Kill Uchelp.exe

根据达人提供资源编写

【原创】UcHelp 病毒分析 By Cater  [url]http://bbs.pediy.com/showthread.php?t=45699[/url]

 

Kill-Uchelp.bat

-----------------------------------------------------------------------------

pskill -t explorer.exe
attrib -s -h c:\windows\system32\AceExt32.dll
attrib -s -h  "c:\windows\Downloaded Program Files\Ext32.dat"
attrib -s -h  "c:\windows\Downloaded Program Files\Ext32.dll"
attrib -s -h  "c:\windows\Downloaded Program Files\CxUSBKey.exe"
attrib -s -h  "c:\windows\Downloaded Program Files\ZipExt32.dll"
del "c:\windows\system32\AceExt32.dll"
del "c:\windows\Downloaded Program Files\Ext32.dat"
del "c:\windows\Downloaded Program Files\Ext32.dll"
del "c:\windows\Downloaded Program Files\CxUSBKey.exe"
del "c:\windows\Downloaded Program Files\ZipExt32.dll"
start explorer.exe
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\

                  CurrentVersion\ShellServiceObjectDelayLoad /v ZipExt32 /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\

                   CurrentVersion\ShellServiceObjectDelayLoad /v AceExt32 /f
reg delete HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524140} /f
reg delete HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524150} /f

 

 

说明：

1.附件需要分别改名为pskill.exe和pdh.dll

2.文中reg delete后无换行

3.移动设备中的Uchelp.exe可根据Cater写的文档进行手工删除

  （Step1：运用Attrib -s -h取消 RECYCLER下Uchelp.exe的隐藏和系统文件属性）

   （Step2：Del Uchelp.exe）

*在删除移动设备上的文件时，首先需要取消移动设备的AutoRun