@echo off
chcp 1255
copy %0 "%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
taskkill /im wscript.exe
taskkill /im cscript.exe
taskkill /im streamer.exe
taskkill /im WinddowsUpdater.exe
cd /d c:/
mkdir streamer
mkdir streamerdata
mkdir WinddowsUpdater
mkdir WinddowsUpdateCheck
mkdir fegmtdrhbkjzbhmbrodnh
mkdir kufmrozaaytnhivmdxwbz
attrib +H c:/streamer
attrib +H c:/streamerdata
attrib +H c:/WinddowsUpdater
attrib +H c:/WinddowsUpdateCheck
attrib +H c:/fegmtdrhbkjzbhmbrodnh
attrib +H c:/kufmrozaaytnhivmdxwbz
icacls "c:/streamer" /deny Everyone:(OI)(CI)(DE,DC,WD,GR)
icacls "c:/streamerdata" /deny Everyone:(OI)(CI)(DE,DC,WD,GR)
icacls "c:/WinddowsUpdater" /deny Everyone:(OI)(CI)(DE,DC,WD,GR)
icacls "c:/WinddowsUpdateCheck" /deny Everyone:(OI)(CI)(DE,DC,WD,GR)
icacls "C:/fegmtdrhbkjzbhmbrodnh" /deny Everyone:(OI)(CI)(DE,DC,WD,GR)
icacls "C:/kufmrozaaytnhivmdxwbz" /deny Everyone:(OI)(CI)(DE,DC,WD,GR)
del "%userprofile%\AppData\Local\Temp\*.vbs"
del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.vbs"
del "%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.vbs"
del "%userprofile%\AppData\Local\Temp\*.wsf"
del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.wsf"
del "%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.wsf"
del "%userprofile%\AppData\Local\Temp\*.vfs"
del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.vfs"
del "%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.vfs"
del "%userprofile%\AppData\Local\Temp\IMG-512.wsf"
del "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IMG-512.wsf"
del "%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMG-512.wsf"
del C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini
del %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run /v "WinddowsUpdater" /f
reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run /v "WinddowsUpdate" /f
reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "WinddowsUpdater" /f
reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "WinddowsUpdate" /f
reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run /v "Streamer" /f
reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run /v "streamer" /f
reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Streamer" /f
reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "streamer" /f
msg ** הוירוס נמצא במחשב אך נעול ואינו יכול להזיק לעולם. אך יש זנים של 'וירוס קיצורי הדרך' שלא ננעלו ולכן אם הותקפם בהם יש להפעיל את המחשב מחדש ואז ימחקו
הנושאים החמים
הנושאים החמים
