-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathusb_vaccine_zh-TW.cmd
1512 lines (1440 loc) · 61.4 KB
/
usb_vaccine_zh-TW.cmd
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
@ECHO OFF
SETLOCAL EnableExtensions
IF CMDEXTVERSION==2 GOTO cmd_ext_ok
ENDLOCAL ;
echo Requires Windows 2000 or later.
GOTO EOF
exit 1;
REM Press Ctrl-C and answer Y to terminate.
COPY CON: NUL:
%0
:cmd_ext_ok
ENDLOCAL
SETLOCAL EnableExtensions EnableDelayedExpansion
REM ---------------------------------------------------------------------------
REM 'usb_vaccine.cmd' version 3 beta zh-TW (2018-07-28)
REM Copyright (C) 2013-2018 Kang-Che Sung <explorer09 @ gmail.com>
REM This program is free software; you can redistribute it and/or
REM modify it under the terms of the GNU Lesser General Public
REM License as published by the Free Software Foundation; either
REM version 2.1 of the License, or (at your option) any later version.
REM This program is distributed in the hope that it will be useful,
REM but WITHOUT ANY WARRANTY; without even the implied warranty of
REM MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
REM Lesser General Public License for more details.
REM You should have received a copy of the GNU Lesser General Public
REM License along with this program. If not, see
REM <http://www.gnu.org/licenses/>.
REM ---------------------------------------------------------------------------
REM CONSTANTS
REM User's default options for commands. Reset.
SET COPYCMD=
SET DIRCMD=
REM Disable user override.
SET CD=
SET ERRORLEVEL=
SET HKLM_SFT=HKLM\SOFTWARE
SET HKLM_CLS=!HKLM_SFT!\Classes
SET HKLM_SFT_WOW=!HKLM_SFT!\Wow6432Node
SET "CMD_SUBKEY=Microsoft\Command Processor"
SET "INF_MAP_SUBKEY=Microsoft\Windows NT\CurrentVersion\IniFileMapping\autorun.inf"
SET "EXPLORER_SUBKEY=Microsoft\Windows\CurrentVersion\Explorer"
SET "ADVANCED_SUBKEY=!EXPLORER_SUBKEY!\Advanced"
SET "SHELL_ICON_SUBKEY=!EXPLORER_SUBKEY!\Shell Icons"
REM BIG5 許蓋功問題 workaround
SET "BIG5_A15E=）"
SET "BIG5_A65E=回"
SET "BIG5_AE7C=徑"
SET "BIG5_B77C=會"
REM Files to keep. The whitelist.
SET KEEP_SYMLINK_FILES=
FOR %%i IN (
"vmlinux" "vmlinuz"
) DO (
SET KEEP_SYMLINK_FILES=!KEEP_SYMLINK_FILES! %%i
)
SET KEEP_HS_ATTRIB_FILES=
FOR %%i IN (
"ibmbio.com" "ibmdos.com" "IO.SYS" "IO.DOS" "WINBOOT.SYS" "JO.SYS" "MSDOS.SYS"
"MSDOS.DOS" "MSDOS.BAK" "MSDOS.W40" "MSDOS.---" "@oldbios.ui" "@oldbdos.ui"
"COMMAND.COM" "COMMAND.DOS" "AUTOEXEC.DOS" "CONFIG.DOS" "OS2BOOT" "OS2LDR"
"OS2LDR.MSG" "OS2KRNL" "OS2DUMP" "OS2VER" "OS2LOGO" "EA DATA. SF" "WP ROOT. SF"
"Nowhere\" "386SPART.PAR" "pagefile.sys" "swapfile.sys" "hiberfil.sys"
"SSPARTSS.ADD" "STACKER.BIN" "STACKER.INI" "STACVOL.DSK" "DBLSPACE.BIN"
"DRVSPACE.BIN" "DBLSPACE.INI" "DRVSPACE.INI" "DBLSPACE.000" "DRVSPACE.000"
"FAILSAFE.DRV\" "@DLWATCH.DAT" "Recycled\" "RECYCLER\" "$Recycle.Bin\"
"boot.ini" "Boot.BAK" "bootfont.bin" "bootsect.dos" "NTDETECT.COM" "ntldr"
"@oldboot.ui" "SUHDLOG.DAT" "SUHDLOG.---" "ldlinux.sys" "ldlinux.c32"
"arcldr.exe" "arcsetup.exe" "Boot\" "bootmgr" "BOOTNXT" "BOOTSECT.BAK"
"BOOTTGT" "BOOTLOG.TXT" "BOOTLOG.PRV" "DETLOG.TXT" "DETLOG.OLD" "NETLOG.TXT"
"SETUPLOG.TXT" "SETUPLOG.OLD" "system.1st" "UNINSTAL.INI" "WINLFN.INI"
"System Volume Information\" "cmdcons\" "cmldr" "Recovery\" "SECURITY.BIN"
"VIDEOROM.BIN" "EBD.SYS"
) DO (
SET KEEP_HS_ATTRIB_FILES=!KEEP_HS_ATTRIB_FILES! %%i
)
SET KEEP_H_ATTRIB_FILES=
FOR %%i IN (
"ibmbio.com" "ibmdos.com" "MSDOS.---" "logo.sys" "@command.ui" "autoexec.bat"
"@AUTOEXE.UI" "config.sys" "@CONFIG.UI" "OS2LDR" "OS2KRNL" "SENTRY\" "Boot.BAK"
"SUHDLOG.DAT" "SUHDLOG.---" "BOOTLOG.TXT" "BOOTLOG.PRV" "SETUPLOG.TXT"
"SETUPLOG.OLD" "ASD.LOG" "CLASSES.1ST" "system.1st" "W95UNDO.DAT" "W95UNDO.INI"
"WINUNDO.DAT" "WINUNDO.INI" "W98UNDO.DAT" "W98UNDO.INI" "W9XUNDO.DAT"
"W9XUNDO.INI" "$INPLACE.~TR\" "$WINDOWS.~Q\" "$Windows.~BT\" "$Windows.~WS\"
"_Restore\" "$WINRE_BACKUP_PARTITION.MARKER" "DOS00I.400" "DOS01L.400"
"ProgramData\" "MSOCache\"
) DO (
SET KEEP_H_ATTRIB_FILES=!KEEP_H_ATTRIB_FILES! %%i
)
SET KEEP_S_ATTRIB_FILES=
FOR %%i IN (
"PCTRACKR.DEL" "boot.ini" "BOOTSECT.BAK"
) DO (
SET KEEP_S_ATTRIB_FILES=!KEEP_S_ATTRIB_FILES! %%i
)
SET KEEP_EXECUTE_FILES=
FOR %%i IN (
"STACKER.EXE" "arcldr.exe" "arcsetup.exe"
) DO (
SET KEEP_EXECUTE_FILES=!KEEP_EXECUTE_FILES! %%i
)
REM ---------------------------------------------------------------------------
REM MAIN
SET g_reg_bak=
SET g_sids=
IF "!opt_move_subdir!"=="" SET opt_move_subdir=\MALWARE
REM Needed by restart routine. SHIFT will change %%*.
SET "args=%*"
:main_parse_options
SET "arg1=%~1"
IF "!arg1!"=="" GOTO main_sanity_test
IF "!arg1!"=="/?" SET opt_help=1
IF "!arg1!"=="-?" SET opt_help=1
IF "!arg1!"=="--help" SET opt_help=1
IF "!arg1:~0,5!"=="--no-" (
FOR %%i IN (restart reg_bak inf_mapping mkdir) DO (
IF "!arg1:-=_!"=="__no_%%i" SET "opt_%%i=SKIP"
)
)
IF "!arg1:~0,7!"=="--skip-" (
FOR %%i IN (
cmd_autorun mountpoints known_ext pif_ext scf_icon scrap_ext
symlink_ext
) DO (
IF "!arg1:-=_!"=="__skip_%%i" SET "opt_%%i=SKIP"
)
)
IF "!arg1:~0,12!"=="--all-users-" (
FOR %%i IN (cmd_autorun known_ext reassoc) DO (
IF "!arg1:-=_!"=="__all_users_%%i" SET "opt_%%i=ALL_USERS"
)
)
IF "!arg1:~0,6!"=="--fix-" (
FOR %%i IN (exe_ext shortcut_icon file_icon) DO (
IF "!arg1:-=_!"=="__fix_%%i" SET "opt_%%i=FIX"
)
)
IF "!arg1!"=="--always-exe-ext" SET "opt_exe_ext=ALWAYS"
IF "!arg1:~0,7!"=="--keep-" (
FOR %%i IN (
symlinks attrib shortcuts folder_exe autorun_inf desktop_ini
) DO (
IF "!arg1:-=_!"=="__keep_%%i" SET "opt_%%i=SKIP"
)
)
IF "!arg1:~0,13!"=="--move-subdir" (
IF "!arg1:~13,1!"=="=" (
REM User quotes the argument so that '=' is included.
SET opt_move_subdir=!arg1:~14!
) ELSE (
REM '=' becomes delimiter. Get the next argument.
SET "opt_move_subdir=%~2"
SHIFT /1
)
)
REM %%0 is needed by restart routine. Don't touch.
SHIFT /1
GOTO main_parse_options
:main_sanity_test
IF "!opt_help!"=="1" SET opt_restart=SKIP
IF "!opt_reg_bak!"=="SKIP" SET g_reg_bak=FAIL
REM Humbly quit when we get a Unix 'find' utility. We won't bother with
REM 'findstr' or (ported) 'grep'.
find . -prune >NUL: 2>NUL: && GOTO main_find_error
ECHO X | find "X" >NUL: 2>NUL: || GOTO main_find_error
IF "!opt_move_subdir!"=="" GOTO main_invalid_path
SET opt_move_subdir=!opt_move_subdir:^"=!
REM ^"
IF "!opt_move_subdir!"=="" GOTO main_invalid_path
SET opt_move_subdir=!opt_move_subdir:/=\!
IF /I "!opt_move_subdir!"=="NUL:" SET opt_move_subdir=NUL
REM Technically we can't check for every possibility of valid path without
REM actually 'mkdir' with it, but we may filter out common path attacks.
IF "!opt_move_subdir:~0,2!"=="\\" GOTO main_invalid_path
REM Windows 9x allows "\...\", "\....\" and so on for grandparent or any
REM ancestor directory. Thankfully it doesn't work anymore in NT.
SET "name=\!opt_move_subdir!\"
IF NOT "!name!"=="!name:*\..\=!" GOTO main_invalid_path
CALL :has_path_char ":*?<>|" && GOTO main_invalid_path
REM Check if "FOR /F" supports unquoted options and 'eol' being null.
REM Check this in a subshell because (a) it won't halt our script in case of
REM unsupported syntax, and (b) we need to disable Command Processor AutoRun.
SET g_cmdfor_unquoted_opts=0
SET "a=FOR /F tokens^=1-2^ delims^=^"
SET b="^ eol^= %%i IN (" ;""x") DO IF NOT "%%i.%%j"==" ;.x^" EXIT /B 1
REM ^"
!ComSpec! /q /d /e:on /c "!a!!b!" >NUL: 2>NUL: && SET g_cmdfor_unquoted_opts=1
REM Delayed expansion is not performed in FOR options field.
IF "!g_cmdfor_unquoted_opts!"=="1" (
SET "FOR_OPTS_FOR_DIR_B=/F delims^=^ eol^="
) ELSE (
SET FOR_OPTS_FOR_DIR_B=/F "eol=/ delims="
ECHO 警告：此命令直譯器（cmd.exe!BIG5_A15E!不支援無引號的 "FOR /F" 選項字串。>&2
)
SET g_is_wow64=0
IF DEFINED PROCESSOR_ARCHITEW6432 (
IF NOT "!opt_restart!"=="SKIP" GOTO main_restart_native
SET g_is_wow64=1
ECHO 注意：偵測到 WoW64 的執行環境。本腳本應該要在作業系統預設的 64 位元的命令直譯器>&2
ECHO （cmd.exe!BIG5_A15E!下執行。>&2
)
reg query "HKCU" >NUL: 2>NUL: || (
REM Without 'reg', we cannot detect Command Processor AutoRun, so always
REM try restarting without it before going further.
IF NOT "!opt_restart!"=="SKIP" GOTO main_restart
ECHO.>&2
ECHO *** 錯誤：無法使用 reg.exe 來存取 Windows 登錄！>&2
ECHO.>&2
ECHO 如果您使用 Windows 2000，請安裝 Windows 2000 支援工具。>&2
ECHO 詳情請見 ^<https://support.microsoft.com/kb/301423^>，您可以從此下載支援工具：>&2
ECHO ^<https://www.microsoft.com/download/details.aspx?id=18614^>>&2
IF "!opt_help!"=="1" GOTO main_help
ECHO.>&2
ECHO 所有登錄檔工作將!BIG5_B77C!被跳過。>&2
GOTO main_all_drives
)
SET has_wow64=0
reg query "!HKLM_SFT_WOW!" >NUL: 2>NUL: && SET has_wow64=1
:main_cmd_autorun
REM The Command Processor AutoRun will execute every time we do command
REM substitution (via "FOR /F") and may pollute output of our every command.
SET has_cmd_autorun=0
FOR %%k IN (!HKLM_SFT_WOW! !HKLM_SFT! HKCU\Software) DO (
REM "reg query" outputs header lines even if key or value doesn't exist.
reg query "%%k\!CMD_SUBKEY!" /v "AutoRun" >NUL: 2>NUL: && (
IF NOT "!opt_restart!"=="SKIP" GOTO main_restart
SET has_cmd_autorun=1
REM Show user the AutoRun values along with error message below.
REM Key name included in "reg query" output.
IF "!g_is_wow64!!has_wow64!%%k"=="10!HKLM_SFT!" (
ECHO （底下的機碼為 WoW64 重定向的機碼，它的實際名稱為>&2
ECHO "!HKLM_SFT_WOW!\!CMD_SUBKEY!"!BIG5_A15E!>&2
)
IF NOT "!g_is_wow64!!has_wow64!%%k"=="11!HKLM_SFT!" (
reg query "%%k\!CMD_SUBKEY!" /v "AutoRun" >&2
)
)
)
IF "!has_cmd_autorun!"=="1" (
ECHO *** 注意：在此訊息顯示之前，您的命令直譯器（cmd.exe!BIG5_A15E!已經自動執行了一些命令，這>&2
ECHO 些命令可能為惡意程式。>&2
)
IF "!opt_help!"=="1" GOTO main_help
IF "!opt_cmd_autorun!"=="SKIP" GOTO main_inf_mapping
IF "!has_cmd_autorun!"=="1" (
IF NOT "!opt_cmd_autorun!"=="ALL_USERS" (
ECHO [cmd-autorun]
ECHO 為了安全性的原因，我們將刪除上面列出的 "AutoRun" 登錄值。
ECHO （影響全機與目前使用者的設定。此無法被復原。若要刪除所有使用者的設定，請指定
ECHO '--all-users-cmd-autorun' 選項。!BIG5_A15E!
CALL :continue_prompt || GOTO main_inf_mapping
)
FOR %%k IN (!HKLM_SFT_WOW! !HKLM_SFT! HKCU\Software) DO (
CALL :delete_reg_value "%%k" "!CMD_SUBKEY!" "AutoRun" "Command Processor /v AutoRun"
)
)
IF "!opt_cmd_autorun!"=="ALL_USERS" (
CALL :prepare_sids
FOR %%i IN (!g_sids!) DO (
ECHO SID %%~i
CALL :delete_reg_value "HKU\%%~i\Software" "!CMD_SUBKEY!" "AutoRun" "Command Processor /v AutoRun"
)
)
:main_inf_mapping
SET has_inf_mapping=1
reg query "!HKLM_SFT!\!INF_MAP_SUBKEY!" /ve 2>NUL: | find /I "@" >NUL: || (
SET has_inf_mapping=0
ECHO.>&2
ECHO *** 注意：您的電腦易受 AutoRun 惡意軟體的攻擊！>&2
)
ECHO.
ECHO 本程式可以幫助您關閉自動執行（AutoRun!BIG5_A15E!、清理您磁碟裡的 autorun.inf 檔案、移除
ECHO 捷!BIG5_AE7C!並顯示被隱藏的檔案。這些動作復原 AutoRun 惡意軟體做造成的傷害。
ECHO 本程式「並不!BIG5_B77C!」移除惡意軟體本身，所以不能用來取代防毒軟體。請安裝一套防毒軟體
ECHO 來保護您的電腦。
ECHO 如果您使用 Windows 2000、XP、Server 2003、Vista 或 Server 2008，我們強烈建議您
ECHO 安裝微軟的 KB967715 與 KB971029 更新，此二更新修正了 AutoRun 實作的臭蟲（即使我
ECHO 們!BIG5_B77C!停止所有的 AutoRun!BIG5_A15E!。
ECHO 請見 ^<https://technet.microsoft.com/library/security/967940.aspx^>
REM Credit to Nick Brown for the solution to disable AutoRun. See:
REM http://archive.today/CpwOH
REM http://www.computerworld.com/article/2481506
REM Works with Windows 7 too, and I believe it's safer to disable ALL AutoRuns
REM in Windows 7 and above, rather than let go some devices.
REM Other references:
REM http://www.kb.cert.org/vuls/id/889747
REM https://www.us-cert.gov/ncas/alerts/TA09-020A
IF "!has_inf_mapping!"=="1" GOTO main_mountpoints
IF "!opt_inf_mapping!"=="SKIP" GOTO main_mountpoints
ECHO.
ECHO [inf-mapping]
ECHO 當您放入光碟，或滑鼠點擊光碟機圖示時，Windows 在預設下!BIG5_B77C!自動執行某些程式（通常
ECHO 是安裝程式!BIG5_A15E!。原本是提供方便，但這個「自動執行」（AutoRun!BIG5_A15E!設計卻容易被惡意軟體
ECHO 利用，在使用者未查覺的情況下自動執行。
ECHO 我們將關閉所有自動執行（AutoRun!BIG5_A15E!，並停止 Windows 剖析任何 autorun.inf 檔案。關
ECHO 閉 AutoRun 之後，如果您要從光碟裡面安裝或執行軟體，您必須手動開啟裡面的
ECHO Setup.exe。這並不影響音樂，電影光碟，或 USB 裝置的自動播放（AutoPlay!BIG5_A15E!功能。
ECHO （這是全機設定。!BIG5_A15E!
CALL :continue_prompt || GOTO main_mountpoints
CALL :backup_reg "!HKLM_SFT!" "!INF_MAP_SUBKEY!" /ve
reg add "!HKLM_SFT!\!INF_MAP_SUBKEY!" /ve /t REG_SZ /d "@SYS:DoesNotExist" /f >NUL:
IF ERRORLEVEL 1 (
CALL :show_reg_write_error "IniFileMapping\autorun.inf"
) ELSE (
CALL :delete_reg_key "!HKLM_SFT!" "DoesNotExist" "!HKLM_SFT!\DoesNotExist"
)
IF "!has_wow64!"=="1" (
CALL :backup_reg "!HKLM_SFT_WOW!" "!INF_MAP_SUBKEY!" /ve
reg add "!HKLM_SFT_WOW!\!INF_MAP_SUBKEY!" /ve /t REG_SZ /d "@SYS:DoesNotExist" /f >NUL:
IF ERRORLEVEL 1 (
CALL :show_reg_write_error "(WoW64) IniFileMapping\autorun.inf"
) ELSE (
CALL :delete_reg_key "!HKLM_SFT_WOW!" "DoesNotExist" "(WoW64) !HKLM_SFT!\DoesNotExist"
)
)
:main_mountpoints
IF "!opt_mountpoints!"=="SKIP" GOTO main_known_ext
REM "MountPoints" for Windows 2000, "MountPoints2" for Windows XP and later.
ECHO.
ECHO [mountpoints]
ECHO "MountPoints"（或 "MountPoints2"!BIG5_A15E!登錄機碼為 Windows 檔案總管的 AutoRun 快取資
ECHO 料，在 AutoRun 關閉之後，清理機碼以避免之前裝置的 AutoRun 威脅。
ECHO （影響所有使用者的設定。此無法被復原。!BIG5_A15E!
CALL :continue_prompt || GOTO main_known_ext
CALL :prepare_sids
FOR %%i IN (!g_sids!) DO (
ECHO SID %%~i
FOR %%k IN (MountPoints MountPoints2) DO (
CALL :clean_reg_key "HKU\%%~i\Software" "!EXPLORER_SUBKEY!\%%k" "Explorer\%%k"
)
)
:main_known_ext
IF "!opt_known_ext!"=="SKIP" GOTO main_exe_ext
REM The value shouldn't exist in HKLM and doesn't work there. Silently delete.
FOR %%k IN (!HKLM_SFT! !HKLM_SFT_WOW!) DO (
reg delete "%%k\!ADVANCED_SUBKEY!" /v "HideFileExt" /f >NUL: 2>NUL:
)
IF NOT "!opt_known_ext!"=="ALL_USERS" (
ECHO.
ECHO [known-ext]
ECHO Windows 預設!BIG5_B77C!隱藏已知檔案類型的副檔名，但是應用程式可以有自訂的圖示，在副檔名
ECHO 被隱藏的時候，惡意程式可以利用圖示來偽裝成普通檔案或資料夾，以誘騙使用者去開啟
ECHO 它們。
ECHO 我們將取消「控制台」→「資料夾選項」的「隱藏已知檔案類型的副檔名」，使得常用的
ECHO 副檔名（除捷!BIG5_AE7C!外!BIG5_A15E!永遠被顯示。使用者可以透過副檔名來辨認檔案是否為執行檔（而且
ECHO 可疑!BIG5_A15E!，以下為可執行的檔案類型：
ECHO .com（MS-DOS 應用程式!BIG5_A15E! .cmd（Windows NT 命令腳本!BIG5_A15E!
ECHO .exe（應用程式!BIG5_A15E! .scr（螢幕保護程式!BIG5_A15E!
ECHO .bat（批次檔案!BIG5_A15E!
ECHO （影響目前使用者的設定，若要更改所有使用者的設定，請指定
ECHO '--all-users-known-ext' 選項。!BIG5_A15E!
CALL :continue_prompt || GOTO main_exe_ext
)
REM "HideFileExt" is enabled (0x1) if value does not exist.
reg add "HKCU\Software\!ADVANCED_SUBKEY!" /v "HideFileExt" /t REG_DWORD /d 0 /f >NUL: || (
CALL :show_reg_write_error "Explorer\Advanced /v HideFileExt"
)
IF "!opt_known_ext!"=="ALL_USERS" (
CALL :prepare_sids
FOR %%i IN (!g_sids!) DO (
ECHO SID %%~i
reg add "HKU\%%~i\Software\!ADVANCED_SUBKEY!" /v "HideFileExt" /t REG_DWORD /d 0 /f >NUL: || (
CALL :show_reg_write_error "Explorer\Advanced /v HideFileExt"
)
)
)
:main_exe_ext
IF "!opt_exe_ext!"=="ALWAYS" (
FOR %%k IN (exefile scrfile) DO (
reg add "!HKLM_CLS!\%%k" /v "AlwaysShowExt" /t REG_SZ /f >NUL: || (
CALL :show_reg_write_error "HKCR\%%k /v AlwaysShowExt"
)
)
SET opt_exe_ext=FIX
)
IF NOT "!opt_exe_ext!"=="FIX" GOTO main_pif_ext
FOR %%e IN (com exe bat scr cmd) DO (
CALL :delete_reg_value "!HKLM_CLS!" "%%efile" "NeverShowExt" "HKCR\%%efile /v NeverShowExt"
)
SET list="com=comfile" "exe=exefile" "bat=batfile" "scr=scrfile" "cmd=cmdfile"
CALL :reassoc_file_types !list!
:main_pif_ext
SET "user_msg=目前使用者"
IF "!opt_reassoc!"=="ALL_USERS" SET "user_msg=所有使用者"
IF "!opt_pif_ext!"=="SKIP" GOTO main_scf_icon
REM .pif files already have shortcut arrows; no need to suggest AlwaysShowExt.
reg query "!HKLM_CLS!\piffile" /v "NeverShowExt" >NUL: 2>NUL: || (
GOTO main_scf_icon
)
REM Thankfully cmd.exe handles .pif right. Only Windows Explorer has this flaw.
ECHO.
ECHO [pif-ext]
ECHO .pif 檔案為 DOS 程式的捷!BIG5_AE7C!。Windows 檔案總管!BIG5_B77C!在使用者請求建立 .com 執行檔的捷
ECHO !BIG5_AE7C!時產生 .pif 檔。然而，檔案總管在處理此檔案類型時有個設計缺陷，如果有人把執行
ECHO 檔重新命名為 .pif 副檔名，而使用者開啟該 .pif 檔案，程式碼就!BIG5_B77C!被執行。此缺陷可
ECHO 以被利用。（執行檔被重新命名為 .pif 檔案後，!BIG5_B77C!取決於 Windows 版本，顯示一般檔案
ECHO 的圖示或是 MS-DOS 圖示。!BIG5_A15E!
ECHO 我們將刪除此檔案類型的 "NeverShowExt" 登錄值，若使用者取消了「隱藏已知檔案類型
ECHO 的副檔名」，他們將!BIG5_B77C!看見 .pif 的副檔名。這可提高警覺。
ECHO （這是全機設定。同時!user_msg!對於此檔案類型的關聯!BIG5_B77C!被重設，而此無法被復原。!BIG5_A15E!
CALL :continue_prompt || GOTO main_scf_icon
CALL :delete_reg_value "!HKLM_CLS!" "piffile" "NeverShowExt" "HKCR\piffile /v NeverShowExt"
CALL :reassoc_file_types "pif=piffile"
:main_scf_icon
IF "!opt_scf_icon!"=="SKIP" GOTO main_scrap_ext
reg query "!HKLM_CLS!\SHCmdFile" >NUL: 2>NUL: || GOTO main_scrap_ext
reg query "!HKLM_CLS!\SHCmdFile" /v "IsShortcut" >NUL: 2>NUL: && (
GOTO main_scrap_ext
)
ECHO.
ECHO [scf-icon]
ECHO .scf 檔案為 Windows 檔案總管殼層（shell!BIG5_A15E!的指令檔。它們!BIG5_B77C!在使用者開啟的時候執行
ECHO 殼層的內部命令。最常見的例子為 Windows Vista 之前版本的快速啟動列上面的「顯示桌
ECHO 面」。（Vista 或之後的「顯示桌面」圖示為 .lnk 檔案。!BIG5_A15E!即使格式本身不允許程式
ECHO 碼，當殼層的命令被無意間執行時，仍然有可能嚇到使用者。
ECHO 我們將為此檔案類型添加捷!BIG5_AE7C!箭頭圖示，以提高使用者的警覺。
ECHO （這是全機設定。同時!user_msg!對於此檔案類型的關聯!BIG5_B77C!被重設，而此無法被復原。!BIG5_A15E!
CALL :continue_prompt || GOTO main_scrap_ext
reg add "!HKLM_CLS!\SHCmdFile" /v "IsShortcut" /t REG_SZ /f >NUL: || (
CALL :show_reg_write_error "HKCR\SHCmdFile /v IsShortcut"
)
CALL :reassoc_file_types "scf=SHCmdFile"
:main_scrap_ext
REM Thanks to PCHelp and others for discovering this security flaw. See:
REM http://www.pc-help.org/security/scrap.htm
REM Other references:
REM http://www.trojanhunter.com/papers/scrapfiles/
REM http://www.giac.org/paper/gsec/614/wrapping-malicious-code-windows-shell-scrap-objects/101444
REM WordPad, Office Word and Excel are all known to support scrap files.
IF "!opt_scrap_ext!"=="SKIP" GOTO main_symlink_ext
REM Scrap files already have static icon; no need to suggest AlwaysShowExt.
SET scrap_ext_keys=
FOR %%k IN (ShellScrap DocShortcut) DO (
reg query "!HKLM_CLS!\%%k" /v "NeverShowExt" >NUL: 2>NUL: && (
SET scrap_ext_keys=!scrap_ext_keys! %%k
)
)
IF "!scrap_ext_keys!"=="" GOTO main_symlink_ext
ECHO.
ECHO [scrap-ext]
ECHO .shs 與 .shb 檔案分別為儲存文件剪輯資料（scrap!BIG5_A15E!與文件捷!BIG5_AE7C!的格式。它們!BIG5_B77C!在使用
ECHO 者從文件編輯器（例如 WordPad!BIG5_A15E!中拖曳文字出去時產生。此格式允許嵌入可執行的程式
ECHO 碼，當使用者開啟一個（特別製作的!BIG5_A15E!此類型的檔案，程式碼就!BIG5_B77C!被執行。（Windows
ECHO Vista 與之後已經移除剪輯資料檔案的支援。!BIG5_A15E!
ECHO 我們將刪除這些檔案類型的 "NeverShowExt" 登錄值，若使用者取消了「隱藏已知檔案類
ECHO 型的副檔名」，他們將!BIG5_B77C!看見 .shs 與 .shb 的副檔名。這可提高警覺。
ECHO （這是全機設定。同時!user_msg!對於此檔案類型的關聯!BIG5_B77C!被重設，而此無法被復原。!BIG5_A15E!
CALL :continue_prompt || GOTO main_symlink_ext
FOR %%k IN (!scrap_ext_keys!) DO (
CALL :delete_reg_value "!HKLM_CLS!" "%%k" "NeverShowExt" "HKCR\%%k /v NeverShowExt"
)
CALL :reassoc_file_types "shs=ShellScrap" "shb=DocShortcut"
:main_symlink_ext
REM The ".symlink" association only applies to Windows 8.1 or later, or
REM Windows 7 SP1 with KB3009980 hotfix. This requires shell32.dll's support.
IF "!opt_symlink_ext!"=="SKIP" GOTO main_shortcut_icon
REM If symlinks are not "known" (i.e. there's no "HKCR\.symlink" entry), then
REM the extensions will be always shown. Don't bother then.
reg query "!HKLM_CLS!\.symlink" >NUL: 2>NUL: || GOTO main_shortcut_icon
reg query "!HKLM_CLS!\.symlink" /v "AlwaysShowExt" >NUL: 2>NUL: && (
reg query "!HKLM_CLS!\.symlink" /v "NeverShowExt" >NUL: 2>NUL: || (
GOTO main_shortcut_icon
)
)
ECHO.
ECHO [symlink-ext]
ECHO 符號連結（symbolic link!BIG5_A15E!是 NTFS 檔案系統中的一種特殊檔案。它類似於捷!BIG5_AE7C!，根據
ECHO 路!BIG5_AE7C!與檔名來連結到另一個檔案。符號連結!BIG5_B77C!顯示捷!BIG5_AE7C!的箭頭圖示來辨別。符號連結的不
ECHO 同之處在於它可以是任意的副檔名或不帶副檔名。Windows 檔案總管!BIG5_B77C!預設隱藏符號連結
ECHO 的副檔名（例如 ".txt" 或 ".exe"，它不像捷!BIG5_AE7C!的 ".lnk" 能標記自己為連結!BIG5_A15E!。隱藏
ECHO 符號連結的副檔名並不像隱藏捷!BIG5_AE7C!的 ".lnk" 有意義。
ECHO 我們將強制檔案符號連結永遠顯示其副檔名。這無論使用者是否使用「隱藏已知檔案類型
ECHO 的副檔名」的選項。
ECHO （這是全機設定。同時!user_msg!對於此檔案類型的關聯!BIG5_B77C!被重設，而此無法被復原。!BIG5_A15E!
CALL :continue_prompt || GOTO main_shortcut_icon
reg add "!HKLM_CLS!\.symlink" /v "AlwaysShowExt" /t REG_SZ /f >NUL: || (
CALL :show_reg_write_error "HKCR\.symlink /v AlwaysShowExt"
)
CALL :delete_reg_value "!HKLM_CLS!" ".symlink" "NeverShowExt" "HKCR\.symlink /v NeverShowExt"
CALL :reassoc_file_types "symlink=.symlink"
:main_shortcut_icon
IF NOT "!opt_shortcut_icon!"=="FIX" GOTO main_file_icon
FOR %%k IN (piffile lnkfile DocShortcut InternetShortcut) DO (
reg query "!HKLM_CLS!\%%k" >NUL: 2>NUL: && (
reg add "!HKLM_CLS!\%%k" /v "IsShortcut" /t REG_SZ /f >NUL: || (
CALL :show_reg_write_error "HKCR\%%k /v IsShortcut"
)
)
)
reg query "!HKLM_CLS!\Application.Reference" >NUL: 2>NUL: && (
reg add "!HKLM_CLS!\Application.Reference" /v "IsShortcut" /t REG_SZ /f >NUL: || (
CALL :show_reg_write_error "Application.Reference /v IsShortcut"
)
)
REM The data string "NULL" is in the original entry, in both Groove 2007 and
REM SharePoint Workspace 2010.
reg query "!HKLM_CLS!\GrooveLinkFile" >NUL: 2>NUL: && (
reg add "!HKLM_CLS!\GrooveLinkFile" /v "IsShortcut" /t REG_SZ /d "NULL" /f >NUL: || (
CALL :show_reg_write_error "HKCR\GrooveLinkFile /v IsShortcut"
)
)
CALL :delete_reg_value "!HKLM_SFT!" "!SHELL_ICON_SUBKEY!" "29" "Explorer\Shell Icons /v 29"
IF NOT "!opt_file_icon!"=="FIX" (
SET list="pif=piffile" "lnk=lnkfile" "shb=DocShortcut" "url=InternetShortcut"
SET list=!list! "appref-ms=Application.Reference" "glk=GrooveLinkFile"
CALL :reassoc_file_types !list!
)
:main_file_icon
IF NOT "!opt_file_icon!"=="FIX" GOTO main_all_drives
REM "DefaultIcon" for "Unknown" is configurable since Windows Vista.
SET key=Unknown\DefaultIcon
CALL :backup_reg "!HKLM_CLS!" "!key!" /ve
IF NOT "!ERRORLEVEL!"=="1" (
reg add "!HKLM_CLS!\!key!" /ve /t REG_EXPAND_SZ /d "%%SystemRoot%%\System32\shell32.dll,0" /f >NUL: || (
CALL :show_reg_write_error "HKCR\!key!"
)
)
SET key=comfile\DefaultIcon
CALL :backup_reg "!HKLM_CLS!" "!key!" /ve
reg add "!HKLM_CLS!\!key!" /ve /t REG_EXPAND_SZ /d "%%SystemRoot%%\System32\shell32.dll,2" /f >NUL: || (
CALL :show_reg_write_error "HKCR\!key!"
)
SET key=comfile\shellex\IconHandler
CALL :delete_reg_key "!HKLM_CLS!" "!key!" "HKCR\!key!"
REM Two vulnerabilities exist in the .lnk and .pif IconHandler:
REM MS10-046 (CVE-2010-2568), MS15-020 (CVE-2015-0096)
REM Windows 2000 has no patch for either. XP has only patch for MS10-046.
REM Expect that user disables the IconHandler as the workaround.
FOR %%k IN (piffile lnkfile) DO (
CALL :delete_reg_key "!HKLM_CLS!" "%%k\DefaultIcon" "HKCR\%%k\DefaultIcon"
SET key=%%k\shellex\IconHandler
CALL :backup_reg "!HKLM_CLS!" "!key!" /ve
reg add "!HKLM_CLS!\!key!" /ve /t REG_SZ /d "{00021401-0000-0000-C000-000000000046}" /f >NUL: || (
CALL :show_reg_write_error "HKCR\!key!"
)
)
REM Scrap file types. Guaranteed to work (and only) in Windows 2000 and XP.
FOR %%k IN (ShellScrap DocShortcut) DO (
reg query "!HKLM_CLS!\%%k" >NUL: 2>NUL: && (
CALL :backup_reg "!HKLM_CLS!" "%%k\DefaultIcon" /ve
reg add "!HKLM_CLS!\%%k\DefaultIcon" /ve /t REG_EXPAND_SZ /d "%%SystemRoot%%\System32\shscrap.dll,-100" /f >NUL: || (
CALL :show_reg_write_error "HKCR\%%k\DefaultIcon"
)
CALL :delete_reg_key "!HKLM_CLS!" "%%k\shellex\IconHandler" "%%k\shellex\IconHandler"
)
)
REM The "InternetShortcut" key has "DefaultIcon" subkey whose Default value
REM differs among IE versions.
reg query "!HKLM_CLS!\InternetShortcut" >NUL: 2>NUL: && (
SET key=InternetShortcut\shellex\IconHandler
CALL :backup_reg "!HKLM_CLS!" "!key!" /ve
reg add "!HKLM_CLS!\!key!" /ve /t REG_SZ /d "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" /f >NUL: || (
CALL :show_reg_write_error "InternetShortcut IconHandler"
)
)
reg query "!HKLM_CLS!\SHCmdFile" >NUL: 2>NUL: && (
CALL :delete_reg_key "!HKLM_CLS!" "SHCmdFile\DefaultIcon" "HKCR\SHCmdFile\DefaultIcon"
SET key=SHCmdFile\shellex\IconHandler
CALL :backup_reg "!HKLM_CLS!" "!key!" /ve
reg add "!HKLM_CLS!\!key!" /ve /t REG_SZ /d "{57651662-CE3E-11D0-8D77-00C04FC99D61}" /f >NUL: || (
CALL :show_reg_write_error "HKCR\!key!"
)
)
reg query "!HKLM_CLS!\Application.Reference" >NUL: 2>NUL: && (
SET key=Application.Reference\DefaultIcon
CALL :delete_reg_key "!HKLM_CLS!" "!key!" "!key!"
SET key=Application.Reference\shellex\IconHandler
CALL :backup_reg "!HKLM_CLS!" "!key!" /ve
reg add "!HKLM_CLS!\!key!" /ve /t REG_SZ /d "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" /f >NUL: || (
CALL :show_reg_write_error "Application.Reference IconHandler"
)
)
REM The "GrooveLinkFile" key has "DefaultIcon" value (data: "%1") and no
REM "DefaultIcon" subkey.
reg query "!HKLM_CLS!\GrooveLinkFile" >NUL: 2>NUL: && (
SET key=GrooveLinkFile\ShellEx\IconHandler
CALL :backup_reg "!HKLM_CLS!" "!key!" /ve
reg add "!HKLM_CLS!\!key!" /ve /t REG_SZ /d "{387E725D-DC16-4D76-B310-2C93ED4752A0}" /f >NUL: || (
CALL :show_reg_write_error "!key!"
)
)
REM We don't reset associations for .url files because user's favorite browser
REM may have its own settings.
SET list="com=comfile" "pif=piffile" "lnk=lnkfile" "shs=ShellScrap"
SET list=!list! "shb=DocShortcut" "scf=SHCmdFile"
SET list=!list! "appref-ms=Application.Reference" "glk=GrooveLinkFile"
CALL :reassoc_file_types !list!
:main_all_drives
ECHO.
ECHO 現在我們將處理所有磁碟機的根目錄。
ECHO 請插入所有受惡意軟體影響的儲存裝置，包括 USB 隨身碟、外接硬碟、記憶卡、PDA、智
ECHO 慧型手機與數位相機。如果您有 CD- 或 DVD-RW 光碟在光碟機裡，建議您退出它們，以免
ECHO 誤啟動燒錄的動作。
IF /I "!opt_move_subdir!"=="NUL" (
ECHO 假如可行的話，被發現為可疑的檔案將!BIG5_B77C!被直接刪除。
) ELSE (
ECHO 假如可行的話，被發現為可疑的檔案將!BIG5_B77C!被移動到磁碟裡名為
ECHO "!opt_move_subdir!" 的子目錄。
)
ECHO 如果您在此輸入 'skip'，則本程式!BIG5_B77C!結束。
CALL :continue_prompt || GOTO main_end
REM Symlinks have to be handled first because we can't guarantee that user's
REM 'attrib' utility supports '/L' (don't follow symlinks).
IF NOT "!opt_symlinks!"=="SKIP" (
ECHO.
ECHO [symlinks] ^(1 / 7^)
ECHO 從 Windows Vista 開始，NTFS 檔案系統支援「符號連結」（symbolic link!BIG5_A15E!。符號連結
ECHO 是一種特殊的檔案，功能類似捷!BIG5_AE7C!檔，也帶有捷!BIG5_AE7C!的箭頭圖示，但是符號連結屬於檔案系
ECHO 統的功能，並且不需帶有副檔名。有些惡意軟體!BIG5_B77C!建立指向（惡意!BIG5_A15E!執行檔的符號連結，
ECHO 以誘騙使用者去開啟它們。
IF /I "!opt_move_subdir!"=="NUL" (
ECHO 我們將刪除存放在根目錄中所有指向檔案（非目錄!BIG5_A15E!的符號連結。
) ELSE (
ECHO 我們將移走存放在根目錄中所有指向檔案（非目錄!BIG5_A15E!的符號連結。
ECHO 注意：由於技術限制，帶有「隱藏」或「系統」屬性的符號連結反而!BIG5_B77C!被直接刪除。
)
CALL :continue_prompt || SET opt_symlinks=SKIP
)
REM [attrib] must be done before moving anything, or MOVE refuses to move
REM Hidden or System files.
IF NOT "!opt_attrib!"=="SKIP" (
ECHO.
ECHO [attrib] ^(2 / 7^)
ECHO 當檔案有設定「隱藏」或「系統」屬性，它們就預設不!BIG5_B77C!在 Windows 檔案總管或 DIR 命
ECHO 令中顯示。有些惡意軟體!BIG5_B77C!隱藏檔案，並產生相同名稱的執行檔（或是指向執行檔的捷
ECHO !BIG5_AE7C!!BIG5_A15E!，以誘騙使用者去開啟它們。（惡意軟體並不!BIG5_B77C!真正刪除掉檔案，不然刪除檔案時空
ECHO 出的磁碟空間很容易引起使用者或防毒軟體的注意。!BIG5_A15E!
ECHO 除了已知真正的作業系統檔案，我們將解除根目錄中所有檔案與資料夾的「隱藏」與「系
ECHO 統」屬性。這復原所有被惡意軟體隱藏的檔案（可能也!BIG5_B77C!顯示惡意軟體檔案本身!BIG5_A15E!。
CALL :continue_prompt || SET opt_attrib=SKIP
)
IF NOT "!opt_shortcuts!"=="SKIP" (
ECHO.
ECHO [shortcuts] ^(3 / 7^)
IF /I "!opt_move_subdir!"=="NUL" (
ECHO 我們將刪除根目錄中以下類型的捷!BIG5_AE7C!檔案：.pif、.lnk、.shb、.url、.appref-ms 與
ECHO .glk.
) ELSE (
ECHO 我們將移走根目錄中以下類型的捷!BIG5_AE7C!檔案：.pif、.lnk、.shb、.url、.appref-ms 與
ECHO .glk.
)
CALL :continue_prompt || SET opt_shortcuts=SKIP
)
IF NOT "!opt_folder_exe!"=="SKIP" (
REM COM format does not allow icons and Explorer won't show custom icons
REM for an NE or PE renamed to .com.
ECHO.
ECHO [folder-exe] ^(4 / 7^)
ECHO 有些惡意軟體!BIG5_B77C!隱藏資料夾，並產生相同名稱的執行檔，通常同時帶著資料夾圖示，以誘
ECHO 騙使用者去開啟它們。
IF /I "!opt_move_subdir!"=="NUL" (
ECHO 我們將刪除存放在根目錄中且與現存資料夾相同名稱的執行檔。!BIG5_B77C!被刪除的檔案類型為
ECHO .exe 與 .scr。
) ELSE (
ECHO 我們將移走存放在根目錄中且與現存資料夾相同名稱的執行檔。!BIG5_B77C!被移動的檔案類型為
ECHO .exe 與 .scr。
)
ECHO 警告：這可能!BIG5_B77C!影響到合法的應用程式，若有疑慮，請跳過此步驟。
CALL :continue_prompt || SET opt_folder_exe=SKIP
)
IF NOT "!opt_autorun_inf!"=="SKIP" (
ECHO.
ECHO [autorun-inf] ^(5 / 7^)
ECHO 有些惡意軟體!BIG5_B77C!建立 autorun.inf 檔案，使自己能在沒有關閉 AutoRun 的電腦裡被自動
ECHO 執行。除了光碟機以外，其它磁碟機都不應該含有名為 autorun.inf 的檔案。
IF /I "!opt_move_subdir!"=="NUL" (
ECHO 我們將刪除它們。
) ELSE (
ECHO 我們將移動並把它們重新命名為 "!opt_move_subdir!\_autorun.in0"。
)
IF NOT "!opt_attrib!"=="SKIP" (
ECHO 同時，對於在根目錄中名為 "autorun.inf" 的資料夾，我們將保留其「隱藏」或「系統」
ECHO 屬性（如果有設定的話!BIG5_A15E!。如果您選擇跳過，則資料夾!BIG5_B77C!被解除隱藏而顯示出來。
)
CALL :continue_prompt || SET opt_autorun_inf=SKIP
)
REM We won't deal with Folder.htt, because technically it could be any name in
REM any location, as specified in Desktop.ini.
IF NOT "!opt_desktop_ini!"=="SKIP" (
ECHO.
ECHO [desktop-ini] ^(6 / 7^)
ECHO 在 Windows 98、2000 或 Me（或是安裝了 IE4 的 95 或 NT 4.0!BIG5_A15E!裡，有個「自訂此資料
ECHO 夾」的功能，它允許自訂磁碟的根資料夾、建立或編輯資料夾的「Web 畫面」範本（通常
ECHO 名為 "Folder.htt"!BIG5_A15E!。該範本允許嵌入 JavaScript 或 VBScript，而這些指令碼!BIG5_A65E!在使
ECHO 用者「瀏覽」資料夾的時候被執行。
ECHO 如果您使用 Windows 2000 或 XP，我們建議您安裝最新的 Service Pack（至少 2000 SP3
ECHO 或 XP SP1!BIG5_A15E!以修補允許自訂範本所造成的安全風險。Vista 與之後版本是安全的。
ECHO "Desktop.ini" 檔案指定了資料夾要使用哪份範本，然而在根目錄裡面，不應該存在
ECHO Desktop.ini 檔案。（不是每個 Desktop.ini 功能都在根資料夾裡有效，而自訂的 Web
ECHO 畫面範本可用在根資料夾中並不是當初設計的一部分。!BIG5_A15E!
IF /I "!opt_move_subdir!"=="NUL" (
ECHO 我們將刪除根目錄中的 "Desktop.ini" 檔案。
) ELSE (
ECHO 我們將從根目錄中移走 "Desktop.ini" 檔案，並把它們重新命名為
ECHO "!opt_move_subdir!\_Desktop.in0"。
)
IF NOT "!opt_attrib!"=="SKIP" (
ECHO 同時，對於在根目錄中名為 "Desktop.ini" 的資料夾，我們將保留其「隱藏」或「系統」
ECHO 屬性（如果有設定的話!BIG5_A15E!。如果您選擇跳過，則資料夾!BIG5_B77C!被解除隱藏而顯示出來。
)
CALL :continue_prompt || SET opt_desktop_ini=SKIP
)
IF "!opt_autorun_inf!.!opt_desktop_ini!"=="SKIP.SKIP" SET opt_mkdir=SKIP
IF NOT "!opt_mkdir!"=="SKIP" (
ECHO.
ECHO [mkdir] ^(7 / 7^)
ECHO 移除 autorun.inf 或 Desktop.ini 檔案後，為了避免惡意軟體重新建立其中任一檔案，
ECHO 我們將建立相同名稱的隱藏目錄，這些目錄使用者看不到，但可干擾惡意軟體，除非惡意
ECHO 軟體有能力刪除它們，否則磁碟機將不!BIG5_B77C!再受 AutoRun 感染。
CALL :continue_prompt || SET opt_mkdir=SKIP
)
SET g_files_moved=0
REM In Windows NT versions before Vista, when accessing A:\ or B:\ without a
REM floppy inserted into the respective drive, a graphical (!) error dialog
REM "Windows - No Disk" will pop up, blocking script execution.
REM Only DIR command (in NT 4 or later) on A: or B: shows non-blocking and no-
REM pop-up behavior.
REM The text of this dialog is usually:
REM "There is no disk in the drive. Please insert a disk into drive A:."
REM "[>Cancel<] [&Try Again] [&Continue]"
REM But due to a bug in Windows XP, it may instead show:
REM "Exception Processing Message c0000013 Parameters <address> 4 <address>
REM <address>" (<address> varied among OS language releases)
REM Beware that it's a really bad idea to supress such error dialogs! Don't
REM follow what the Web suggests and set the "ErrorMode" value in
REM "HKLM\SYSTEM\CurrentControlSet\Control\Windows" to 2! It could make real
REM serious errors to go unnoticed in your system.
FOR %%d IN (A B C D E F G H I J K L M N O P Q R S T U V W X Y Z) DO (
DIR /B %%d:\ >NUL: 2>NUL: && (
CD /D %%d:\
SET g_move_status=
ECHO.
ECHO 磁碟 %%d：
IF NOT "!opt_attrib!"=="SKIP" CALL :clear_files_attrib
IF NOT "!opt_shortcuts!"=="SKIP" CALL :process_shortcuts
IF NOT "!opt_folder_exe!"=="SKIP" CALL :process_folder_exes
SET name=autorun.inf
IF NOT "!opt_autorun_inf!"=="SKIP" CALL :make_dummy_dir
SET name=Desktop.ini
IF NOT "!opt_desktop_ini!"=="SKIP" CALL :make_dummy_dir
IF NOT "!opt_symlinks!"=="SKIP" CALL :process_symlinks
IF "!g_move_status!"=="OK_EMPTY" (
DEL "!opt_move_subdir!\README.txt" >NUL:
RMDIR "!opt_move_subdir!"
)
)
)
ECHO.
IF "!g_files_moved!"=="0" (
ECHO 全部完成。按任意鍵關閉本程式。
) ELSE (
ECHO 全部完成。請檢查各個 "!opt_move_subdir!"
ECHO 子目錄，所有可疑檔案皆被移動到那裡了。按任意鍵關閉本程式。
)
PAUSE >NUL:
GOTO main_end
:main_help
ECHO.
ECHO --help 顯示此說明
ECHO --no-restart 不重新啟動腳本（預設!BIG5_B77C!在偵測到命令處裡程式的 AutoRun
ECHO 時重新啟動!BIG5_A15E!
ECHO --no-reg-bak 不產生登錄備份檔案 "Vacc_reg.bak"
ECHO --skip-cmd-autorun 不要刪除命令處裡程式的 AutoRun 登錄值
ECHO --all-users-cmd-autorun 刪除*所有使用者*的 cmd.exe AutoRun（預設不進行!BIG5_A15E!
ECHO --no-inf-mapping 不要關閉 autorun.inf 的剖析
ECHO --skip-mountpoints 不要清理 MountPoints 登錄機碼（快取!BIG5_A15E!
ECHO --skip-known-ext 不要顯示已知檔案類型的副檔名
ECHO --all-users-known-ext *所有使用者*皆顯示已知檔案類型的副檔名（預設不進行!BIG5_A15E!
ECHO --fix-exe-ext 刪除執行檔類型的 NeverShowExt 登錄值（預設不進行!BIG5_A15E!
ECHO --always-exe-ext 永遠顯示 .exe 與 .scr 檔案類型的副檔名（預設不進行!BIG5_A15E!
ECHO --skip-pif-ext 不要刪除 .pif 檔案的 NeverShowExt 登錄值
ECHO --skip-scf-icon 不要為 .scf 檔案添加捷!BIG5_AE7C!箭頭圖示
ECHO --skip-scrap-ext 不要刪除 .shs 與 .shb 檔案的 NeverShowExt 登錄值
ECHO --skip-symlink-ext 不要永遠顯示符號連結（symbolic link!BIG5_A15E!的副檔名
ECHO --fix-shortcut-icon 復原捷!BIG5_AE7C!檔案的箭頭圖示（預設不進行!BIG5_A15E!
ECHO --fix-file-icon 復原未知類型、com、pif、lnk、shs、shb、url、scf、
ECHO appref-ms 與 glk 檔案類型的圖示（預設不進行!BIG5_A15E!
ECHO --all-users-reassoc 當編輯檔案關聯時，除了編輯全機預設與目前使用者的設定
ECHO 外，一併套用到*所有使用者*
ECHO 以下程序是套用在所有磁碟機的根目錄：
ECHO --move-subdir=子目錄 各磁碟的可疑檔案!BIG5_B77C!被移動到的子目錄
ECHO （預設："\MALWARE"!BIG5_A15E!
ECHO --keep-symlinks 不移動或刪除符號連結（symbolic link!BIG5_A15E!
ECHO --keep-attrib 保留所有檔案的「隱藏」與「系統」屬性
ECHO --keep-shortcuts 不移動或刪除捷!BIG5_AE7C!檔案
ECHO --keep-folder-exe 不移動或刪除與資料夾相同名稱的執行檔
ECHO --keep-autorun-inf 不移動或刪除 autorun.inf
ECHO --keep-desktop-ini 不移動或刪除 Desktop.ini
ECHO --no-mkdir 不建立佔位的目錄
ECHO 為了安全性的原因，此腳本並不!BIG5_B77C!將可疑的檔案移出磁碟機外。要刪除檔案而不是移動的
ECHO 話，請指定 '--move-subdir=NUL'。
GOTO main_end
:main_end
ENDLOCAL
EXIT /B 0
:main_find_error
ECHO *** 嚴重錯誤：不是 DOS/Windows 的 'find' 命令。>&2
ENDLOCAL
EXIT /B 1
:main_invalid_path
ECHO *** 嚴重錯誤：指定在 '--move-subdir' 選項裡的路!BIG5_AE7C!無效。>&2
ENDLOCAL
EXIT /B 1
:main_restart_native
REM KB942589 hotfix brings Sysnative folder support to Windows 2003 SP1+ (IA64
REM and x64) and XP x64 but is never offered in Windows Update.
SET status=1
REM Even with file system redirection in WoW64, the "IF EXIST" construct and
REM 'attrib' command do not redirect and can be used to check the existence of
REM real file names on disk. (Better not run cmd.exe inside if we're unsure
REM that "Sysnative" is a redirected pseudo-directory.)
FOR %%I IN ("!WinDir!\Sysnative") DO (
REM "%%~aI" redirects.
CALL :has_ci_substr "%%~aI" "d" && (
CALL :has_ci_substr "%%~aI" "h" || (
IF NOT EXIST %%I (
%%I\cmd /d /c "%0 --no-restart !args!" && GOTO :main_end
SET status=!ERRORLEVEL!
)
)
)
)
ECHO *** 偵測到 WoW64 的執行環境。本腳本應該要在作業系統預設的 64 位元命令直譯器>&2
ECHO （cmd.exe!BIG5_A15E!下執行。>&2
ECHO 請按照下列步驟操作：>&2
ECHO 1. 執行 "%%WinDir%%\explorer.exe"（預設、64 位元的 Windows 檔案總管。注意不是>&2
ECHO System32 或 SysWOW64 目錄底下的 explorer.exe。!BIG5_A15E!>&2
ECHO 2. 在新的檔案總管視窗，瀏覽到 "%%WinDir%%\System32"，然後尋找 "cmd.exe" 並在上面>&2
ECHO 按滑鼠右鍵。>&2
ECHO 3. 選取「以系統管理員身分執行」。>&2
ECHO 4. 在新的命令提示字元視窗，執行下列命令：>&2
ECHO %0 !args!>&2
ECHO.
PAUSE
ENDLOCAL & EXIT /B %status%
:main_restart
cmd /d /c "%0 --no-restart !args!" && GOTO :main_end
SET status=!ERRORLEVEL!
ECHO *** 重新啟動時發生錯誤。請以下列命令來重新執行此腳本（注意 '/d' 與>&2
ECHO '--no-restart' 選項!BIG5_A15E!：>&2
ECHO cmd /d /c ^"%0 --no-restart !args!^">&2
ECHO.
PAUSE
ENDLOCAL & EXIT /B %status%
REM ---------------------------------------------------------------------------
REM SUBROUTINES
REM Checks if string contains any of the substrings, ignoring case.
REM @param %1 String, which must be quoted
REM @param %2... Substrings, each must be quoted and not contain "!" or "="
REM @return 0 (true) if any of the substrings is found in string
:has_ci_substr
SET "str=%~1"
REM cmd.exe bug: "SET v=&ECHO.!v:s=r!x" outputs "s=rx" instead of "x".
REM Must return early lest the bug break the condtional below.
IF "%~1"=="" EXIT /B 1
SHIFT /1
REM Can't use FOR because it expands "*" and "?" that we don't want.
GOTO has_ci_substr_loop_
:has_ci_substr_loop_
IF "%~1"=="" EXIT /B 1
REM The first "*" in "!v:*s=r!" syntax is special (read "SET /?" page);
REM the rest is matched literally even if it contains "*".
REM Undocumented: String substitution is case insensitive.
REM Undocumented: On a multi-byte code page, string substitution operates
REM on characters, not bytes. E.g. !v:s=! won't match the character 0xE073.
IF NOT "!str!"=="!str:*%~1=!" EXIT /B 0
SHIFT /1
GOTO has_ci_substr_loop_
REM Checks if path or file name contains any character in the set.
REM @param %1 Quoted string containing set of characters to be checked.
REM @param name Unquoted file name
REM @return 0 (true) if names contain any of the characters in %1
:has_path_char
FOR /F "tokens=2 eol=/ delims=%~1" %%t IN ("x!name!x") DO (
REM It won't enter loop body if token 2 is empty, but for safety...
SETLOCAL DisableDelayedExpansion
IF NOT "%%t"=="" (
ENDLOCAL & EXIT /B 0
)
ENDLOCAL
)
EXIT /B 1
REM Prompts user to continue or skip.
REM @return 0 if user says to continue, or 1 if says to skip
:continue_prompt
REM Note: If the user answers empty string after a "SET /P", The variable
REM is kept the previous value and NOT set to the empty string.
SET reply=
SET /P reply="請按 Enter 鍵繼續，或是輸入 'skip' 跳過此步驟："
IF "!reply!"=="" EXIT /B 0
IF /I "!reply!"=="Y" EXIT /B 0
IF /I "!reply!"=="SKIP" EXIT /B 1
GOTO continue_prompt
REM Creates a file.
REM @param name Unquoted, valid file name
REM @return 0 if file is created
:create_file
REM There's no atomic "create file if not exist" command in Batch, so we
REM can't avoid a TOCTTOU attack completely.
REM "IF EXIST" doesn't detect the existence of file with Hidden attribute.
REM "%%~aI" outputs empty string for files with (hacked) Device attribute.
REM Neither of them are more reliable than MKDIR for checking file's
REM existence (or availability of the file name).
MKDIR "!name!" || EXIT /B 1
RMDIR "!name!" & TYPE NUL: >>"!name!"
IF NOT EXIST "!name!" EXIT /B 1
FOR %%I IN ("!name!") DO (
CALL :has_ci_substr "%%~aI" "d" && EXIT /B 1
)
EXIT /B 0
REM Creates and initializes "Vacc_reg.bak"
:init_reg_bak
REM This is not .reg format! So we don't allow user to specify file name.
SET name=Vacc_reg.bak
CALL :create_file || (
SET g_reg_bak=FAIL
ECHO.>&2
ECHO 警告：無法在此目錄裡建立登錄備份檔 "Vacc_reg.bak">&2
ECHO "!CD!"!BIG5_A15E!>&2
ECHO 可能已經存在相同名稱的檔案，或是此目錄是唯讀的。>&2
ECHO 本程式將!BIG5_B77C!在沒有登錄備份的情況下繼續。>&2
PAUSE
GOTO :EOF
)
SET g_reg_bak=OK
(
REM Don't localize.
ECHO ; Registry backup generated by 'usb_vaccine.cmd'. Project website:
ECHO ; ^<https://gitlab.com/Explorer09/usb_vaccine^>
) >>"Vacc_reg.bak"
ECHO.
ECHO 您的登錄將!BIG5_B77C!備份在此檔案裡：
FOR %%i IN (Vacc_reg.bak) DO (
SETLOCAL DisableDelayedExpansion
ECHO "%%~fi"
ENDLOCAL
)
PAUSE
GOTO :EOF
REM Logs data of a registry key/value into "Vacc_reg.bak".
REM @param %1 Part of key name up to and including the "Wow6432Node" delimiter
REM @param %2 Sub-key name after "%1\"
REM @param %3 (Without quotes:) "/v", "/ve" (default value) or "" (whole key)
REM @param %4 Value name if "%3"=="/v", empty otherwise
REM @return 0 on success, 1 if key/value doesn't exist, 2 if backup file fails
:backup_reg
REM With '/ve' option, 'reg' in Windows 2000 or XP exits with 1 on a "value
REM not set" default, while in 2003 or later it exits with 0. We ensures
REM Windows 2003's behavior by querying the whole key.
SET "v=%3"
IF "%3"=="/ve" SET v=