Yesterday my family's virus, the system's EXE file almost all became hidden files, and then generated the same name virus.
It's so bad.
I checked the information on the Internet, changed, and wrote the following procedures (batch), run, half an hour, I will get the virus, more than 50,000.
@echo off
Echo "Lovegate" special killing tool modify by stepping
echo
Echo Please run in security mode and DOS mode
PAUSE
echo
PAUSE
CD / D% WINDIR% / system
For %% I in (MSJDBC11.DLL, MSSIGN30.DLL, KERNEL66.DLL, ODBC16.DLL) DO DEL / S / Q / A: RH %% i
For %% I in (hxdef.exe, ravmond.exe, ipplore.exe, netmeeting.exe, spollsv.exe) Do del / S / Q / A: RH %% i
For %% I in (Autorun.inf, Command.exe) DO DEL / S / Q / A: RH %% i
CD /
For %% I in (Letter.rar, Install.rar, Pass.rar, Setup.rar, Work.rar, Bak.rar) DO DEL / Q %% i
For %% I in (Letter.zip, Install.zip, Pass.zip, Setup.zip, Work.zip, Bak.zip) DO DEL / Q %% I
echo
PAUSE
Net Share Media / DEL
echo
PAUSE
Echo Windows Registry Editor Version 5.00 >> TMP.REG
echo. >> TMP.REG
Echo [HKEY_LOCAL_MACHINE / SOFTWARE / Microsoft / Windows / CurrentVersion / Run] >> TMP.REG
Echo "Hardware Profile" = - >> TMP.REG
Echo "Microsoft Netmeeting Associates, Inc." = - >> TMP.REG
Echo "VFW Encoder / Decoder Settings" = - >> TMP.REG
Echo "shell extension" = - >> tmp.reg
Echo "protected storage" = - >> tmp.reg
Echo "Program in Windows" = - >> TMP.REG
Echo "Bie" = - >> TMP.REG
echo. >> TMP.REG
Echo [-hKey_local_machine / soft / microsoft / windows / currentversion / unservices] >> TMP.REG
echo. >> TMP.REG
Echo [-HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SERVICES_REG] >> TMP.REG
echo. >> TMP.REG
Echo [-hKey_local_machine / system / currentcontrolset / services / windows] >> TMP.REG
echo. >> TMP.REG
Regedit / S TMP.REG
Del Tmp.Reg
echo
PAUSE
Attrib - s -h -r * .zmx / s @ dir / b / s * .zmx> zmx_file.txt
@for / f "Delims ==" %% a in (zmx_file.txt) Do Ren "%% a" * .exe
@del zmx_file.txt
Echo clear recovery is successful, copy the program to other discs
PAUSE
