最新消息:

蓝色网际卸载3721流氓插件

nsis 永恒心锁 2019浏览 0评论

一直以来 3721 在我眼里都是病毒的象征,这次 AVP 把 3721 列为病毒终于使 3721 病毒合法化。依然合法化了,那么就应该全民杀毒了吧。

在这里我提供一个 NSIS 安装程序杀掉 3721 的脚本,你可以不用修改太多的地方就可以直接使用。使用方法为把下载地址里的 Ban3721.nsi

放到你的 NSIS 安装程序脚本目录里,然后编辑你的脚本文件在某一个地方(一般在 !include MUI.nsh 这一句的下面添加 !include Ban3721.nsi,

然后在 Function .onInit 里(如果没有就建一个)增加一句 Call Chk3721 即可)。这样你的安装程序即可以杀掉 3721 病毒。

过程:当你的安装程序启动时会检测你的机器里有没有 3721,如果有的话则有提示框“是否安装 Ban 3721 助手………………”,

如果选“是”则会清除机器里的 3721 病毒,如果选“否”则退出安装,如果选“取消”则打开一个文本,里面列出机器里的 3721 分布情况。

这个脚本我自己命名为“Ban 3721 助手”意在以其人之道治其人之身。用 NSIS 做安装程序的人很多,如果有一半的人加入这个代码,

那么这个世界就会清静很多…………

这个“Ban 3721 助手”没有什么实体文件,它仅仅是删除了一些本来不该有的东西,并进行免疫。所以你不用担心这个“助手”会引起什么冲突,

如果说引起了什么冲突的话,我想就是因为缺少了 3721 而引起的。

 

Function Chk3721

Call SkipBan3721

Pop $0

StrCmp $0 1 no_3721

InitPluginsDir

Push $0

;File

IfFileExists $PROGRAMFILES3721assist 0 +3

Push "目录: $PROGRAMFILES3721assist"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721autolive.dll 0 +3

Push "文件: $PROGRAMFILES3721autolive.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cns01.dat 0 +3

Push "文件: $PROGRAMFILES3721cns01.dat"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721assistadfilter.dll 0 +3

Push "文件: $PROGRAMFILES3721assistadfilter.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721assistadwreg.dll 0 +3

Push "文件: $PROGRAMFILES3721assistadwreg.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721assistassisres.dll 0 +3

Push "文件: $PROGRAMFILES3721assistassisres.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721assistassist.dll 0 +3

Push "文件: $PROGRAMFILES3721assistassist.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721assisteheflash.dll 0 +3

Push "文件: $PROGRAMFILES3721assisteheflash.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721assistoptimum.dll 0 +3

Push "文件: $PROGRAMFILES3721assistoptimum.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721assistrepair.dll 0 +3

Push "文件: $PROGRAMFILES3721assistrepair.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721assistxpstyle.dll 0 +3

Push "文件: $PROGRAMFILES3721assistxpstyle.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cesabmain.dll 0 +3

Push "文件: $PROGRAMFILES3721cesabmain.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cescescache.dll 0 +3

Push "文件: $PROGRAMFILES3721cescescache.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cescesfox.dll 0 +3

Push "文件: $PROGRAMFILES3721cescesfox.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cescesmain.dll 0 +3

Push "文件: $PROGRAMFILES3721cescesmain.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cescesout.dll 0 +3

Push "文件: $PROGRAMFILES3721cescesout.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cescesout10.dll 0 +3

Push "文件: $PROGRAMFILES3721cescesout10.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cescespack.dll 0 +3

Push "文件: $PROGRAMFILES3721cescespack.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cescesweb.dll 0 +3

Push "文件: $PROGRAMFILES3721cescesweb.dll"

Call Ban3721WriteFile

IfFileExists $PROGRAMFILES3721cescmail.dll 0 +3

Push "文件: $PROGRAMFILES3721cescmail.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721abmain.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721abmain.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721autolive.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721autolive.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cescache.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cescache.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cesfox.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cesfox.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cesmain.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cesmain.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cesout.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cesout.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cesout10.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cesout10.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cesweb.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cesweb.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cmail.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cmail.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cnsio.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cnsio.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cnsminkp.vxd" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cnsminkp.vxd"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cnsminkp2k.sys" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cnsminkp2k.sys"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Files3721cnsminkpxp.sys" 0 +3

Push "文件: $WINDIRDownloaded Program Files3721cnsminkpxp.sys"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filesaxfilter.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filesaxfilter.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescns02.dat" 0 +3

Push "文件: $WINDIRDownloaded Program Filescns02.dat"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnshook.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnshook.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsio.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsio.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsmin.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsmin.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsmin.inf" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsmin.inf"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsmin.ini" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsmin.ini"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminaf.cab" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminaf.cab"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsmincg.ini" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsmincg.ini"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminck.cab" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminck.cab"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminck.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminck.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsmindt.cab" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsmindt.cab"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsmindt.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsmindt.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminex.cab" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminex.cab"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminex.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminex.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminex.ini" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminex.ini"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminio.cab" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminio.cab"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminio.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminio.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminsv.cab" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminsv.cab"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsminsv.dll" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsminsv.dll"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Filescnsup.ini" 0 +3

Push "文件: $WINDIRDownloaded Program Filescnsup.ini"

Call Ban3721WriteFile

IfFileExists "$WINDIRDownloaded Program Fileskeepmainm.cab" 0 +3

Push "文件: $WINDIRDownloaded Program Fileskeepmainm.cab"

Call Ban3721WriteFile

IfFileExists "$SYSDIRassist.dll" 0 +3

Push "文件: $SYSDIRassist.dll"

Call Ban3721WriteFile

IfFileExists "$SYSDIRbdhelper.dll" 0 +3

Push "文件: $SYSDIRbdhelper.dll"

Call Ban3721WriteFile

IfFileExists "$SYSDIRcesweb.dll" 0 +3

Push "文件: $SYSDIRcesweb.dll"

Call Ban3721WriteFile

IfFileExists "$SYSDIRcnshook.dll" 0 +3

Push "文件: $SYSDIRcnshook.dll"

Call Ban3721WriteFile

IfFileExists "$SYSDIRehelper.dll" 0 +3

Push "文件: $SYSDIRehelper.dll"

Call Ban3721WriteFile

;RegKey

EnumRegKey $0 HKCU Software3721 0

StrCmp $0 "" +3

Push "注册表键: HKCU Software3721"

Call Ban3721WriteFile

EnumRegKey $0 HKLM SOFTWARE3721 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWARE3721"

Call Ban3721WriteFile

EnumRegKey $0 HKCR CnsHelper.CH 0

StrCmp $0 "" +3

Push "注册表键: HKCR CnsHelper.CH"

Call Ban3721WriteFile

EnumRegKey $0 HKCR CnsHelper.CH.1 0

StrCmp $0 "" +3

Push "注册表键: HKCR CnsHelper.CH.1"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionUninstallCnsMin" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionUninstallCnsMin"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionUninstall{1B0E7716-898E-48cc-9690-4E338E8DE1D3}" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionUninstall{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCachecnsmin" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCachecnsmin"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCache{1b0e7716-898e-48cc-9690-4e338e8de1d3}" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCache{1b0e7716-898e-48cc-9690-4e338e8de1d3}"

Call Ban3721WriteFile

;RegValue

ReadRegStr $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{1B0E7716-898E-48cc-9690-4E338E8DE1D3}" ""

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR Assist.EasyAssist.1 ""

StrCmp $0 "" +3

Push "注册表键: HKCR Assist.EasyAssist.1"

Call Ban3721WriteFile

ReadRegStr $0 HKCR Assist.EasyAssist ""

StrCmp $0 "" +3

Push "注册表键: HKCR Assist.EasyAssist"

Call Ban3721WriteFile

ReadRegStr $0 HKCR cnsminhk.cnshook.1 ""

StrCmp $0 "" +3

Push "注册表键: HKCR cnsminhk.cnshook.1"

Call Ban3721WriteFile

ReadRegStr $0 HKCR cnsminhk.cnshook ""

StrCmp $0 "" +3

Push "注册表键: HKCR cnsminhk.cnshook"

Call Ban3721WriteFile

ReadRegStr $0 HKLM "SOFTWAREMicrosoftInternet ExplorerToolbar" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}

StrCmp $0 "" +3

Push "注册表键值: HKLM SOFTWAREMicrosoftInternet ExplorerToolbar {1B0E7716-898E-48cc-9690-4E338E8DE1D3}"

Call Ban3721WriteFile

;CLSID

ReadRegStr $0 HKCR CLSID{1B0E7716-898E-48CC-9690-4E338E8DE1D3} ""

StrCmp $0 "" +3

Push "注册表键: HKCR CLSID{1B0E7716-898E-48CC-9690-4E338E8DE1D3}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR CLSID{6231d512-e4a4-4df2-be62-5b8f0ee348ef} ""

StrCmp $0 "" +3

Push "注册表键: HKCR CLSID{6231d512-e4a4-4df2-be62-5b8f0ee348ef}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR CLSID{6d8f256b-6ab8-4398-8f86-1e56207db77a} ""

StrCmp $0 "" +3

Push "注册表键: HKCR CLSID{6d8f256b-6ab8-4398-8f86-1e56207db77a}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR CLSID{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} ""

StrCmp $0 "" +3

Push "注册表键: HKCR CLSID{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR CLSID{B83FC273-3522-4CC6-92EC-75CC86678DA4} ""

StrCmp $0 "" +3

Push "注册表键: HKCR CLSID{B83FC273-3522-4CC6-92EC-75CC86678DA4}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR CLSID{ca92b524-bc8a-4610-bd2c-6bd3e28155d0} ""

StrCmp $0 "" +3

Push "注册表键: HKCR CLSID{D157330A-9EF3-49F8-9A67-4141AC41ADD4}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR CLSID{D157330A-9EF3-49F8-9A67-4141AC41ADD4} ""

StrCmp $0 "" +3

Push "注册表键: HKCR CLSID{D157330A-9EF3-49F8-9A67-4141AC41ADD4}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR CLSID{e5e4e352-6947-44ee-a420-db84efd3fe93} ""

StrCmp $0 "" +3

Push "注册表键: HKCR CLSID{e5e4e352-6947-44ee-a420-db84efd3fe93}"

Call Ban3721WriteFile

;Interface

ReadRegStr $0 HKCR Interface{1bb0abbe-2d95-4847-b9d8-6f90de3714c1} ""

StrCmp $0 "" +3

Push "注册表键: HKCR Interface{1bb0abbe-2d95-4847-b9d8-6f90de3714c1}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR Interface{DF692509-D9EF-48A0-9CD0-3AA5B81F6F68} ""

StrCmp $0 "" +3

Push "注册表键: HKCR Interface{DF692509-D9EF-48A0-9CD0-3AA5B81F6F68}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR Interface{924F5B3A-7A27-484A-B873-E855C9708667} ""

StrCmp $0 "" +3

Push "注册表键: HKCR Interface{924F5B3A-7A27-484A-B873-E855C9708667}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR Interface{BE08F6BC-C3E6-4149-BEB1-CB449E1B372E} ""

StrCmp $0 "" +3

Push "注册表键: HKCR Interface{BE08F6BC-C3E6-4149-BEB1-CB449E1B372E}"

Call Ban3721WriteFile

;TypeLib

ReadRegStr $0 HKCR TypeLib{19069804-2CF0-4357-B696-BA6E9AAD99EF} ""

StrCmp $0 "" +3

Push "注册表键: HKCR TypeLib{19069804-2CF0-4357-B696-BA6E9AAD99EF}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR TypeLib{4158DB95-DE71-41FF-BEA1-2C3D1C679DF1} ""

StrCmp $0 "" +3

Push "注册表键: HKCR TypeLib{4158DB95-DE71-41FF-BEA1-2C3D1C679DF1}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR TypeLib{a5adeae7-a8b4-4f94-9128-bf8d8db5e927} ""

StrCmp $0 "" +3

Push "注册表键: HKCR TypeLib{a5adeae7-a8b4-4f94-9128-bf8d8db5e927}"

Call Ban3721WriteFile

ReadRegStr $0 HKCR TypeLib{AAB6BCE3-1DF6-4930-9B14-9CA79DC8C267} ""

StrCmp $0 "" +3

Push "注册表键: HKCR TypeLib{AAB6BCE3-1DF6-4930-9B14-9CA79DC8C267}"

Call Ban3721WriteFile

;IE

ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSHint

StrCmp $0 "" +3

Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSHint"

Call Ban3721WriteFile

ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSMenu

StrCmp $0 "" +3

Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSMenu"

Call Ban3721WriteFile

ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSReset

StrCmp $0 "" +3

Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSReset"

Call Ban3721WriteFile

ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSEnable

StrCmp $0 "" +3

Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSEnable"

Call Ban3721WriteFile

ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSList

StrCmp $0 "" +3

Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSList"

Call Ban3721WriteFile

ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSAutoUpdate

StrCmp $0 "" +3

Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSAutoUpdatet"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{00000000-0000-0001-0001-596BAEDD1289}" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{00000000-0000-0001-0001-596BAEDD1289}"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{5D73EE86-05F1-49ed-B850-E423120EC338}" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{5D73EE86-05F1-49ed-B850-E423120EC338}"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{0F7DE07D-BD74-4991-9D5F-ECBB8391875D}" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{0F7DE07D-BD74-4991-9D5F-ECBB8391875D}"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{FD00D911-7529-4084-9946-A29F1BDF4FE5}" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{FD00D911-7529-4084-9946-A29F1BDF4FE5}"

Call Ban3721WriteFile

EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}" 0

StrCmp $0 "" +3

Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}"

Call Ban3721WriteFile

ReadRegStr $0 HKLM "SOFTWAREMicrosoftInternet ExplorerToolbar" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}

StrCmp $0 "" +3

Push "注册表键值: HKLM SOFTWAREMicrosoftInternet ExplorerToolbar{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"

Call Ban3721WriteFile

ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerURLSearchHooks" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}

StrCmp $0 "" +3

Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerURLSearchHooks{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"

Call Ban3721WriteFile

;Run

ReadRegStr $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionRun" CnsMin

StrCmp $0 "" +3

Push "注册表键值: HKLM SOFTWAREMicrosoftWindowsCurrentVersionRunCnsMin"

Call Ban3721WriteFile

ReadRegStr $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionRun" helper.dll

StrCmp $0 "" +3

Push "注册表键值: HKLM SOFTWAREMicrosoftWindowsCurrentVersionRunhelper.dll"

Call Ban3721WriteFile

ReadRegStr $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionRun" cesmain.dll

StrCmp $0 "" +3

Push "注册表键值: HKLM SOFTWAREMicrosoftWindowsCurrentVersionRuncesmain.dll"

Call Ban3721WriteFile

FileOpen $0 $PLUGINSDIR3721.txt r

FileRead $0 $1

FileClose $0

StrCmp $1 "" no_3721

MessageBox MB_YESNOCANCEL|MB_ICONINFORMATION "在安装这个软件同时,您是否要安装 Ban 3721 助手?

Ban 3721 助手可以安全修复受 3721 感染的浏览器,保护上网隐私,还提供了强大的清除 3721 地址栏搜索、清除 3721 网络加速等功能。" IDYES +4 IDNO +3

ExecShell open $PLUGINSDIR3721.txt "" SW_SHOWMAXIMIZED

Sleep 5000

Quit

Call Ban3721

no_3721:

Pop $0

FunctionEnd

; --------------------------------------

!macro UnRegDLL DLL

IfFileExists "${DLL}" 0 +2

ExecWait 'Regsvr32 /s /u "${DLL}"'

!macroend

Function Ban3721

;ExecWait 'Regsvr32 /s /u

!insertmacro UnRegDLL "$PROGRAMFILES3721assistadfilter.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721assistadwreg.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721assistassisres.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721assistassist.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721assisteheflash.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721assistoptimum.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721assistrepair.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721assistxpstyle.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cesabmain.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cescescache.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cescesfox.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cescesmain.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cescesout.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cescesout10.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cescespack.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cescesweb.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721cescmail.dll"

!insertmacro UnRegDLL "$PROGRAMFILES3721helper.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721abmain.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721autolive.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cescache.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesfox.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesmain.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesout.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesout10.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesweb.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cmail.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cnsio.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filesaxfilter.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnshook.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsio.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsmin.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsminck.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsmindt.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsminex.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsminio.dll"

!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsminsv.dll"

!insertmacro UnRegDLL "$SYSDIRassist.dll"

!insertmacro UnRegDLL "$SYSDIRbdhelper.dll"

!insertmacro UnRegDLL "$SYSDIRcesweb.dll"

!insertmacro UnRegDLL "$SYSDIRcnshook.dll"

!insertmacro UnRegDLL "$SYSDIRehelper.dll"

;DelRegKey

DeleteRegKey HKCU Software3721

DeleteRegKey HKLM SOFTWARE3721

DeleteRegKey HKCR CnsHelper.CH

DeleteRegKey HKCR CnsHelper.CH.1

DeleteRegKey HKCR cnsminhk.cnshook

DeleteRegKey HKCR cnsminhk.cnshook.1

DeleteRegKey HKCR Assist.EasyAssist

DeleteRegKey HKCR Assist.EasyAssist.1

DeleteRegKey HKCR CLSID{1B0E7716-898E-48CC-9690-4E338E8DE1D3}

DeleteRegKey HKCR CLSID{6231d512-e4a4-4df2-be62-5b8f0ee348ef}

DeleteRegKey HKCR CLSID{6d8f256b-6ab8-4398-8f86-1e56207db77a}

DeleteRegKey HKCR CLSID{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}

DeleteRegKey HKCR CLSID{B83FC273-3522-4CC6-92EC-75CC86678DA4}

DeleteRegKey HKCR CLSID{ca92b524-bc8a-4610-bd2c-6bd3e28155d0}

DeleteRegKey HKCR CLSID{D157330A-9EF3-49F8-9A67-4141AC41ADD4}

DeleteRegKey HKCR CLSID{e5e4e352-6947-44ee-a420-db84efd3fe93}

DeleteRegKey HKCR Interface{1bb0abbe-2d95-4847-b9d8-6f90de3714c1}

DeleteRegKey HKCR Interface{DF692509-D9EF-48A0-9CD0-3AA5B81F6F68}

DeleteRegKey HKCR Interface{924F5B3A-7A27-484A-B873-E855C9708667}

DeleteRegKey HKCR Interface{BE08F6BC-C3E6-4149-BEB1-CB449E1B372E}

DeleteRegKey HKCR TypeLib{19069804-2CF0-4357-B696-BA6E9AAD99EF}

DeleteRegKey HKCR TypeLib{4158DB95-DE71-41FF-BEA1-2C3D1C679DF1}

DeleteRegKey HKCR TypeLib{a5adeae7-a8b4-4f94-9128-bf8d8db5e927}

DeleteRegKey HKCR TypeLib{AAB6BCE3-1DF6-4930-9B14-9CA79DC8C267}

DeleteRegKey HKLM SOFTWAREMicrosoftWindowsCurrentVersionUninstallCnsMin

DeleteRegKey HKLM SOFTWAREMicrosoftWindowsCurrentVersionUninstall{1B0E7716-898E-48cc-9690-4E338E8DE1D3}

DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerAdvancedOptions!CNS"

DeleteRegKey HKLM "SOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"

DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{00000000-0000-0001-0001-596BAEDD1289}"

DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{5D73EE86-05F1-49ed-B850-E423120EC338}"

DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{0F7DE07D-BD74-4991-9D5F-ECBB8391875D}"

DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{FD00D911-7529-4084-9946-A29F1BDF4FE5}"

DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}"

DeleteRegKey HKLM "SOFTWAREMicrosoftCode Store DatabaseDistribution Units{B83FC273-3522-4CC6-92EC-75CC86678DA4}"

;DelRegValue

DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSHint

DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSMenu

DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSReset

DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSEnable

DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSList

DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSAutoUpdate

DeleteRegValue HKLM SOFTWAREMicrosoftWindowsCurrentVersionRun CnsMin

DeleteRegValue HKLM SOFTWAREMicrosoftWindowsCurrentVersionRun helper.dll

DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerURLSearchHooks" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}

DeleteRegValue HKLM "SOFTWAREMicrosoftInternet ExplorerToolbar" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}

Push $0

Push $1

Push $2

StrCpy $1 0

loop:

EnumRegValue $0 HKLM SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs $1

StrCmp $0 "" loop_quit

StrCpy $2 $0 "" -9

StrCmp $2 cns02.dat 0 +2

DeleteRegValue HKLM SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs $0

StrCpy $2 $0 "" -10

StrCmp $2 CnsMin.dll 0 +2

DeleteRegValue HKLM SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs $0

IntOp $1 $1 + 1

Goto loop

loop_quit:

StrCpy $1 0

loop2:

EnumRegKey $0 HKLM SOFTWAREMicrosoftWindowsCurrentVersionModuleUsage $1

StrCmp $0 "" loop2_quit

StrCpy $2 $0 "" -9

StrCmp $2 cns02.dat 0 +2

DeleteRegKey HKLM SOFTWAREMicrosoftWindowsCurrentVersionModuleUsage$0

StrCpy $2 $0 "" -10

StrCmp $2 CnsMin.dll 0 +2

DeleteRegKey HKLM SOFTWAREMicrosoftWindowsCurrentVersionModuleUsage$0

IntOp $1 $1 + 1

Goto loop2

loop2_quit:

;免疫

WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{B83FC273-3522-4CC6-92EC-75CC86678DA4}" "Compatibility Flags" 1024

WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{4522DBFE-14CD-4A59-AC2A-54BADFDD6D53}" "Compatibility Flags" 1024

WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{1B0E7716-898E-48CC-9690-4E338E8DE1D3}" "Compatibility Flags" 1024

WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}" "Compatibility Flags" 1024

WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686}" "Compatibility Flags" 1024

WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{8D898B17-976D-44c1-84E6-AF38842AC9EC}" "Compatibility Flags" 1024

Delete /REBOOTOK $PROGRAMFILEScnscfgf.dat

Delete /REBOOTOK $PROGRAMFILEScnscfgr.dat

Delete /REBOOTOK $PROGRAMFILEScnsmin.dat

Delete /REBOOTOK $PROGRAMFILES3721*.*

RMDir /r $PROGRAMFILES3721

RMDir /REBOOTOK $PROGRAMFILES3721

RMDir /r "$SMPROGRAMS网络实名"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721abmain.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721autolive.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cescache.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesfox.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesmain.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesout.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesout10.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesweb.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cmail.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cnsio.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cnsminkp.vxd"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cnsminkp2k.sys"

Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cnsminkpxp.sys"

Delete /REBOOTOK "$WINDIRDownloaded Program Filesaxfilter.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescns02.dat"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnshook.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsio.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmin.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmin.inf"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmin.ini"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminaf.cab"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmincg.ini"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminck.cab"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminck.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmindt.cab"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmindt.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminex.cab"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminex.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminex.ini"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminio.cab"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminio.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminsv.cab"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminsv.dll"

Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsup.ini"

Delete /REBOOTOK "$WINDIRDownloaded Program Fileskeepmainm.cab"

Delete /REBOOTOK "$SYSDIRassist.dll"

Delete /REBOOTOK "$SYSDIRbdhelper.dll"

Delete /REBOOTOK "$SYSDIRcesweb.dll"

Delete /REBOOTOK "$SYSDIRcnshook.dll"

Delete /REBOOTOK "$SYSDIRehelper.dll"

Pop $2

Pop $1

Pop $0

FunctionEnd

Function Ban3721WriteFile

Exch $R0

Push $R1

FileOpen $R1 $PLUGINSDIR3721.txt a

FileSeek $R1 0 END

FileWrite $R1 $R0$r$n

FileClose $R1

Pop $R1

Pop $R0

FunctionEnd

Function SkipBan3721

Push $R0

Push $R1

Push $R2

Push $R3

StrCpy $R1 1

StrCpy $R0 0

StrLen $R3 $CMDLINE

loop:

StrCpy $R2 $CMDLINE 14 $R1

StrCmp $R2 "/skip ban 3721" loop_quit

IntCmp $R1 $R3 end 0 end

IntOp $R1 $R1 + 1

Goto loop

loop_quit:

StrCpy $R0 1

end:

Pop $R3

Pop $R2

Pop $R1

Exch $R0

FunctionEnd

OutFile "Chk3721.exe"

Section "永恒心锁"

Call Chk3721

SectionEnd
永恒心锁,版权所有丨如未注明,均为转载丨本网站采用BY-NC-SA协议进行授权

转载请注明:永恒心锁-分享互联网 » 蓝色网际卸载3721流氓插件

您必须 登录 才能发表评论!