一直以来 3721 在我眼里都是病毒的象征,这次 AVP 把 3721 列为病毒终于使 3721 病毒合法化。依然合法化了,那么就应该全民杀毒了吧。
在这里我提供一个 NSIS 安装程序杀掉 3721 的脚本,你可以不用修改太多的地方就可以直接使用。使用方法为把下载地址里的 Ban3721.nsi
放到你的 NSIS 安装程序脚本目录里,然后编辑你的脚本文件在某一个地方(一般在 !include MUI.nsh 这一句的下面添加 !include Ban3721.nsi,
然后在 Function .onInit 里(如果没有就建一个)增加一句 Call Chk3721 即可)。这样你的安装程序即可以杀掉 3721 病毒。
过程:当你的安装程序启动时会检测你的机器里有没有 3721,如果有的话则有提示框“是否安装 Ban 3721 助手………………”,
如果选“是”则会清除机器里的 3721 病毒,如果选“否”则退出安装,如果选“取消”则打开一个文本,里面列出机器里的 3721 分布情况。
这个脚本我自己命名为“Ban 3721 助手”意在以其人之道治其人之身。用 NSIS 做安装程序的人很多,如果有一半的人加入这个代码,
那么这个世界就会清静很多…………
这个“Ban 3721 助手”没有什么实体文件,它仅仅是删除了一些本来不该有的东西,并进行免疫。所以你不用担心这个“助手”会引起什么冲突,
如果说引起了什么冲突的话,我想就是因为缺少了 3721 而引起的。
Function Chk3721
Call SkipBan3721
Pop $0
StrCmp $0 1 no_3721
InitPluginsDir
Push $0
;File
IfFileExists $PROGRAMFILES3721assist 0 +3
Push "目录: $PROGRAMFILES3721assist"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721autolive.dll 0 +3
Push "文件: $PROGRAMFILES3721autolive.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cns01.dat 0 +3
Push "文件: $PROGRAMFILES3721cns01.dat"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721assistadfilter.dll 0 +3
Push "文件: $PROGRAMFILES3721assistadfilter.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721assistadwreg.dll 0 +3
Push "文件: $PROGRAMFILES3721assistadwreg.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721assistassisres.dll 0 +3
Push "文件: $PROGRAMFILES3721assistassisres.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721assistassist.dll 0 +3
Push "文件: $PROGRAMFILES3721assistassist.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721assisteheflash.dll 0 +3
Push "文件: $PROGRAMFILES3721assisteheflash.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721assistoptimum.dll 0 +3
Push "文件: $PROGRAMFILES3721assistoptimum.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721assistrepair.dll 0 +3
Push "文件: $PROGRAMFILES3721assistrepair.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721assistxpstyle.dll 0 +3
Push "文件: $PROGRAMFILES3721assistxpstyle.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cesabmain.dll 0 +3
Push "文件: $PROGRAMFILES3721cesabmain.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cescescache.dll 0 +3
Push "文件: $PROGRAMFILES3721cescescache.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cescesfox.dll 0 +3
Push "文件: $PROGRAMFILES3721cescesfox.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cescesmain.dll 0 +3
Push "文件: $PROGRAMFILES3721cescesmain.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cescesout.dll 0 +3
Push "文件: $PROGRAMFILES3721cescesout.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cescesout10.dll 0 +3
Push "文件: $PROGRAMFILES3721cescesout10.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cescespack.dll 0 +3
Push "文件: $PROGRAMFILES3721cescespack.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cescesweb.dll 0 +3
Push "文件: $PROGRAMFILES3721cescesweb.dll"
Call Ban3721WriteFile
IfFileExists $PROGRAMFILES3721cescmail.dll 0 +3
Push "文件: $PROGRAMFILES3721cescmail.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721abmain.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721abmain.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721autolive.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721autolive.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cescache.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cescache.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cesfox.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cesfox.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cesmain.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cesmain.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cesout.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cesout.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cesout10.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cesout10.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cesweb.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cesweb.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cmail.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cmail.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cnsio.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cnsio.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cnsminkp.vxd" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cnsminkp.vxd"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cnsminkp2k.sys" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cnsminkp2k.sys"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Files3721cnsminkpxp.sys" 0 +3
Push "文件: $WINDIRDownloaded Program Files3721cnsminkpxp.sys"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filesaxfilter.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filesaxfilter.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescns02.dat" 0 +3
Push "文件: $WINDIRDownloaded Program Filescns02.dat"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnshook.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnshook.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsio.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsio.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsmin.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsmin.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsmin.inf" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsmin.inf"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsmin.ini" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsmin.ini"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminaf.cab" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminaf.cab"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsmincg.ini" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsmincg.ini"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminck.cab" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminck.cab"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminck.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminck.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsmindt.cab" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsmindt.cab"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsmindt.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsmindt.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminex.cab" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminex.cab"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminex.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminex.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminex.ini" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminex.ini"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminio.cab" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminio.cab"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminio.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminio.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminsv.cab" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminsv.cab"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsminsv.dll" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsminsv.dll"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Filescnsup.ini" 0 +3
Push "文件: $WINDIRDownloaded Program Filescnsup.ini"
Call Ban3721WriteFile
IfFileExists "$WINDIRDownloaded Program Fileskeepmainm.cab" 0 +3
Push "文件: $WINDIRDownloaded Program Fileskeepmainm.cab"
Call Ban3721WriteFile
IfFileExists "$SYSDIRassist.dll" 0 +3
Push "文件: $SYSDIRassist.dll"
Call Ban3721WriteFile
IfFileExists "$SYSDIRbdhelper.dll" 0 +3
Push "文件: $SYSDIRbdhelper.dll"
Call Ban3721WriteFile
IfFileExists "$SYSDIRcesweb.dll" 0 +3
Push "文件: $SYSDIRcesweb.dll"
Call Ban3721WriteFile
IfFileExists "$SYSDIRcnshook.dll" 0 +3
Push "文件: $SYSDIRcnshook.dll"
Call Ban3721WriteFile
IfFileExists "$SYSDIRehelper.dll" 0 +3
Push "文件: $SYSDIRehelper.dll"
Call Ban3721WriteFile
;RegKey
EnumRegKey $0 HKCU Software3721 0
StrCmp $0 "" +3
Push "注册表键: HKCU Software3721"
Call Ban3721WriteFile
EnumRegKey $0 HKLM SOFTWARE3721 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWARE3721"
Call Ban3721WriteFile
EnumRegKey $0 HKCR CnsHelper.CH 0
StrCmp $0 "" +3
Push "注册表键: HKCR CnsHelper.CH"
Call Ban3721WriteFile
EnumRegKey $0 HKCR CnsHelper.CH.1 0
StrCmp $0 "" +3
Push "注册表键: HKCR CnsHelper.CH.1"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionUninstallCnsMin" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionUninstallCnsMin"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionUninstall{1B0E7716-898E-48cc-9690-4E338E8DE1D3}" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionUninstall{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCachecnsmin" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCachecnsmin"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCache{1b0e7716-898e-48cc-9690-4e338e8de1d3}" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCache{1b0e7716-898e-48cc-9690-4e338e8de1d3}"
Call Ban3721WriteFile
;RegValue
ReadRegStr $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{1B0E7716-898E-48cc-9690-4E338E8DE1D3}" ""
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR Assist.EasyAssist.1 ""
StrCmp $0 "" +3
Push "注册表键: HKCR Assist.EasyAssist.1"
Call Ban3721WriteFile
ReadRegStr $0 HKCR Assist.EasyAssist ""
StrCmp $0 "" +3
Push "注册表键: HKCR Assist.EasyAssist"
Call Ban3721WriteFile
ReadRegStr $0 HKCR cnsminhk.cnshook.1 ""
StrCmp $0 "" +3
Push "注册表键: HKCR cnsminhk.cnshook.1"
Call Ban3721WriteFile
ReadRegStr $0 HKCR cnsminhk.cnshook ""
StrCmp $0 "" +3
Push "注册表键: HKCR cnsminhk.cnshook"
Call Ban3721WriteFile
ReadRegStr $0 HKLM "SOFTWAREMicrosoftInternet ExplorerToolbar" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}
StrCmp $0 "" +3
Push "注册表键值: HKLM SOFTWAREMicrosoftInternet ExplorerToolbar {1B0E7716-898E-48cc-9690-4E338E8DE1D3}"
Call Ban3721WriteFile
;CLSID
ReadRegStr $0 HKCR CLSID{1B0E7716-898E-48CC-9690-4E338E8DE1D3} ""
StrCmp $0 "" +3
Push "注册表键: HKCR CLSID{1B0E7716-898E-48CC-9690-4E338E8DE1D3}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR CLSID{6231d512-e4a4-4df2-be62-5b8f0ee348ef} ""
StrCmp $0 "" +3
Push "注册表键: HKCR CLSID{6231d512-e4a4-4df2-be62-5b8f0ee348ef}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR CLSID{6d8f256b-6ab8-4398-8f86-1e56207db77a} ""
StrCmp $0 "" +3
Push "注册表键: HKCR CLSID{6d8f256b-6ab8-4398-8f86-1e56207db77a}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR CLSID{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} ""
StrCmp $0 "" +3
Push "注册表键: HKCR CLSID{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR CLSID{B83FC273-3522-4CC6-92EC-75CC86678DA4} ""
StrCmp $0 "" +3
Push "注册表键: HKCR CLSID{B83FC273-3522-4CC6-92EC-75CC86678DA4}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR CLSID{ca92b524-bc8a-4610-bd2c-6bd3e28155d0} ""
StrCmp $0 "" +3
Push "注册表键: HKCR CLSID{D157330A-9EF3-49F8-9A67-4141AC41ADD4}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR CLSID{D157330A-9EF3-49F8-9A67-4141AC41ADD4} ""
StrCmp $0 "" +3
Push "注册表键: HKCR CLSID{D157330A-9EF3-49F8-9A67-4141AC41ADD4}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR CLSID{e5e4e352-6947-44ee-a420-db84efd3fe93} ""
StrCmp $0 "" +3
Push "注册表键: HKCR CLSID{e5e4e352-6947-44ee-a420-db84efd3fe93}"
Call Ban3721WriteFile
;Interface
ReadRegStr $0 HKCR Interface{1bb0abbe-2d95-4847-b9d8-6f90de3714c1} ""
StrCmp $0 "" +3
Push "注册表键: HKCR Interface{1bb0abbe-2d95-4847-b9d8-6f90de3714c1}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR Interface{DF692509-D9EF-48A0-9CD0-3AA5B81F6F68} ""
StrCmp $0 "" +3
Push "注册表键: HKCR Interface{DF692509-D9EF-48A0-9CD0-3AA5B81F6F68}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR Interface{924F5B3A-7A27-484A-B873-E855C9708667} ""
StrCmp $0 "" +3
Push "注册表键: HKCR Interface{924F5B3A-7A27-484A-B873-E855C9708667}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR Interface{BE08F6BC-C3E6-4149-BEB1-CB449E1B372E} ""
StrCmp $0 "" +3
Push "注册表键: HKCR Interface{BE08F6BC-C3E6-4149-BEB1-CB449E1B372E}"
Call Ban3721WriteFile
;TypeLib
ReadRegStr $0 HKCR TypeLib{19069804-2CF0-4357-B696-BA6E9AAD99EF} ""
StrCmp $0 "" +3
Push "注册表键: HKCR TypeLib{19069804-2CF0-4357-B696-BA6E9AAD99EF}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR TypeLib{4158DB95-DE71-41FF-BEA1-2C3D1C679DF1} ""
StrCmp $0 "" +3
Push "注册表键: HKCR TypeLib{4158DB95-DE71-41FF-BEA1-2C3D1C679DF1}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR TypeLib{a5adeae7-a8b4-4f94-9128-bf8d8db5e927} ""
StrCmp $0 "" +3
Push "注册表键: HKCR TypeLib{a5adeae7-a8b4-4f94-9128-bf8d8db5e927}"
Call Ban3721WriteFile
ReadRegStr $0 HKCR TypeLib{AAB6BCE3-1DF6-4930-9B14-9CA79DC8C267} ""
StrCmp $0 "" +3
Push "注册表键: HKCR TypeLib{AAB6BCE3-1DF6-4930-9B14-9CA79DC8C267}"
Call Ban3721WriteFile
;IE
ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSHint
StrCmp $0 "" +3
Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSHint"
Call Ban3721WriteFile
ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSMenu
StrCmp $0 "" +3
Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSMenu"
Call Ban3721WriteFile
ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSReset
StrCmp $0 "" +3
Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSReset"
Call Ban3721WriteFile
ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSEnable
StrCmp $0 "" +3
Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSEnable"
Call Ban3721WriteFile
ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSList
StrCmp $0 "" +3
Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSList"
Call Ban3721WriteFile
ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSAutoUpdate
StrCmp $0 "" +3
Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerMainCNSAutoUpdatet"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{00000000-0000-0001-0001-596BAEDD1289}" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{00000000-0000-0001-0001-596BAEDD1289}"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{5D73EE86-05F1-49ed-B850-E423120EC338}" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{5D73EE86-05F1-49ed-B850-E423120EC338}"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{0F7DE07D-BD74-4991-9D5F-ECBB8391875D}" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{0F7DE07D-BD74-4991-9D5F-ECBB8391875D}"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{FD00D911-7529-4084-9946-A29F1BDF4FE5}" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{FD00D911-7529-4084-9946-A29F1BDF4FE5}"
Call Ban3721WriteFile
EnumRegValue $0 HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}" 0
StrCmp $0 "" +3
Push "注册表键: HKLM SOFTWAREMicrosoftInternet ExplorerExtensions{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}"
Call Ban3721WriteFile
ReadRegStr $0 HKLM "SOFTWAREMicrosoftInternet ExplorerToolbar" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}
StrCmp $0 "" +3
Push "注册表键值: HKLM SOFTWAREMicrosoftInternet ExplorerToolbar{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"
Call Ban3721WriteFile
ReadRegStr $0 HKCU "SoftwareMicrosoftInternet ExplorerURLSearchHooks" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}
StrCmp $0 "" +3
Push "注册表键值: HKCU SoftwareMicrosoftInternet ExplorerURLSearchHooks{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"
Call Ban3721WriteFile
;Run
ReadRegStr $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionRun" CnsMin
StrCmp $0 "" +3
Push "注册表键值: HKLM SOFTWAREMicrosoftWindowsCurrentVersionRunCnsMin"
Call Ban3721WriteFile
ReadRegStr $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionRun" helper.dll
StrCmp $0 "" +3
Push "注册表键值: HKLM SOFTWAREMicrosoftWindowsCurrentVersionRunhelper.dll"
Call Ban3721WriteFile
ReadRegStr $0 HKLM "SOFTWAREMicrosoftWindowsCurrentVersionRun" cesmain.dll
StrCmp $0 "" +3
Push "注册表键值: HKLM SOFTWAREMicrosoftWindowsCurrentVersionRuncesmain.dll"
Call Ban3721WriteFile
FileOpen $0 $PLUGINSDIR3721.txt r
FileRead $0 $1
FileClose $0
StrCmp $1 "" no_3721
MessageBox MB_YESNOCANCEL|MB_ICONINFORMATION "在安装这个软件同时,您是否要安装 Ban 3721 助手?
Ban 3721 助手可以安全修复受 3721 感染的浏览器,保护上网隐私,还提供了强大的清除 3721 地址栏搜索、清除 3721 网络加速等功能。" IDYES +4 IDNO +3
ExecShell open $PLUGINSDIR3721.txt "" SW_SHOWMAXIMIZED
Sleep 5000
Quit
Call Ban3721
no_3721:
Pop $0
FunctionEnd
; --------------------------------------
!macro UnRegDLL DLL
IfFileExists "${DLL}" 0 +2
ExecWait 'Regsvr32 /s /u "${DLL}"'
!macroend
Function Ban3721
;ExecWait 'Regsvr32 /s /u
!insertmacro UnRegDLL "$PROGRAMFILES3721assistadfilter.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721assistadwreg.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721assistassisres.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721assistassist.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721assisteheflash.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721assistoptimum.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721assistrepair.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721assistxpstyle.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cesabmain.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cescescache.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cescesfox.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cescesmain.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cescesout.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cescesout10.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cescespack.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cescesweb.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721cescmail.dll"
!insertmacro UnRegDLL "$PROGRAMFILES3721helper.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721abmain.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721autolive.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cescache.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesfox.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesmain.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesout.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesout10.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cesweb.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cmail.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Files3721cnsio.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filesaxfilter.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnshook.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsio.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsmin.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsminck.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsmindt.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsminex.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsminio.dll"
!insertmacro UnRegDLL "$WINDIRDownloaded Program Filescnsminsv.dll"
!insertmacro UnRegDLL "$SYSDIRassist.dll"
!insertmacro UnRegDLL "$SYSDIRbdhelper.dll"
!insertmacro UnRegDLL "$SYSDIRcesweb.dll"
!insertmacro UnRegDLL "$SYSDIRcnshook.dll"
!insertmacro UnRegDLL "$SYSDIRehelper.dll"
;DelRegKey
DeleteRegKey HKCU Software3721
DeleteRegKey HKLM SOFTWARE3721
DeleteRegKey HKCR CnsHelper.CH
DeleteRegKey HKCR CnsHelper.CH.1
DeleteRegKey HKCR cnsminhk.cnshook
DeleteRegKey HKCR cnsminhk.cnshook.1
DeleteRegKey HKCR Assist.EasyAssist
DeleteRegKey HKCR Assist.EasyAssist.1
DeleteRegKey HKCR CLSID{1B0E7716-898E-48CC-9690-4E338E8DE1D3}
DeleteRegKey HKCR CLSID{6231d512-e4a4-4df2-be62-5b8f0ee348ef}
DeleteRegKey HKCR CLSID{6d8f256b-6ab8-4398-8f86-1e56207db77a}
DeleteRegKey HKCR CLSID{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}
DeleteRegKey HKCR CLSID{B83FC273-3522-4CC6-92EC-75CC86678DA4}
DeleteRegKey HKCR CLSID{ca92b524-bc8a-4610-bd2c-6bd3e28155d0}
DeleteRegKey HKCR CLSID{D157330A-9EF3-49F8-9A67-4141AC41ADD4}
DeleteRegKey HKCR CLSID{e5e4e352-6947-44ee-a420-db84efd3fe93}
DeleteRegKey HKCR Interface{1bb0abbe-2d95-4847-b9d8-6f90de3714c1}
DeleteRegKey HKCR Interface{DF692509-D9EF-48A0-9CD0-3AA5B81F6F68}
DeleteRegKey HKCR Interface{924F5B3A-7A27-484A-B873-E855C9708667}
DeleteRegKey HKCR Interface{BE08F6BC-C3E6-4149-BEB1-CB449E1B372E}
DeleteRegKey HKCR TypeLib{19069804-2CF0-4357-B696-BA6E9AAD99EF}
DeleteRegKey HKCR TypeLib{4158DB95-DE71-41FF-BEA1-2C3D1C679DF1}
DeleteRegKey HKCR TypeLib{a5adeae7-a8b4-4f94-9128-bf8d8db5e927}
DeleteRegKey HKCR TypeLib{AAB6BCE3-1DF6-4930-9B14-9CA79DC8C267}
DeleteRegKey HKLM SOFTWAREMicrosoftWindowsCurrentVersionUninstallCnsMin
DeleteRegKey HKLM SOFTWAREMicrosoftWindowsCurrentVersionUninstall{1B0E7716-898E-48cc-9690-4E338E8DE1D3}
DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerAdvancedOptions!CNS"
DeleteRegKey HKLM "SOFTWAREMicrosoftWindowsCurrentVersionexplorerBrowser Helper Objects{1B0E7716-898E-48cc-9690-4E338E8DE1D3}"
DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{00000000-0000-0001-0001-596BAEDD1289}"
DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{5D73EE86-05F1-49ed-B850-E423120EC338}"
DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{0F7DE07D-BD74-4991-9D5F-ECBB8391875D}"
DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{FD00D911-7529-4084-9946-A29F1BDF4FE5}"
DeleteRegKey HKLM "SOFTWAREMicrosoftInternet ExplorerExtensions{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}"
DeleteRegKey HKLM "SOFTWAREMicrosoftCode Store DatabaseDistribution Units{B83FC273-3522-4CC6-92EC-75CC86678DA4}"
;DelRegValue
DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSHint
DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSMenu
DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSReset
DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSEnable
DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSList
DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerMain" CNSAutoUpdate
DeleteRegValue HKLM SOFTWAREMicrosoftWindowsCurrentVersionRun CnsMin
DeleteRegValue HKLM SOFTWAREMicrosoftWindowsCurrentVersionRun helper.dll
DeleteRegValue HKCU "SoftwareMicrosoftInternet ExplorerURLSearchHooks" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}
DeleteRegValue HKLM "SOFTWAREMicrosoftInternet ExplorerToolbar" {1B0E7716-898E-48cc-9690-4E338E8DE1D3}
Push $0
Push $1
Push $2
StrCpy $1 0
loop:
EnumRegValue $0 HKLM SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs $1
StrCmp $0 "" loop_quit
StrCpy $2 $0 "" -9
StrCmp $2 cns02.dat 0 +2
DeleteRegValue HKLM SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs $0
StrCpy $2 $0 "" -10
StrCmp $2 CnsMin.dll 0 +2
DeleteRegValue HKLM SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs $0
IntOp $1 $1 + 1
Goto loop
loop_quit:
StrCpy $1 0
loop2:
EnumRegKey $0 HKLM SOFTWAREMicrosoftWindowsCurrentVersionModuleUsage $1
StrCmp $0 "" loop2_quit
StrCpy $2 $0 "" -9
StrCmp $2 cns02.dat 0 +2
DeleteRegKey HKLM SOFTWAREMicrosoftWindowsCurrentVersionModuleUsage$0
StrCpy $2 $0 "" -10
StrCmp $2 CnsMin.dll 0 +2
DeleteRegKey HKLM SOFTWAREMicrosoftWindowsCurrentVersionModuleUsage$0
IntOp $1 $1 + 1
Goto loop2
loop2_quit:
;免疫
WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{B83FC273-3522-4CC6-92EC-75CC86678DA4}" "Compatibility Flags" 1024
WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{4522DBFE-14CD-4A59-AC2A-54BADFDD6D53}" "Compatibility Flags" 1024
WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{1B0E7716-898E-48CC-9690-4E338E8DE1D3}" "Compatibility Flags" 1024
WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}" "Compatibility Flags" 1024
WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686}" "Compatibility Flags" 1024
WriteRegDWORD HKLM "SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{8D898B17-976D-44c1-84E6-AF38842AC9EC}" "Compatibility Flags" 1024
Delete /REBOOTOK $PROGRAMFILEScnscfgf.dat
Delete /REBOOTOK $PROGRAMFILEScnscfgr.dat
Delete /REBOOTOK $PROGRAMFILEScnsmin.dat
Delete /REBOOTOK $PROGRAMFILES3721*.*
RMDir /r $PROGRAMFILES3721
RMDir /REBOOTOK $PROGRAMFILES3721
RMDir /r "$SMPROGRAMS网络实名"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721abmain.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721autolive.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cescache.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesfox.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesmain.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesout.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesout10.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cesweb.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cmail.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cnsio.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cnsminkp.vxd"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cnsminkp2k.sys"
Delete /REBOOTOK "$WINDIRDownloaded Program Files3721cnsminkpxp.sys"
Delete /REBOOTOK "$WINDIRDownloaded Program Filesaxfilter.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescns02.dat"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnshook.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsio.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmin.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmin.inf"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmin.ini"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminaf.cab"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmincg.ini"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminck.cab"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminck.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmindt.cab"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsmindt.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminex.cab"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminex.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminex.ini"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminio.cab"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminio.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminsv.cab"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsminsv.dll"
Delete /REBOOTOK "$WINDIRDownloaded Program Filescnsup.ini"
Delete /REBOOTOK "$WINDIRDownloaded Program Fileskeepmainm.cab"
Delete /REBOOTOK "$SYSDIRassist.dll"
Delete /REBOOTOK "$SYSDIRbdhelper.dll"
Delete /REBOOTOK "$SYSDIRcesweb.dll"
Delete /REBOOTOK "$SYSDIRcnshook.dll"
Delete /REBOOTOK "$SYSDIRehelper.dll"
Pop $2
Pop $1
Pop $0
FunctionEnd
Function Ban3721WriteFile
Exch $R0
Push $R1
FileOpen $R1 $PLUGINSDIR3721.txt a
FileSeek $R1 0 END
FileWrite $R1 $R0$r$n
FileClose $R1
Pop $R1
Pop $R0
FunctionEnd
Function SkipBan3721
Push $R0
Push $R1
Push $R2
Push $R3
StrCpy $R1 1
StrCpy $R0 0
StrLen $R3 $CMDLINE
loop:
StrCpy $R2 $CMDLINE 14 $R1
StrCmp $R2 "/skip ban 3721" loop_quit
IntCmp $R1 $R3 end 0 end
IntOp $R1 $R1 + 1
Goto loop
loop_quit:
StrCpy $R0 1
end:
Pop $R3
Pop $R2
Pop $R1
Exch $R0
FunctionEnd
OutFile "Chk3721.exe"
Section "永恒心锁"
Call Chk3721
SectionEnd
免责声明：根据《计算机软件保护条例》第十七条规定“为了学习和研究软件内含的设计思想和原理，通过安装、显示、传输或者存储软件等方式使用软件的，可以不经软件著作权人许可，不向其支付报酬。”您需知晓本站所有内容资源均来源于网络，仅供用户交流学习与研究使用，版权归属原版权方所有，版权争议与本站无关，用户本人下载后不能用作商业或非法用途，需在24个小时之内从您的电脑中彻底删除上述内容，否则后果均由用户承担责任；如果您访问和下载此文件，表示您同意只将此文件用于参考、学习而非其他用途，否则一切后果请您自行承担，如果您喜欢该程序，请支持正版软件，购买注册，得到更好的正版服务。丨本站为个人博客非盈利性站点，所有软件信息均来自网络，所有资源仅供学习参考研究目的，并不贩卖软件，不存在任何商业目的及用途。丨本文采用知识共享 署名4.0国际许可协议 [BY-NC-SA] 进行授权BY-NC-SA协议进行授权
转载请注明：永恒心锁-分享互联网 » 蓝色网际卸载3721流氓插件