|
|
发表于 2025-12-2 15:08:37
|
显示全部楼层
本帖最后由 窄口牛 于 2025-12-3 06:52 编辑
搞了个配套启动器
半自动操作，执行完后清理所有痕迹。
@echo off
Setlocal enabledelayedexpansion
reg query HKU\S-1-5-20>nul || (
echo;CreateObject^("Shell.Application"^).ShellExecute "%~f0", "", "", "runas", 1 > "%temp%\getadmin.vbs" && cscript //b "%temp%\getadmin.vbs" && exit /b & del "%temp%\getadmin.vbs" /f /q>nul 2>nul)
pushd "%CD%" && CD /D "%~dp0"
md "%AppData%\360Safe"
cd.>"%AppData%\360Safe\speedupopt"
cd.>"%AppData%\360Safe\antiadwa"
cd.>"%AppData%\360Safe\CloudData"
cd.>"%AppData%\360Safe\360Disabled"
mklink /d "%AppData%\360Safe\SnapShot" x:\temp
mklink /d "%AppData%\360Safe\Clean" x:\temp
start "" "%~dp0safemon\360tray.exe"
timeout /t 10
taskkill /im 360tray.exe /f
start "" /wait "%~dp0safemon\360settingcenter.exe"
taskkill /im 360settingcenter.exe /f
ren .\safemon\360tray.exe 360tray.ex
ren .\safemon\360settingcenter.exe 360settingcenter.ex
start "" /wait 360Safe.exe
rd "%AppData%\360Safe" /s /q
rd "%ProgramData%\360safe" /s /q
ren .\safemon\360tray.ex 360tray.exe
ren .\safemon\360settingcenter.ex 360settingcenter.exe
for /f "tokens=2" %%i in ('whoami /user ^|find "S-1-5"') do (
set sid=%%i
)
reg delete "HKCU\Software\360Safe" /f
reg delete "HKLM\SOFTWARE\Wow6432Node\360Safe" /f
reg delete "HKEY_USERS\%sid%\Software\360Safe" /f
play.rar
(644 Bytes, 下载次数: 11)
注意：有两行是建立了两个目录连接到内存盘的，和你环境不符需要修改。
这个清理痕迹有个前提，是禁止其联网，联网后会带来什么别的东西，我没有研究。
|
|
楼主: aoyabing
闽公网安备35020302032614号 )
IP卡
狗仔卡
显身卡