@echo off
color 0e
echo
pause
echo 開始結束3721程序進程.......
replace pskill.exe "C:\windows\system32" /a >nul 2>nul
pskill rundll32.exe 2>NUL 1>NUL
pskill assistse.exe 2>NUL 1>NUL
pskill YLive.exe 2>NUL 1>NUL
pause
echo 自動備份啓動項目,將要殺掉全部啓動項目
regedit /e 1.reg "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e 2.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
regedit /e 3.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
regedit /e 4.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx"
copy /b /y 1.reg+2.reg+3.reg+4.reg hy.reg >nul
for %%a in (1 2 3 4) do del %%a.reg
pause
echo 開始查殺3721惡意程序，垃圾Yahoo
attrib -s -h -r
del "%Windir%\\system32\\drivers\\CnsMinKP.sys">nul 2>nul
del "%Windir%\\system32\\cns.dll">nul 2>nul
del "%Windir%\\system32\\cns.dat">nul 2>nul
del "%Windir%\\Downloaded Program Files\\*.ico">nul 2>nul
delete "%ProgramFiles%\\3721\\*.*">nul 2>nul
delete "%ProgramFiles%\\Yahoo!\\*.*">nul 2>nul
del "%Windir%\\Downloaded Program Files\\CnsMinAL.cab">nul 2>nul
del "%Windir%\\Downloaded Program Files\\keepmainM.cab/cns1.exe">nul 2>nul
del "%Windir%\\Downloaded Program Files\\CnsMinHK.cab/CnsHook.dll">nul 2>nul
del "%Windir%\\Downloaded Program Files\\CnsMinAL.cab/AutoLive.dll/helper.dll">nul 2>nul
del "%Windir%\\system32\\cns.exe">nul 2>nul
del "%ProgramFiles%\\alLiveEx.dll">nul 2>nul
del "%ProgramFiles%\\helper.dll">nul 2>nul
del "%Windir%\\system32\\pskill.exe">nul 2>nul
echo 刪除文件完畢，進入注冊表刪除
pause
rem 加載輸入法，其他全部刪除
regedit /s del.reg
pause

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[-HKEY_CLASSES_ROOT\CMSnapin.CMSnapin]

[-HKEY_CLASSES_ROOT\CMSnapin.CMSnapin.1]

[-HKEY_CLASSES_ROOT\CMSnapinAbout.1]

[-HKEY_CLASSES_ROOT\CnsHelper.CH]

[-HKEY_CLASSES_ROOT\CnsHelper.CH.1]

[-HKEY_CLASSES_ROOT\CnsMinHK.CnsHook]

[-HKEY_CLASSES_ROOT\CnsMinHK.CnsHook.1]

[-HKEY_CLASSES_ROOT\TypeLib\{4158DB95-DE71-41FF-BEA1-2C3D1C679DF1}]

[-HKEY_CLASSES_ROOT\TypeLib\{F9AD9D67-EFA8-480E-8291-0163F3960DE7}]

[-HKEY_CLASSES_ROOT\CLSID\{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}]

[-HKEY_CLASSES_ROOT\CLSID\{ABEC6103-F6AC-43A3-834F-FB03FBA339A2}]

[-HKEY_CLASSES_ROOT\CLSID\{B83FC273-3522-4CC6-92EC-75CC86678DA4}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsMinHK.CnsHook.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsHelper.CH.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMSnapin.CMSnapin.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsHelper.CH]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMSnapinAbout.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsMinHK.CnsHook]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABEC6103-F6AC-43A3-834F-FB03FBA339A2}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B83FC273-3522-4CC6-92EC-75CC86678DA4}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}]

[-HKEY_CURRENT_USER\Software\Yahoo]

[-HKEY_CURRENT_USER\Software\3721\CnsMin]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABEC6103-F6AC-43A3-834F-FB03FBA339A2}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMSnapin.CMSnapin]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4158DB95-DE71-41FF-BEA1-2C3D1C679DF1}]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\CnsMinKP]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CnsMinKP]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CnsMinKP]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CnsMinKP]

[-HKEY_USERS\S-1-5-21-1214440339-1078145449-1343024091-500\Software\3721]

[-HKEY_USERS\S-1-5-21-1214440339-1078145449-1343024091-500\Software\Yahoo]

[-HKEY_CLASSES_ROOT\CLSID\{17F1C8E8-B99B-4D85-927B-A0EE7290455A}]

[-HKEY_CLASSES_ROOT\CLSID\{2283BB66-A15D-4AC8-BA72-9C8C9F5A1691}]

[-HKEY_CLASSES_ROOT\CLSID\{33BBE430-0E42-4F12-B075-8D21ACB10DCB}]

[-HKEY_CLASSES_ROOT\CLSID\{38928D50-8A48-44C2-945F-D2F23F771410}]

[-HKEY_CLASSES_ROOT\CLSID\{406F94F0-504F-4a40-8DFD-58B0666ABEBD}]

[-HKEY_CLASSES_ROOT\CLSID\{4F2C1A0A-622E-4D23-9870-6FB6D109C170}]

[-HKEY_CLASSES_ROOT\CLSID\{57421194-58FB-49AE-9B4F-FD48869B9AD4}]

[-HKEY_CLASSES_ROOT\CLSID\{59E99ADD-E926-40e8-BD6F-1532124A4AAA}]

[-HKEY_CLASSES_ROOT\CLSID\{62EED7C6-9F02-42f9-B634-98E2899E147B}]

[-HKEY_CLASSES_ROOT\CLSID\{9C3C2C08-C494-4F52-AE94-85156A447D43}]

[-HKEY_CLASSES_ROOT\CLSID\{AF53D70E-29DF-443A-92AA-9C314AF5871E}]

[-HKEY_CLASSES_ROOT\CLSID\{C459AB59-28A5-43A3-9D22-753F4C9586E6}]

[-HKEY_CLASSES_ROOT\CLSID\{E3128A3A-C191-4149-8631-C632C8FC9919}]

[-HKEY_CLASSES_ROOT\CLSID\{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8}]

[-HKEY_CLASSES_ROOT\jpegfile\shellex\ContextMenuHandlers\Yahoo!Photo]

[-HKEY_CLASSES_ROOT\TypeLib\{04D0FD01-C8FA-413B-AD83-519D10B93324}]

[-HKEY_CLASSES_ROOT\TypeLib\{5517390C-60D1-4FFA-BD4C-81F8278AF29E}]

[-HKEY_CLASSES_ROOT\TypeLib\{58E9B715-3C97-4048-9CBE-A708E0AEB29E}]

[-HKEY_CLASSES_ROOT\TypeLib\{8417D3DB-4004-4259-952D-A6EC64A1800E}]

[-HKEY_CLASSES_ROOT\TypeLib\{95E822B6-6B10-4E86-9603-6CECB6135867}]

[-HKEY_CLASSES_ROOT\CLSID\{C459AB59-28A5-43A3-9D22-753F4C9586E6}]

[-HKEY_CLASSES_ROOT\TypeLib\{9E9914ED-D40B-4B63-AC3B-A22AB9DE158F}]

[-HKEY_CLASSES_ROOT\TypeLib\{CF67E74A-3C62-4867-9DFA-DD2374003333}]

[-HKEY_CLASSES_ROOT\TypeLib\{E816B7F9-96AB-4D4D-8DA4-B9D124959DA5}]

[-HKEY_CLASSES_ROOT\TypeLib\{F8CC28B5-4042-4054-99CB-8855EFD0FAB7}]

[-HKEY_CLASSES_ROOT\YahooAssistBar.AsNoAdObj]

[-HKEY_CLASSES_ROOT\YahooAssistBar.AsNoAdObj.1]

[-HKEY_CLASSES_ROOT\YahooAssistBar.AssistBarObj]

[-HKEY_CLASSES_ROOT\YahooAssistBar.AssistBarObj.1]

[-HKEY_CLASSES_ROOT\YahooAssistBar.DragSearch]

[-HKEY_CLASSES_ROOT\YahooAssistBar.DragSearch.1]

[-HKEY_CLASSES_ROOT\YahooAssistBar.PhotoTb]

[-HKEY_CLASSES_ROOT\YahooAssistBar.PhotoTb.1]

[-HKEY_CLASSES_ROOT\zschkfile]

[-HKEY_CURRENT_USER\Software\Kingsoft\AntiVirus\KAVIEReg\MenuExt]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17F1C8E8-B99B-4D85-927B-A0EE7290455A}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19CE93DE-8334-42C6-B2CA-BFE3DF5196A3}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2283BB66-A15D-4AC8-BA72-9C8C9F5A1691}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33BBE430-0E42-4F12-B075-8D21ACB10DCB}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38928D50-8A48-44C2-945F-D2F23F771410}\InprocServer32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{406F94F0-504F-4a40-8DFD-58B0666ABEBD}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F2C1A0A-622E-4D23-9870-6FB6D109C17
0}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57421194-58FB-49AE-9B4F-FD48869B9AD4}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59E99ADD-E926-40e8-BD6F-1532124A4AAA}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62EED7C6-9F02-42f9-B634-98E2899E147B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C3C2C08-C494-4F52-AE94-85156A447D43}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF53D70E-29DF-443A-92AA-9C314AF5871E}\InprocServer32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C14F7681-33D8-11D3-A09B-00500402F30B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YahooAssistBar.PhotoTb.1]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\添加到雅虎收藏+]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]