@echo off
@setlocal enabledelayedexpansion
@rem 查找所有的svchost.exe 進(jìn)程
@set "str=wmic process where caption="svchsot.exe" get ExecutablePath^,Handle"
@rem 找查如果不是系統(tǒng)路徑的svchost.exe 就結(jié)束了
@for /f "skip=1 tokens=*" %%i in ('!str!') do (
for /f "tokens=1-2" %%a in ("%%i") do (
if /i not "%%a"=="!systemroot!\system32\svchost.exe" (wmic process where Handle="%%b" call Terminate)
)
)
@rem 清理綠茶后門
@attrib -h -s C:\Windows\java\Packages\urr\svchsot.exe
@del /q /f C:\Windows\java\Packages\urr\svchsot.exe
@md C:\Windows\java\Packages\urr\svchsot.exe
@echo y|cacls C:\Windows\java\Packages\urr\svchsot.exe /c /p everyone:n