In-depth understanding and writing a special killing tool system to kill the virus at startup (1)

Many vicious viruses now need to be killed by special killing tools, but some viruses will automatically disable the killing tool. For these stubborn viruses, we often use other systems (such as DOS or PE) to kill. In fact, the killing tool is a batch file that can delete virus files. It is not difficult to understand and write. This article takes everyone to understand and write a special killing tool, you can directly enter the anti-virus menu and kill the virus when the system starts.

First, for Windows XP system users

For such system users, we can use Vfloppy and other virtual floppy software to add DOS anti-virus system to Windows XP, and then use the automatic batch file under DOS (Autoexec.bat) to easily remove viruses. Here is an example of automatic removal of the dog virus.

Step 1: Go online to find the dog virus information, make a batch file according to the virus characteristics or directly download the batch file made by the netizen. For example, the robot dog virus kill can go to http://hi.baidu.com/%D0%C2%C9%FA%BA%DA%BF%CD/blog/item/4274eef44b0645ea7709d7ec.html to get the special kill batch file.

Step 2: Start Notepad, enter the following code, save as kill.bat, and place it in the root directory of the D drive (Rem statement is a comment, no need to enter).

Rem removes hidden, read-only, system properties of virus files

attrib -h -r -s C:\\WINDOWS\\IGM.exe

rem deletes specified virus files

del C:\\WINDOWS\\IGM.exe

rem Create a directory with the same name as the virus file at the source location to prevent virus recurrence

md C:\\WINDOWS\\IGM. Exe

Note: For the convenience of description, only one of the virus files C:\\WINDOWS\\IGM.exe is deleted in the batch processing. For the command to delete other virus files, please refer to the above format.

Step 3: Download Vfloppy, download and unzip Vfloppy.exe, select the "filedisk.img" file in the unzipped directory, and display the text as "DOS Auto Antivirus". Others take the default settings and finally Click Apply and the program prompts that the boot image file is successful. Do not choose to restart and exit Vfloppy at this time.

Step 4: Now modify the batch file in Bootdisk.img to start the anti-virus. Download winimage at http://winimage.com/winima70g.exe. After running WinImage, click "File → Open", open C:\\boot\\bootdisk.img, then select "AUTOEXEC.BAT" in the file list, right click on it and select "Expand" to release AUTOEXEC.BAT to d:\\.

Step 5: Open d:\\autoexec.bat with Notepad, find the line "echo The diagnostic tools were successfully loaded to drive %RAMD%.", then add the following line under "echo." Content: call d:\\kill.bat

Tip: The function of the above command is to automatically delete the virus after calling DOS to make the batch file kill.bat.

Step 6: Run WinImage again to open C:\\boot\\bootdisk.img, click “Image→Add”, and follow the prompts to add the modified AUTOEXEC.BAT file. If the program prompts to overwrite, click "Yes", then save bootdisk.img and exit the program. By modifying AUTOEXEC.BAT, the purpose of automatically calling the killing batch file to delete the virus after booting to DOS is realized. If you encounter other viruses next time, just modify the code in d:\\kill.bat to implement the new kill function.