批处理之家 - Powered by Discuz! Board

标题: [文件操作] 批处理怎么删除所有盘下所有目录的lpk.dll? [打印本页]

作者: HughRyu 时间: 2019-1-24 18:58 标题: 批处理怎么删除所有盘下所有目录的lpk.dll?

怎么删除所有盘下所有目录的lpk.dll?
比如C盘,D盘,E盘
各个目录下的各个lpk.dll
都想删除删除之前还要执行以下针对lpk.dll
执行attrib -r -a -s -h /s /d lpk.dll
del /s /q lpk.dll
怎么嵌套循环起来呢?

作者: 窄口牛 时间: 2019-1-24 20:14

有专杀工具。

作者: xczxczxcz 时间: 2019-1-25 10:34

attrib -r -s -h /s /d c:\lpk.dll & del /s /q c:\lpk.dll
在脚本前加入管理员权限。或用PS调用 RUNAS 。
先自行修改PS的执行策略改成最高。删除后再改回来。

start "$pshome\powershell.exe" -ArgumentList "-noprofile -command `
&attrib -r -s -h /s c:\lpk.dll;`
&attrib -r -s -h /s d:\lpk.dll;`
&attrib -r -s -h /s e:\lpk.dll;`
del c:\lpk.dll -rec -force;`
del d:\lpk.dll -rec -force;`
del e:\lpk.dll -rec -force;" `
-verb runas;
复制代码

作者: Batcher 时间: 2019-1-25 11:03

@echo off
for %%a in (C D E F G H I J K L M N O P Q R S T U V W X Y Z) do (
    if exist %%a:\ (
        pushd %%a:\
        echo 正在处理 %%a:\
        attrib -r -a -s -h /s /d lpk.dll
        del /s /q lpk.dll
        popd
    )
)
pause
复制代码

作者: HughRyu 时间: 2019-1-25 13:16

回复 4# Batcher

正在处理 C:\
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Wind
ows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Wind
ows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Window
s\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Window
s\SysWOW64\lpk.dll

执行就出现这样的字样,然后开始无限循环...

作者: HughRyu 时间: 2019-1-25 13:31

拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Wind
ows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Wind
ows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Window
s\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Window
s\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\
System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\
SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\Sy
stem32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\Sy
sWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\Syst
em32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysW
OW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System
32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW
64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32
\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64
\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\l
pk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\l
pk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk
.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk
.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.d
ll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.d
ll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll

拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll

拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\D\Windows\System32\lpk.dll
拒绝访问 - C:\D\Windows\SysWOW64\lpk.dll
拒绝访问 - C:\Windows\System32\lpk.dll
拒绝访问 - C:\Windows\SysWOW64\lpk.dll
C:\Windows\System32\lpk.dll
拒绝访问。
C:\Windows\SysWOW64\lpk.dll
拒绝访问。

最后结果是这样的...这个感觉怪怪的....耗时很久....

作者: Batcher 时间: 2019-1-25 14:00

回复 6# HughRyu

邮件单击bat文件，以管理员方式运行，试试可以吗？

作者: xczxczxcz 时间: 2019-1-26 09:49

听说LPK.DLL 是勒索病毒。其实系统自带也有这个文件。下面的排除系统目录。

@echo off
::UAC
>nul 2>&1 "%Windir%\system32\cacls.exe" "%Windir%\system32\config\system"
if %errorlevel% NEQ 0 (echo UAC……& goto UACPrompt) else goto gotAdmin
:UACPrompt
	echo Set UAC = CreateObject^("Shell.Application"^) > "%Temp%\getadmin.vbs"
	echo UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%Temp%\getadmin.vbs"
	"%Temp%\getadmin.vbs"
	exit /B
:gotAdmin
	del /f /q "%Temp%\getadmin.vbs">nul 2>&1

for %%a in (C D E) do (
	echo 检查 %%a 盘中...
	for /f "delims=" %%c in ('dir/a-d/b/s "%%a:\lpk.dll"') do (
		if exist "%%c" (
			echo %%c|findstr /iv "System32 SysWOW64 WinSxS" && (
				takeown /f "%%c"
				icacls "%%c" /grant administrators:F
				attrib -r -s -h "%%c"
				del /q /f "%%c"
			)
		)
	)
)
pause
复制代码

欢迎光临批处理之家 (http://bbs.bathome.net/)