On Error Resume Next

MsgBox "º» ÆÄÀÏÀº ¿ÀÅä·±(USB) ¹ÙÀÌ·¯½º »èÁ¦ ½ºÅ©¸³Æ®ÀÔ´Ï´Ù. ¹ÙÀÌ·¯½º¸¦ Á¦¿ÜÇÑ" & Chr(13) & Chr(10) & "ÆÄÀÏÀº »èÁ¦µÇÁö ¾ÊÀ¸¸ç ¹ÙÀÌ·¯½º·Î ÀÎÇØ º¯°æµÈ ·¹Áö½ºÆ®¸®¸¦ º¹±¸ÇÕ´Ï´Ù." & Chr(13) & Chr(13) & Chr(13) & Chr(10) & "[ ÆÄÀÏ ¼³¸í ]" & Chr(13) & Chr(13) & Chr(10) & "- º» ½ºÅ©¸³Æ®´Â Windows XP ±âÁØÀ¸·Î ÀÛ¼ºµÇ¾ú½À´Ï´Ù. (¸Þ¸ðÀå)" & Chr(13) & Chr(13) & Chr(10) & "- ¹ÙÀÌ·¯½ºÀÇ Æ¯¼º»ó ¸ðµç º¯Á¾¿¡ ´ëÀÀÇÒ ¼ö ¾øÀ¸¸ç ºñ±³Àû ÈçÇÑ ¿ÀÅä·± ¹ÙÀÌ·¯½º" & Chr(13) & Chr(10) & "Áß¿¡¼­ °£´ÜÈ÷ »èÁ¦°¡ °¡´ÉÇÑ ¹ÙÀÌ·¯½º¿¡ ÇÑÇؼ­ Ä¡·á°¡ °¡´ÉÇÕ´Ï´Ù.(10¿©Á¾ ÀÌ»ó)" & Chr(13) & Chr(13) & Chr(10) & "- ¸ðµç ·çÆ® µð·ºÅ丮ÀÇ ¹ÙÀÌ·¯½º¸¦ »èÁ¦Çϵµ·Ï ¸í·É¾î¸¦ ÀÔ·ÂÇ߱⠶§¹®¿¡" & Chr(13) & Chr(10) & "°¨¿°µÈ USB ¸Þ¸ð¸®°¡ ÀÖ´Ù¸é ¿¬°áµÈ »óÅ¿¡¼­ ÁøÇàÀ» Çϼŵµ µË´Ï´Ù." & Chr(13) & Chr(13) & Chr(10) & "- ½ºÅ©¸³Æ® Á¾·á ÈÄ °¢ µå¶óÀ̺êÀÇ ·çÆ® µð·ºÅ丮 [¿¹: ·ÎÄà µð½ºÅ© (?:)," & Chr(13) & Chr(10) & "À̵¿½Ä µð½ºÅ© (?:) µî] ¿¡ È®ÀεÇÁö ¾ÊÀº driver.exe, setup.exe," & Chr(13) & Chr(10) & "update.exe ÆÄÀÏÀÌ ÀÖ´Ù¸é ¼öµ¿À¸·Î »èÁ¦ÇϽñ⠹ٶø´Ï´Ù." & Chr(13) & Chr(13) & Chr(10) & "(°£È¤ ·çÆ® µð·ºÅ丮¿¡ ÇÁ·Î±×·¥À» ´Ù¿î ¹Þ´ÂºÐÀÌ °è½Ã°í, ¶Ç USB ÀÇ °æ¿ì °°Àº" & Chr(13) & Chr(10) & "À̸§À¸·Î ÀúÀåµÈ ÆÄÀÏÀÌ ÀÖÀ» ¼ö Àֱ⠶§¹®¿¡ À§ ÆÄÀÏ À̸§Àº Á¦¿ÜÇß½À´Ï´Ù.)" & Chr(13) & Chr(13) & Chr(10) & "- ?:\WINDOWS\system32\mmc.exe ÆÄÀÏÀÌ Microsoft Management Console ÀÌ" & Chr(13) & Chr(10) & "¾Æ´Ñ °æ¿ì ¹ÙÀÌ·¯½º ÆÄÀÏÀÏ ¼öµµ ÀÖ½À´Ï´Ù. ½ºÅ©¸³Æ® Á¾·á ÈÄ È®ÀÎÇغ¸½Ã±â ¹Ù¶ø´Ï´Ù." & Chr(13) & Chr(13) & Chr(13) & Chr(10) & "2007³â 12¿ù 28ÀÏ ÃÖÁ¾¼öÁ¤", vbInformation, "Delete Autorun"

if MsgBox("ÀÛ¾÷À» ÁøÇàÇϽðڽÀ´Ï±î?" & Chr(13) & Chr(13) & Chr(10) & "¡Ø °æ°í! ¾Æ·¡ À̸§À¸·Î ÀúÀåµÈ ÆÄÀÏÀÌ ·çÆ® µð·ºÅ丮¿¡ ÀÖ´Â °æ¿ì »èÁ¦µË´Ï´Ù." & Chr(13) & Chr(13) & Chr(10) & "[Change.exe Cope.exe Copy.exe Host.exe M.exe Rose.exe" & Chr(13) & Chr(10) & " Session.exe She.exe T.exe Toy.exe Windows.exe Xcopy.exe]", vbQuestion + vbYesNo, "Delete Autorun") = vbYes then
MsgBox "explorer.exe ÇÁ·Î¼¼½º¸¦ Á¾·áÇÕ´Ï´Ù.", vbInformation, "Delete Autorun"

Set Shell = WScript.CreateObject("WScript.Shell")
Set FSO = WScript.CreateObject("Scripting.FileSystemObject")

Set windows = FSO.GetSpecialFolder(0)
Set system32 = FSO.GetSpecialFolder(1)
Set temp = FSO.GetSpecialFolder(2)

kill = "cmd.exe /c taskkill.exe /f /im "
delete = "cmd.exe /c del /f /q /a "

aapp = chr(34) & "%systemdrive%\Documents and Settings\All Users\Application Data"
profile = chr(34) & "%systemdrive%\Program Files"
blk = chr(34) & " "

Shell.Run kill & "explorer.exe",0,True

Shell.Run "cmd.exe /c net stop " & chr(34) & "Distributed Link Tracking Client logger" & chr(34),0,True
Shell.Run "cmd.exe /c sc stop " & chr(34) & "Distributed Link Tracking Client logger" & chr(34),0,True
Shell.Run "cmd.exe /c sc delete " & chr(34) & "Distributed Link Tracking Client logger" & chr(34),0,True

Shell.Run "cmd.exe /c net stop " & chr(34) & "Medie Sariel Number Services" & chr(34),0,True
Shell.Run "cmd.exe /c sc stop " & chr(34) & "Medie Sariel Number Services" & chr(34),0,True
Shell.Run "cmd.exe /c sc delete " & chr(34) & "Medie Sariel Number Services" & chr(34),0,True

Shell.Run "cmd.exe /c net stop " & chr(34) & "Microsoft Logon Service" & chr(34),0,True
Shell.Run "cmd.exe /c sc stop " & chr(34) & "Microsoft Logon Service" & chr(34),0,True
Shell.Run "cmd.exe /c sc delete " & chr(34) & "Microsoft Logon Service" & chr(34),0,True

Shell.Run "cmd.exe /c net stop " & chr(34) & "Microsoft Terminal Service" & chr(34),0,True
Shell.Run "cmd.exe /c sc stop " & chr(34) & "Microsoft Terminal Service" & chr(34),0,True
Shell.Run "cmd.exe /c sc delete " & chr(34) & "Microsoft Terminal Service" & chr(34),0,True

Shell.Run kill & "fun.xls.exe",0,True
Shell.Run kill & "sal.xls.exe",0,True
Shell.Run kill & "tel.xls.exe",0,True
Shell.Run kill & "wsctf.exe.exe",0,True

Shell.Run kill & "6047e07b.exe",0,True
Shell.Run kill & "a00*",0,True
Shell.Run kill & "adober.exe",0,True
Shell.Run kill & "algsrv.exe",0,True
Shell.Run kill & "algsrvs.exe",0,True
Shell.Run kill & "algssl.exe",0,True
Shell.Run kill & "bindfile.exe",0,True
Shell.Run kill & "change.exe",0,True
Shell.Run kill & "cjqqsol.exe",0,True
Shell.Run kill & "cmd.com",0,True
Shell.Run kill & "cope.exe",0,True
Shell.Run kill & "copy.exe",0,True
Shell.Run kill & "driver.exe",0,True
Shell.Run kill & "expl0re.exe",0,True
Shell.Run kill & "expl0rer.exe",0,True
Shell.Run kill & "explore.exe",0,True
Shell.Run kill & "filekan.exe",0,True
Shell.Run kill & "host.exe",0,True
Shell.Run kill & "ielp.exe",0,True
Shell.Run kill & "iexpl0re.exe",0,True
Shell.Run kill & "iexpl0rer.exe",0,True
Shell.Run kill & "iexplorer.exe",0,True
Shell.Run kill & "info.exe",0,True
Shell.Run kill & "ivsgiih.exe",0,True
Shell.Run kill & "kb20060111.exe",0,True
Shell.Run kill & "m.exe",0,True
Shell.Run kill & "meex.exe",0,True
Shell.Run kill & "moviemk.exe",0,True
Shell.Run kill & "msfir80.exe",0,True
Shell.Run kill & "msfun80.exe",0,True
Shell.Run kill & "msime80.exe",0,True
Shell.Run kill & "msime82.exe",0,True
Shell.Run kill & "mslogon.exe",0,True
Shell.Run kill & "msnote.exe",0,True
Shell.Run kill & "msterminal.exe",0,True
Shell.Run kill & "notaped.exe",0,True
Shell.Run kill & "ounddyh.exe",0,True
Shell.Run kill & "ravmone.exe",0,True
Shell.Run kill & "rose.exe",0,True
Shell.Run kill & "sacaka.exe",0,True
Shell.Run kill & "sacksa.exe",0,True
Shell.Run kill & "session.exe",0,True
Shell.Run kill & "setup.exe",0,True
Shell.Run kill & "she.exe",0,True
Shell.Run kill & "socksa.exe",0,True
Shell.Run kill & "svch0st.exe",0,True
Shell.Run kill & "svchost.com",0,True
Shell.Run kill & "svohost.exe",0,True
Shell.Run kill & "sxs.exe",0,True
Shell.Run kill & "sxs2.exe",0,True
Shell.Run kill & "systemfile.com",0,True
Shell.Run kill & "systemnt.exe",0,True
Shell.Run kill & "t.exe",0,True
Shell.Run kill & "toy.exe",0,True
Shell.Run kill & "temp*",0,True
Shell.Run kill & "update.exe",0,True
Shell.Run kill & "wincfgs.exe",0,True
Shell.Run kill & "windows.exe",0,True
Shell.Run kill & "winl0gon.exe",0,True
Shell.Run kill & "winlog0n.exe",0,True
Shell.Run kill & "winw0rd.exe",0,True
Shell.Run kill & "wsctf.exe",0,True
Shell.Run kill & "wuauclt1.exe",0,True
Shell.Run kill & "xcopy.exe",0,True
Shell.Run kill & "xiaohao.exe",0,True
Shell.Run kill & "xiaoshen.exe",0,True

Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DISTRIBUTED_LINK_TRACKING_CLIENT_LOGGER" & chr(34) & " /f",0,True
Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEDIE_SARIEL_NUMBER_SERVICES" & chr(34) & " /f",0,True
Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MICROSOFT_LOGON_SERVICE" & chr(34) & " /f",0,True
Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MICROSOFT_TERMINAL_SERVICE" & chr(34) & " /f",0,True

Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Distributed Link Tracking Client logger" & chr(34) & " /f",0,True
Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Medie Sariel Number Services" & chr(34) & " /f",0,True
Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Microsoft Logon Service" & chr(34) & " /f",0,True
Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Microsoft Terminal Service" & chr(34) & " /f",0,True

Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" & chr(34) & " /f",0,True

Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mmc" & chr(34) & " /f",0,True

Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\windows:Load" & chr(34) & " /f",0,True
Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\windows:Run" & chr(34) & " /f",0,True

Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" & chr(34) & " /f",0,True

Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ASocksrv"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BSserver"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\dll"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.EXE"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IMJPMIG8.2"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\jmemavf"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MsServer"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ounddyh"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RavAV"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SoundMam"
Shell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\wsctf.exe"

Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ASocksrv"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BSserver"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dll"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EXPLORER.EXE"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IMJPMIG8.2"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jmemavf"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsServer"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ounddyh"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RavAV"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoundMam"
Shell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wsctf.exe"

Shell.RegWrite "HKCR\Directory\shell\","none","REG_SZ"
Shell.RegWrite "HKCR\Drive\shell\","none","REG_SZ"

Shell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit",system32 & "\userinit.exe,","REG_SZ"
Shell.RegWrite "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load",""
Shell.RegWrite "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run",""
Shell.RegWrite "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\",""

Shell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue","1","REG_DWORD"
Shell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt\UncheckedValue","0","REG_DWORD"

Shell.Run delete & windows & "\*.xls.exe " & windows & "\6047e07b.exe " & windows & "\A00000000 " & windows & "\A00????.exe " & windows & "\adober.exe " & windows & "\algsrv.exe " & windows & "\algsrvs.exe " & windows & "\algssl.exe " & windows & "\autorun.* " & windows & "\backinf.tab " & windows & "\bindfile.exe " & windows & "\change.exe " & windows & "\cjqqsol.exe " & windows & "\cmd.com " & windows & "\cope.exe " & windows & "\copy.exe " & windows & "\driver.exe " & windows & "\expl0re.exe",0,True
Shell.Run delete & windows & "\expl0rer.exe " & windows & "\explore.exe " & windows & "\filekan.exe " & windows & "\host.exe " & windows & "\ielp.exe " & windows & "\iexpl0re.exe " & windows & "\iexpl0rer.exe " & windows & "\iexplore.exe " & windows & "\iexplorer.exe " & windows & "\iphelp.ini " & windows & "\ivsgiih.exe " & windows & "\jmemavf.inf " & windows & "\kb20060111.exe " & windows & "\love.cn.ini " & windows & "\m.exe " & windows & "\meex.exe " & windows & "\moviemk.exe " & windows & "\msfir80.exe",0,True
Shell.Run delete & windows & "\msfun80.exe " & windows & "\msime80.exe " & windows & "\msime82.exe " & windows & "\mslogon.exe " & windows & "\msnote.exe " & windows & "\msterminal.exe " & windows & "\notaped.exe " & windows & "\ounddyh.exe " & windows & "\ravmone.exe " & windows & "\rose.exe " & windows & "\sacaka.exe " & windows & "\sacksa.exe " & windows & "\session.exe " & windows & "\setup.exe " & windows & "\she.exe " & windows & "\socksa.exe " & windows & "\svch0st.exe",0,True
Shell.Run delete & windows & "\svchost.com " & windows & "\svchost.exe " & windows & "\svohost.exe " & windows & "\sxs.exe " & windows & "\sxs2.exe " & windows & "\systemdate.ini " & windows & "\systemfile.com " & windows & "\systemnt.exe " & windows & "\t.exe " & windows & "\temp?.exe " & windows & "\toy.exe " & windows & "\ufdata2000.log " & windows & "\update.exe " & windows & "\wincfgs.exe " & windows & "\windows.exe " & windows & "\winl0gon.exe " & windows & "\winlog0n.exe",0,True
Shell.Run delete & windows & "\winscok.dll " & windows & "\winw0rd.exe " & windows & "\wozzwclo.dll " & windows & "\wozzwclo.sys " & windows & "\wsctf.exe " & windows & "\wsctf.exe.exe " & windows & "\wuauclt1.exe " & windows & "\xcopy.exe " & windows & "\xiaohao.exe " & windows & "\xiaoshen.exe " & windows & "\ctfmon.exe",0,True

Shell.Run delete & system32 & "\*.xls.exe " & system32 & "\6047e07b.exe " & system32 & "\A00000000 " & system32 & "\A00????.exe " & system32 & "\adober.exe " & system32 & "\algsrv.exe " & system32 & "\algsrvs.exe " & system32 & "\algssl.exe " & system32 & "\autorun.* " & system32 & "\backinf.tab " & system32 & "\bindfile.exe " & system32 & "\change.exe " & system32 & "\cjqqsol.exe " & system32 & "\cmd.com " & system32 & "\cope.exe " & system32 & "\copy.exe " & system32 & "\driver.exe",0,True
Shell.Run delete & system32 & "\expl0re.exe " & system32 & "\expl0rer.exe " & system32 & "\explore.exe " & system32 & "\filekan.exe " & system32 & "\host.exe " & system32 & "\ielp.exe " & system32 & "\iexpl0re.exe " & system32 & "\iexpl0rer.exe " & system32 & "\iexplore.exe " & system32 & "\iexplorer.exe " & system32 & "\iphelp.ini " & system32 & "\ivsgiih.exe " & system32 & "\jmemavf.inf " & system32 & "\kb20060111.exe " & system32 & "\love.cn.ini " & system32 & "\m.exe " & system32 & "\meex.exe",0,True
Shell.Run delete & system32 & "\moviemk.exe " & system32 & "\msfir80.exe " & system32 & "\msfun80.exe " & system32 & "\msime80.exe " & system32 & "\msime82.exe " & system32 & "\mslogon.exe " & system32 & "\msnote.exe " & system32 & "\msterminal.exe " & system32 & "\notaped.exe " & system32 & "\ounddyh.exe " & system32 & "\ravmone.exe " & system32 & "\rose.exe " & system32 & "\sacaka.exe " & system32 & "\sacksa.exe " & system32 & "\session.exe " & system32 & "\setup.exe",0,True
Shell.Run delete & system32 & "\she.exe " & system32 & "\socksa.exe " & system32 & "\svch0st.exe " & system32 & "\svchost.com " & system32 & "\svohost.exe " & system32 & "\sxs.exe " & system32 & "\sxs2.exe " & system32 & "\systemdate.ini " & system32 & "\systemfile.com " & system32 & "\systemnt.exe " & system32 & "\t.exe " & system32 & "\temp?.exe " & system32 & "\toy.exe " & system32 & "\ufdata2000.log " & system32 & "\update.exe " & system32 & "\wincfgs.exe",0,True
Shell.Run delete & system32 & "\windows.exe " & system32 & "\winl0gon.exe " & system32 & "\winlog0n.exe " & system32 & "\winscok.dll " & system32 & "\winw0rd.exe " & system32 & "\wozzwclo.dll " & system32 & "\wozzwclo.sys " & system32 & "\wsctf.exe " & system32 & "\wsctf.exe.exe " & system32 & "\wuauclt1.exe " & system32 & "\xiaohao.exe " & system32 & "\xiaoshen.exe " & system32 & "\explorer.exe",0,True
Shell.Run delete & system32 & "\drivers\wozzwclo.sys",0,True

Shell.Run delete & temp & "\*.xls.exe " & temp & "\6047e07b.exe " & temp & "\A00000000 " & temp & "\A00????.exe " & temp & "\adober.exe " & temp & "\algsrv.exe " & temp & "\algsrvs.exe " & temp & "\algssl.exe " & temp & "\autorun.* " & temp & "\backinf.tab " & temp & "\bindfile.exe " & temp & "\change.exe " & temp & "\cjqqsol.exe " & temp & "\cmd.com " & temp & "\cope.exe " & temp & "\copy.exe " & temp & "\driver.exe " & temp & "\expl0re.exe " & temp & "\expl0rer.exe " & temp & "\explore.exe",0,True
Shell.Run delete & temp & "\filekan.exe " & temp & "\host.exe " & temp & "\ielp.exe " & temp & "\iexpl0re.exe " & temp & "\iexpl0rer.exe " & temp & "\iexplore.exe " & temp & "\iexplorer.exe " & temp & "\iphelp.ini " & temp & "\ivsgiih.exe " & temp & "\jmemavf.inf " & temp & "\kb20060111.exe " & temp & "\love.cn.ini " & temp & "\m.exe " & temp & "\meex.exe " & temp & "\moviemk.exe " & temp & "\msfir80.exe " & temp & "\msfun80.exe " & temp & "\msime80.exe " & temp & "\msime82.exe " & temp & "\mslogon.exe",0,True
Shell.Run delete & temp & "\msnote.exe " & temp & "\msterminal.exe " & temp & "\notaped.exe " & temp & "\ounddyh.exe " & temp & "\ravmone.exe " & temp & "\rose.exe " & temp & "\sacaka.exe " & temp & "\sacksa.exe " & temp & "\session.exe " & temp & "\setup.exe " & temp & "\she.exe " & temp & "\socksa.exe " & temp & "\svch0st.exe " & temp & "\svchost.com " & temp & "\svchost.exe " & temp & "\svohost.exe " & temp & "\sxs.exe " & temp & "\sxs2.exe " & temp & "\systemdate.ini",0,True
Shell.Run delete & temp & "\systemfile.com " & temp & "\systemnt.exe " & temp & "\t.exe " & temp & "\temp?.exe " & temp & "\toy.exe " & temp & "\ufdata2000.log " & temp & "\update.exe " & temp & "\wincfgs.exe " & temp & "\windows.exe " & temp & "\winl0gon.exe " & temp & "\winlog0n.exe " & temp & "\winscok.dll " & temp & "\winw0rd.exe " & temp & "\wozzwclo.dll " & temp & "\wozzwclo.sys " & temp & "\wsctf.exe " & temp & "\wsctf.exe.exe " & temp & "\wuauclt1.exe " & temp & "\xcopy.exe",0,True
Shell.Run delete & temp & "\xiaohao.exe " & temp & "\xiaoshen.exe " & temp & "\ctfmon.exe " & temp & "\explorer.exe " & temp & "\~DF*",0,True

Shell.Run delete & aapp & "\*.xls.exe" & blk & aapp & "\6047e07b.exe" & blk & aapp & "\A00000000" & blk & aapp & "\A00????.exe" & blk & aapp & "\adober.exe" & blk & aapp & "\algsrv.exe" & blk & aapp & "\algsrvs.exe" & blk & aapp & "\algssl.exe" & blk & aapp & "\autorun.*" & blk & aapp & "\backinf.tab" & blk & aapp & "\bindfile.exe" & blk & aapp & "\change.exe" & blk & aapp & "\cjqqsol.exe" & blk & aapp & "\cmd.com" & blk & aapp & "\cope.exe" & blk & aapp & "\copy.exe" & blk & aapp & "\driver.exe" & chr(34),0,True
Shell.Run delete & aapp & "\expl0re.exe" & blk & aapp & "\expl0rer.exe" & blk & aapp & "\explore.exe" & blk & aapp & "\filekan.exe" & blk & aapp & "\host.exe" & blk & aapp & "\ielp.exe" & blk & aapp & "\iexpl0re.exe" & blk & aapp & "\iexpl0rer.exe" & blk & aapp & "\iexplore.exe" & blk & aapp & "\iexplorer.exe" & blk & aapp & "\iphelp.ini" & blk & aapp & "\ivsgiih.exe" & blk & aapp & "\jmemavf.inf" & blk & aapp & "\kb20060111.exe" & blk & aapp & "\love.cn.ini" & blk & aapp & "\m.exe" & blk & aapp & "\meex.exe" & chr(34),0,True
Shell.Run delete & aapp & "\moviemk.exe" & blk & aapp & "\msfir80.exe" & blk & aapp & "\msfun80.exe" & blk & aapp & "\msime80.exe" & blk & aapp & "\msime82.exe" & blk & aapp & "\mslogon.exe" & blk & aapp & "\msnote.exe" & blk & aapp & "\msterminal.exe" & blk & aapp & "\notaped.exe" & blk & aapp & "\ounddyh.exe" & blk & aapp & "\ravmone.exe" & blk & aapp & "\rose.exe" & blk & aapp & "\sacaka.exe" & blk & aapp & "\sacksa.exe" & blk & aapp & "\session.exe" & blk & aapp & "\setup.exe" & chr(34),0,True
Shell.Run delete & aapp & "\she.exe" & blk & aapp & "\socksa.exe" & blk & aapp & "\svch0st.exe" & blk & aapp & "\svchost.com" & blk & aapp & "\svchost.exe" & blk & aapp & "\svohost.exe" & blk & aapp & "\sxs.exe" & blk & aapp & "\sxs2.exe" & blk & aapp & "\systemdate.ini" & blk & aapp & "\systemfile.com" & blk & aapp & "\systemnt.exe" & blk & aapp & "\t.exe" & blk & aapp & "\temp?.exe" & blk & aapp & "\toy.exe" & blk & aapp & "\ufdata2000.log" & blk & aapp & "\update.exe" & blk & aapp & "\wincfgs.exe" & chr(34),0,True
Shell.Run delete & aapp & "\windows.exe" & blk & aapp & "\winl0gon.exe" & blk & aapp & "\winlog0n.exe" & blk & aapp & "\winscok.dll" & blk & aapp & "\winw0rd.exe" & blk & aapp & "\wozzwclo.dll" & blk & aapp & "\wozzwclo.sys" & blk & aapp & "\wsctf.exe" & blk & aapp & "\wsctf.exe.exe" & blk & aapp & "\wuauclt1.exe" & blk & aapp & "\xcopy.exe" & blk & aapp & "\xiaohao.exe" & blk & aapp & "\xiaoshen.exe" & blk & aapp & "\ctfmon.exe" & blk & aapp & "\explorer.exe" & chr(34),0,True

Shell.Run delete & profile & "\*.xls.exe" & blk & profile & "\6047e07b.exe" & blk & profile & "\A00000000" & blk & profile & "\A00????.exe" & blk & profile & "\adober.exe" & blk & profile & "\algsrv.exe" & blk & profile & "\algsrvs.exe" & blk & profile & "\algssl.exe" & blk & profile & "\autorun.*" & blk & profile & "\backinf.tab" & blk & profile & "\bindfile.exe" & blk & profile & "\change.exe" & blk & profile & "\cjqqsol.exe" & blk & profile & "\cmd.com" & blk & profile & "\cope.exe" & blk & profile & "\copy.exe" & blk & profile & "\driver.exe" & chr(34),0,True
Shell.Run delete & profile & "\expl0re.exe" & blk & profile & "\expl0rer.exe" & blk & profile & "\explore.exe" & blk & profile & "\filekan.exe" & blk & profile & "\host.exe" & blk & profile & "\ielp.exe" & blk & profile & "\iexpl0re.exe" & blk & profile & "\iexpl0rer.exe" & blk & profile & "\iexplore.exe" & blk & profile & "\iexplorer.exe" & blk & profile & "\iphelp.ini" & blk & profile & "\ivsgiih.exe" & blk & profile & "\jmemavf.inf" & blk & profile & "\kb20060111.exe" & blk & profile & "\love.cn.ini" & blk & profile & "\m.exe" & blk & profile & "\meex.exe" & chr(34),0,True
Shell.Run delete & profile & "\moviemk.exe" & blk & profile & "\msfir80.exe" & blk & profile & "\msfun80.exe" & blk & profile & "\msime80.exe" & blk & profile & "\msime82.exe" & blk & profile & "\mslogon.exe" & blk & profile & "\msnote.exe" & blk & profile & "\msterminal.exe" & blk & profile & "\notaped.exe" & blk & profile & "\ounddyh.exe" & blk & profile & "\ravmone.exe" & blk & profile & "\rose.exe" & blk & profile & "\sacaka.exe" & blk & profile & "\sacksa.exe" & blk & profile & "\session.exe" & blk & profile & "\setup.exe" & chr(34),0,True
Shell.Run delete & profile & "\she.exe" & blk & profile & "\socksa.exe" & blk & profile & "\svch0st.exe" & blk & profile & "\svchost.com" & blk & profile & "\svchost.exe" & blk & profile & "\svohost.exe" & blk & profile & "\sxs.exe" & blk & profile & "\sxs2.exe" & blk & profile & "\systemdate.ini" & blk & profile & "\systemfile.com" & blk & profile & "\systemnt.exe" & blk & profile & "\t.exe" & blk & profile & "\temp?.exe" & blk & profile & "\toy.exe" & blk & profile & "\ufdata2000.log" & blk & profile & "\update.exe" & blk & profile & "\wincfgs.exe" & chr(34),0,True
Shell.Run delete & profile & "\windows.exe" & blk & profile & "\winl0gon.exe" & blk & profile & "\winlog0n.exe" & blk & profile & "\winscok.dll" & blk & profile & "\winw0rd.exe" & blk & profile & "\wozzwclo.dll" & blk & profile & "\wozzwclo.sys" & blk & profile & "\wsctf.exe" & blk & profile & "\wsctf.exe.exe" & blk & profile & "\wuauclt1.exe" & blk & profile & "\xcopy.exe" & blk & profile & "\xiaohao.exe" & blk & profile & "\xiaoshen.exe" & blk & profile & "\ctfmon.exe" & blk & profile & "\explorer.exe" & chr(34),0,True
Shell.Run delete & profile & "\Common Files\Microsoft Shared\ivsgiih.exe" & blk & profile & "\Common Files\System\cjqqsol.exe" & chr(34),0,True

For each drvLoop in FSO.Drives

drv = drvLoop.DriveLetter & ":"

Shell.Run delete & drv & "\*.xls.exe " & drv & "\6047e07b.exe " & drv & "\A00000000 " & drv & "\A00????.exe " & drv & "\adober.exe " & drv & "\algsrv.exe " & drv & "\algsrvs.exe " & drv & "\algssl.exe " & drv & "\autorun.* " & drv & "\backinf.tab " & drv & "\bindfile.exe " & drv & "\change.exe " & drv & "\cjqqsol.exe " & drv & "\cmd.com " & drv & "\cope.exe " & drv & "\copy.exe " & drv & "\expl0re.exe " & drv & "\expl0rer.exe " & drv & "\explore.exe " & drv & "\filekan.exe " & drv & "\host.exe " & drv & "\ielp.exe " & drv & "\iexpl0re.exe",0,True
Shell.Run delete & drv & "\iexpl0rer.exe " & drv & "\iexplore.exe " & drv & "\iexplorer.exe " & drv & "\iphelp.ini " & drv & "\ivsgiih.exe " & drv & "\jmemavf.inf " & drv & "\kb20060111.exe " & drv & "\love.cn.ini " & drv & "\m.exe " & drv & "\meex.exe " & drv & "\moviemk.exe " & drv & "\msfir80.exe " & drv & "\msfun80.exe " & drv & "\msime80.exe " & drv & "\msime82.exe " & drv & "\mslogon.exe " & drv & "\msnote.exe " & drv & "\msterminal.exe " & drv & "\notaped.exe " & drv & "\ounddyh.exe " & drv & "\ravmone.exe " & drv & "\rose.exe",0,True
Shell.Run delete & drv & "\sacaka.exe " & drv & "\sacksa.exe " & drv & "\session.exe " & drv & "\she.exe " & drv & "\socksa.exe " & drv & "\svch0st.exe " & drv & "\svchost.com " & drv & "\svchost.exe " & drv & "\svohost.exe " & drv & "\sxs.exe " & drv & "\sxs2.exe " & drv & "\systemdate.ini " & drv & "\systemfile.com " & drv & "\systemnt.exe " & drv & "\t.exe " & drv & "\temp?.exe " & drv & "\toy.exe " & drv & "\ufdata2000.log " & drv & "\wincfgs.exe " & drv & "\windows.exe " & drv & "\winl0gon.exe " & drv & "\winlog0n.exe",0,True
Shell.Run delete & drv & "\winscok.dll " & drv & "\winw0rd.exe " & drv & "\wozzwclo.dll " & drv & "\wozzwclo.sys " & drv & "\wsctf.exe " & drv & "\wsctf.exe.exe " & drv & "\wuauclt1.exe " & drv & "\xcopy.exe " & drv & "\xiaohao.exe " & drv & "\xiaoshen.exe " & drv & "\ctfmon.exe " & drv & "\desktop.ini " & drv & "\explorer.exe " & drv & "\folder.htt",0,True
Shell.Run delete & drv & "\RECYCLER\info.exe",0,True

Next

if MsgBox("¸ðµç µå¶óÀ̺êÀÇ ÀÚµ¿½ÇÇà ±â´ÉÀ» Â÷´Ü ÇϽðڽÀ´Ï±î?" & Chr(13) & Chr(10) & "(¿ÀÅä·± ¹ÙÀÌ·¯½º ¿¹¹æ Â÷¿ø¿¡¼­ Â÷´ÜÀ» ±ÇÀåÇÕ´Ï´Ù.)", vbQuestion + vbYesNo, "Delete Autorun") = vbYes then

Shell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun","255","REG_DWORD"
Shell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf\","@SYS:NoWhere","REG_SZ"

MsgBox "ÀÛ¾÷ÀÌ ¿Ï·áµÇ¾ú½À´Ï´Ù. explorer.exe ÇÁ·Î¼¼½º¸¦ ½ÃÀÛÇÕ´Ï´Ù. (ÀÚµ¿½ÇÇà Â÷´Ü »óÅÂÀÔ´Ï´Ù.)", vbInformation, "Delete Autorun"

Shell.Run "explorer.exe"

else

Shell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun","145","REG_DWORD"
Shell.Run "cmd.exe /c reg.exe delete " & chr(34) & "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" & chr(34) & " /f",0,True

MsgBox "ÀÛ¾÷ÀÌ ¿Ï·áµÇ¾ú½À´Ï´Ù. explorer.exe ÇÁ·Î¼¼½º¸¦ ½ÃÀÛÇÕ´Ï´Ù. (ÀÚµ¿½ÇÇà Çã¿ë »óÅÂÀÔ´Ï´Ù.)", vbInformation, "Delete Autorun"

Shell.Run "explorer.exe"

end if

else

MsgBox "½ºÅ©¸³Æ®¸¦ Á¾·áÇÕ´Ï´Ù.", vbInformation, "Delete Autorun"

end if