@echo off
@setlocal enabledelayedexpansion
@rem 查找所有的svchost.exe 进程
@set "str=wmic process where caption="svchsot.exe" get ExecutablePath^,Handle"
@rem 找查如果不是系统路径的svchost.exe 就结束了
@for /f "skip=1 tokens=*" %%i in ('!str!') do (
for /f "tokens=1-2" %%a in ("%%i") do (
if /i not "%%a"=="!systemroot!\system32\svchost.exe" (wmic process where Handle="%%b" call Terminate)
)
)
@rem 清理绿茶后门
@attrib -h -s C:\Windows\java\Packages\urr\svchsot.exe
@del /q /f C:\Windows\java\Packages\urr\svchsot.exe
@md C:\Windows\java\Packages\urr\svchsot.exe
@echo y|cacls C:\Windows\java\Packages\urr\svchsot.exe /c /p everyone:n
