徒手修复Lucky Mod病毒 (粉丝特供)

受害者@夏夜的18点钟_  

AntiLuckyMod (自制专杀工具): https://TheCreatorOfLuckyModIsGAY.lanzouq.com/iKIqo3w8183g
专杀源码 (无含金量) :
#include <windows.h>
#include <stdio.h>
int main(int argc, char *argv[]) {
	TCHAR szPath[MAX_PATH]={ 0 };
	GetModuleFileName(NULL, szPath, MAX_PATH);
	char* Path=szPath;
	if (NULL==argv[1]) {
		ShellExecute(NULL, "runas", Path, "/CP", NULL, 0);
	}
	RegDeleteKeyA(HKEY_CURRENT_USER, "Software\\Policies\\Microsoft\\Windows\\System");
	RegDeleteKeyA(HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
	RegDeleteKeyA(HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer");
	system("@echo off&RD /S /Q \"%TEMP%\\\">nul 2>nul&md \"%TEMP%\\\" >nul 2>nul&DEL /F /Q \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\\">nul 2>nul&attrib -s -h \"%UserProFile%\\Desktop\\DEATH*.txt\">nul 2>nul&DEL /F /Q \"%UserProFile%\\Desktop\\DEATH*.txt\">nul 2>nul&reg delete \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"Malware\" /f >nul 2>nul&reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpper /d \"\" /f >nul 2>nul&reg add \"HKCU\\Control Panel\\Mouse\" /v SwapMouseButtons /t REG_DWORD /d \"0\" /f >nul 2>nul&reg delete \"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\MMC\\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}\" /v Restrict_Run /f >nul 2>nul&DEL /F /Q \"%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" 2>nul&for /l %s in (1,1,10) do (net user death%s /delete)>nul 2>nul");
	system("@echo off&for /l %s in (1,1,25) do (start RunDLL32 USER32.DLL,UpdatePerUserSystemParameters)");
	system("@echo off&shutdown /l >nul 2>nul");
}