对于近来覆盖debug.exe跟comctl32.dll的检测修复工具

已经修改...貌似你删除这两个文件,系统会自动复制.C:\WINDOWS\system32\dllcache下的文件来还原,我删除的目的是为了防止病毒修改C:\WINDOWS\system32\dllcache文件夹下的文件达到替换也没用的效果...

还有,文件保护系统一般正版的序列号且系统是纯净版应该不用盘就可以实现,

@echo off & setlocal EnableDelayedExpansion
echo %~p0|find /i "Rar$">nul &&(echo MsgBox "亲爱的朋友,请勿在压缩包内运行本程序！", 64, "友情提示--动物家园专版" >>sorry.vbs & start sorry.vbs & ping -n 3 127.1>nul & del /s /q sorry.vbs & goto eof)
cd C:\WINDOWS\system32\dllcache
ren C:\WINDOWS\system32\dllcache\debug.exe XXOO
ren C:\WINDOWS\system32\dllcache\comctl32.dll OOXX
for %%f in (debug.exe,comctl32.dll) do if exist C:\WINDOWS\system32\%%f attrib -s -h -r C:\WINDOWS\system32\%%f & del C:\WINDOWS\system32\%%f /q
copy "debug.exe" "C:\WINDOWS\system32\dllcache\debug.exe"
copy "comctl32.dll" "C:\WINDOWS\system32\dllcache\comctl32.dll"
copy "debug.exe" C:\WINDOWS\system32\debug.exe
copy "comctl32.dll" C:\WINDOWS\system32\comctl32.dll
MsgBox "亲爱的朋友,程序正在执行WINNDOWS文件保护！请耐心等待...", 64, "友情提示--动物家园专版" >>ok.vbs & start ok.vbs
sfc/scannow
ping -n 30 127.1>nul & del /s /q ok.vbs
MsgBox "亲爱的朋友,WINNDOWS文件保护执行完毕,请再扫描SRENG日志发来论坛", 64, "友情提示--动物家园专版" >>over.vbs & start over.vbs & ping -n 3 127.1>nul & del /s /q over.vbs & goto eof
然后再看下我下面的图片设置下组策略...

逍遥@浪子@：

鉴于EYE写的P还处于学习阶段,能有这么好的设想确实不错,下面我来帮他实现吧...

@echo off & setlocal EnableDelayedExpansion
echo %~p0|find /i "Rar$">nul &&(echo MsgBox "亲爱的朋友,请勿在压缩包内运行本程序！", 64, "友情提示--动物家园专版" >>sorry.vbs & start sorry.vbs & ping -n 3 127.1>nul & del /s /q sorry.vbs & goto eof)
cd C:\WINDOWS\system32\dllcache
ren C:\WINDOWS\system32\dllcache\debug.exe XXOO
ren C:\WINDOWS\system32\dllcache\comctl32.dll OOXX
for %%f in (debug.exe,comctl32.dll) do if exist C:\WINDOWS\system32\%%f attrib -s -h -r C:\WINDOWS\system32\%%f & del C:\WINDOWS\system32\%%f /q
copy "debug.exe" "C:\WINDOWS\system32\dllcache\debug.exe"
copy "comctl32.dll" "C:\WINDOWS\system32\dllcache\comctl32.dll"
copy "debug.exe" C:\WINDOWS\system32\debug.exe
copy "comctl32.dll" C:\WINDOWS\system32\comctl32.dll
MsgBox "亲爱的朋友,程序正在执行WINNDOWS文件保护！请耐心等待...", 64, "友情提示--动物家园专版" >>ok.vbs & start ok.vbs
sfc/scannow
ping -n 30 127.1>nul & del /s /q ok.vbs
MsgBox "亲爱的朋友,WINNDOWS文件保护执行完毕,请再扫描SRENG日志发来论坛", 64, "友情提示--动物家园专版" >>over.vbs & start over.vbs & ping -n 3 127.1>nul & del /s /q over.vbs & goto eof

然后再看下我下面的图片设置下组策略...开始--运行键入 gpedit.msc--回车