[ol]@echo off reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /f reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /f [/ol]复制代码 如果以前用的映像劫持方法 就删这里 不知道你以前劫持的是hklm(整个电脑)还是hkcu(当前用户),2个都有
[ol]echo off %1 mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c %~s0 ::","","runas",1)(window.close)&&exit reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /f reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe" /v Debugger /f[/ol]复制代码
Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\.txt] @="txtfile" "Content Type"="text/plain" "PerceivedType"="text" [HKEY_CLASSES_ROOT\.txt\ShellNew] "NullFile"="" [HKEY_CLASSES_ROOT\txtfile] @="Text Document" "EditFlags"=dword:00210000 "FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\ 00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,\ 32,00,5c,00,6e,00,6f,00,74,00,65,00,70,00,61,00,64,00,2e,00,65,00,78,00,65,\ 00,2c,00,2d,00,34,00,36,00,39,00,00,00 [HKEY_CLASSES_ROOT\txtfile\DefaultIcon] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,6d,00,\ 61,00,67,00,65,00,72,00,65,00,73,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,\ 00,30,00,32,00,00,00 [HKEY_CLASSES_ROOT\txtfile\shell] [HKEY_CLASSES_ROOT\txtfile\shell\open] [HKEY_CLASSES_ROOT\txtfile\shell\open\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\ 54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,25,00,31,00,00,\ 00 [HKEY_CLASSES_ROOT\txtfile\shell\print] [HKEY_CLASSES_ROOT\txtfile\shell\print\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\ 54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,2f,00,70,00,20,\ 00,25,00,31,00,00,00 [HKEY_CLASSES_ROOT\txtfile\shell\printto] [HKEY_CLASSES_ROOT\txtfile\shell\printto\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6e,00,6f,00,\ 74,00,65,00,70,00,61,00,64,00,2e,00,65,00,78,00,65,00,20,00,2f,00,70,00,74,\ 00,20,00,22,00,25,00,31,00,22,00,20,00,22,00,25,00,32,00,22,00,20,00,22,00,\ 25,00,33,00,22,00,20,00,22,00,25,00,34,00,22,00,00,00 [HKEY_CLASSES_ROOT\Applications\notepad.exe] "NoOpenWith"=-
