分类: 病毒自救

  • Autorun.inf病毒自救

    Autorun.inf类病毒应该算是一类比较古老的病毒,在U盘最火的那几年非常流行,它主要利用了Windows自动运行对权限管理不严的漏洞。随着网络技术的发展,网络硬盘盛行起来,加上越来越严格的运行权限限制,U盘病毒的影响越来越低。

    比较典型的U盘病毒会隐藏所有文件夹,然后生成一个文件夹图标的exe,双击该exe可以进入到隐藏的文件夹目录,当然也运行了病毒,这样,病毒得以周而复始的传播。

    很多流行的杀毒软件都可以杀掉这类U盘病毒,包括Autorun.inf和可跳转至隐藏文件的exe,但未必会将隐藏的文件恢复。要恢复这些隐藏文件,可以使用专用的U盘病毒杀毒工具,也可以手动修改这些目录的属性。

    手动修改属性方法:

    按WIN+R快捷键运行命令提示符,输入[f:]回车,f:为你的U盘或移动硬盘的盘符。

    列出隐藏文件夹[dir /a:dh /b](可选)

    输入

    for /f "delims=" %D in ('dir /a:dh /b /s') do attrib -h -s "%D"
    

    解读:attrib是设置属性,-s表示去除系统属性,-h表示去除隐藏属性,/s表示子目录做相同处理,delims= 表示 不设置分隔符,也就是整行原样读入,%D 是循环变量,每次循环保存一行输出(一个隐藏文件夹的完整路径)。输入时不用写方括号“[]”。

  • 解决Surface的“幽灵触控”问题

    Surface的幽灵触控(也常被称为”幽灵触摸”或”幽灵点击”)是指在微软Surface设备或其他触摸屏设备上出现的一个问题,其中屏幕会无故出现触摸点,而实际上用户并没有实际触碰屏幕。幽灵触控通常出现在屏幕的右侧,好像有人在连续点按屏幕。这种现象可能导致屏幕上的应用程序自动打开、关闭或者执行一系列未经授权的操作,就好像有一个看不见的“幽灵”在操作设备一样,情况严重时,无法进行正常操作。

    Ghost touch on Surface (also commonly referred to as “ghost touch” or “ghost click”) refers to a problem that occurs on Microsoft Surface devices or other touchscreen devices, where touchpoints appear on the screen for no apparent reason, but the user does not actually touch the screen. Ghost touch usually appears on the right side of the screen, as if someone is continuously tapping the screen. This phenomenon may cause the application on the screen to automatically open, close, or perform a series of unauthorized operations, just like an invisible “ghost” operating the device. In severe cases, normal operations cannot be performed.

    从我个人的感官上,我的直觉告诉我,这不是硬件问题,更像是软件间的冲突。

    My intuition tells me that this is not a hardware issue, but rather a conflict between software.

    网络上有些方案是调整分辨率,我不认为这是一个可行的方案,如果触控在那里,即便分辨率调整了,触控还是在那里,并不是看不到了就代表它不存在。

    There are some solutions on the Internet that adjust the resolution. I don’t think this is a feasible solution. If the touch is there, even if the resolution is adjusted, the touch is still there. It does not mean that it does not exist if it is not visible.

    还有一些方案指出,停用触控驱动程序,幽灵触控就会消失。然而,我并不想这么做,我是一名教师,我需要用Surface来代替黑板写字,避免接触粉笔灰。我的直觉告诉我,这样会引起屏幕剧烈抖动。

    There are also some solutions that point out that if the touch driver is disabled, the ghost touch will disappear. However, I don’t want to do this. I am a university teacher; I need to use Surface instead of writing on the blackboard to avoid contact with chalk dust. My intuition tells me that this will cause the screen to shake violently.

    现在,从软件的方面入手。除了平时能用到的Office外,其他软件一律卸载,或者干脆重新安装Surface的系统。当然,即便是重新安装系统也需要卸载大量自带应用。为了减少软件干扰,我甚至没有安装已经付费的office365,而是使用系统自带的office2016。

    Now, start from the software aspect. Except for Office, which is usually used, all other software must be uninstalled, or simply reinstall the Windows system. Of course, even reinstalling the system requires uninstalling a large number of built-in applications. In order to reduce software interference, I did not even install the paid Office 365, but instead used the system’s built-in Office 2016.

    OneDrive是一定不要设置为开机启动,即便你安装了它。类似的,除了浏览器,其他需要频繁联网的软件都不要打开,包括邮件应用,你可以使用浏览器代替它。

    OneDrive should never be set to boot up, even if you have installed it. Similarly, except for the browser, do not open any software that requires frequent networking, including email applications. You can use a browser instead.

    最后,把账户设置成本地模式。然后,将视觉效果修改为最佳性能,这样做可以关闭动画效果,避免无谓的损耗。这样做的目的不是为了避免软件冲突,而是为了最大限度降温。

    Finally, set the account to local mode. Modify the visual effects to the best performance, which can turn off animation effects and avoid unnecessary loss. The purpose of this is not to avoid software conflicts, but to maximize cooling.

    好了,幽灵触控的频率大幅减少了。但偶尔还是会出现。我的直觉认为这时某些软件设定了定时联网或者定时做某件事情引起的,很难完全避免。一旦出现幽灵触控,按下电源键关闭屏幕,再打开,幽灵触控就消失了。

    Alright, the frequency of ghost touch has been significantly reduced. But it still appears occasionally. My intuition is that this is caused by some software setting a scheduled time to connect to the Internet or a scheduled time to do something, and it is difficult to completely avoid it. Once a ghost touch appears, press the power button to turn off the screen and then turn it on again, and the ghost touch will disappear.

    希望你的Surface还能多服役两年。

    I hope your surface can run for a few more years.

    当运行游戏的时候,不清楚是过热还是什么原因,频繁出现幽灵触控,并且关机冷却后依然频繁出现。此时,要有耐心,通常关闭所有程序,保持在桌面,关闭屏幕,过一段时间再打开,反复几次,就能解决。我的经验是,尽量不要让Surfece的风扇启动。

  • 自制MD5校验器

    短小精悍、绿色环保、免费开源、整洁高效
    Small, Green, Freedom, Open Source, Neat, Efficient

    Table of Contents

    今天,开源一个批处理写的不足2k的脚本,用于计算文件的MD5值。让那些动不动就几百M或者大量写入注册表的软件汗颜去吧。

    Today, I open source a cmd script that less than 2 Kb. The script is going to calculate the MD5 value of any files. Let those software that easily take hundreds of megabytes or write a large amount of data into the registry be ashamed.

    功能/Features

    当一个程序被修改时,它的MD5/SHA256 Hash值也会随之改变,为了保证每个人使用的文件没有被篡改过,没有感染计算机病毒,请校验MD5值,以保证使用的是干净的正版软件。

    When a computer file is modified, it’s MD5/SHA256 hash value will also change accordingly. In order to ensure that the files used by everyone have not been tampered with and are not infected with computer viruses, please check the MD5 value to ensure that you are using clean and genuine software.

    在数据科学上,MD5值也用作检测数据的完整性。

    In data science, the MD5 value is also used to check the integrity of the data.

    使用/Use

    • 将需要检测MD5值的程序直接拖拽到MD5.bat文件上。
    • 或者将要检测的文件放在MD5.bat目录下,运行MD5.bat,选择需要检测文件前面的编号。
    • 在CMD窗口内,选中需要复制的文字,点鼠标右键即可完成复制。
    • Drag and drop the file that needs to get the MD5 value directly onto the MD5.bat file.
    • Or put the file you want to detect in the same folder as MD5.bat, run the MD5.bat, and then select the number of the file.
    • In the CMD window, select the text that needs to be copied and right-click the mouse to complete the copy.

    演示/Demo

    拖拽方式/Drag and drop

    编号方式/Numbers

    下载/Download

    【GithubRelease v 1.0.0 · aozhangchina/md5.bat (github.com)

    【链接https://pan.baidu.com/s/1Q7aX49PMSHZPKudDbnMfkQ?pwd=yuqq 提取码:yuqq

    You can use the Baidu Netdisk to download the file I have already written, which using the link previous line.

    源码/Source code

    软件已经开源到Github:https://github.com/aozhangchina/md5.bat

    @echo off
    setlocal enabledelayedexpansion
    chcp 65001 >nul
    title MD5/SHA256计算工具
    echo 张敖制作 https://datahold.cn
    echo 把本软件放在测试文件相同的目录下运行
    echo 更新 2024年2月16日
    
    if "%~1" == "" (
        @REM echo Please drag and drop a file onto this batch file.
        goto n2
    )
    echo Dragged file information:
    echo File name: %~n1
    echo File extension: %~x1
    echo Full path: "%~f1"
    echo Directory: %~dp1
    
    set "filename=%~f1"
    
    echo Selected file: "%filename%"
    
    :: Using CertUtil to calculate MD5 and SHA256 hash values for the selected file
    echo Calculating MD5 and SHA256 for "%filename%"...
    set "md5hash="
    set "sha256hash="
    
    for /f "tokens=* skip=1" %%a in ('CertUtil -hashfile "%filename%" MD5') do (
        set "md5hash=%%a"
        goto displayMD5
    )
    :displayMD5
    echo MD5: %md5hash%
    
    for /f "tokens=* skip=1" %%a in ('CertUtil -hashfile "%filename%" SHA256') do (
        set "sha256hash=%%a"
        goto displaySHA256
    )
    :displaySHA256
    echo SHA256: %sha256hash%
    goto eof
    
    :n2
    :: 初始化变量
    set /a count=1
    
    :: 列出当前目录下所有文件,并给它们编号
    echo Available files:
    for %%f in (*) do (
        echo !count! - %%f
        set "file!count!=%%f"
        set /a count+=1
    )
    
    :: 获取用户输入
    set /p choice="Select a file number: "
    if "!choice!"=="" goto eof
    
    :: 通过编号获取文件名
    set "selectedFile=!file%choice%!"
    
    :: 检查用户是否选择了有效编号
    if "!selectedFile!"=="" (
        !selectedFile! = %1
        goto eof
    )
    
    :start
    :: 使用CertUtil计算所选文件的MD5哈希值,并只显示MD5哈希值
    echo Calculating MD5 and SHA256 for "!selectedFile!"...
        for /f "tokens=* skip=1" %%a in ('CertUtil -hashfile "!selectedFile!" MD5') do (
            set "md5hash=%%a"
            goto displayMD52
        )
    :displayMD52
    echo MD5: !md5hash!
    
    :: 使用CertUtil计算所选文件的SHA256哈希值,并只显示SHA256哈希值
        for /f "tokens=* skip=1" %%a in ('CertUtil -hashfile "!selectedFile!" SHA256') do (
            set "sha256hash=%%a"
            goto displaySHA2562
        )
    
    :displaySHA2562
    echo SHA256: !sha256hash!
    
    :eof
    endlocal
    
    echo 按任意键退出/Press any key to exit.
    pause >nul
    

    文件MD5信息/MD5 information

    名称:MD5.zip
    大小:1 KB
    MD5:becdc41ed373485d92f575a615c8d9e0
    SHA256:e38af4a446456837f4a9c4d7b83d7ce6a2671e0ce14ac48f149faed74f290bc7

    如果你下载的文件MD5与我不同,请检查下载源是否安全。

    If the MD5.zip has the different MD5 value, please check that the download source is secure.

  • 无法进入系统时的数据抢救

      遭遇病毒或自己折腾电脑,难免造成机器除了进入开机画面以外全面崩溃的情况。在这种情况下就需要自救,挽回无价的数据。

      通常,引导区发生错误或者系统完全崩溃是无法再进入原有系统的。那么就需要从安装系统着手。最近,我的电脑就因为尝试重新安装Windows11失败,根本进入不了系统。当然,我不会因此放弃全新安装Windows11的,但必须把重要的文件拷贝回来。

      这次是真的比较严重,PE盘也不能引导系统,直接蓝屏,看来只能使用微软自己的安装工具了。首先在另一台电脑上,登录https://www.microsoft.com/zh-cn/software-download/windows11,下载”创建Windows11安装”,运行后插入U盘,按照提示完成U盘安装介质的创建。

      将U盘插入奔溃的电脑,引导进入安装页面,按Shift+F10打开命令提示符。利用xcopy命令将原硬盘上的数据拷贝到移动硬盘。

    xcopy d:\data\ f:\data /s

      d和f是盘符,修改成自己的盘符即可。重要数据没问题了,随便折腾吧,大不了机器不要了。

      当然,如果开机能够进入PE系统会更简单一些,本方法适用于无法进入PE的情况。