Hướng dẫn Tổng hợp chia sẻ, hướng dẫn...

:64b
HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID
:32b
HKEY_CURRENT_USER\Software\Classes\CLSID

:: Open current directory
cd %~dp0

:: Install the service
sc create RegGuardSvc binPath= "C:\RegGuardSvc\Service\RegGuardSvc.exe" DisplayName= "RegGuardSvc Service" start= auto

:: Start the service
sc start RegGuardSvc

pause

:: Open current directory
cd %~dp0

:: Install the service
sc create RegGuardSvc binPath= "%userprofile%\Desktop\RegGuardSvc\Service\RegGuardSvc.exe" DisplayName= "RegGuardSvc Service" start= auto

:: Start the service
sc start RegGuardSvc

pause

[Options]
ProtectionEnabled = y
LogToFile = y
LogToWindowsEventViewer = n

[Settings]
LogPath = C:\RegGuardSvc\Logs
RulesPath = C:\RegGuardSvc\Rules
ExclusionsPath = C:\RegGuardSvc\Exclusions
DeleteLogsOlderThanNDays = 30
PassiveMode = n

[Options]
ProtectionEnabled = y
LogToFile = y
LogToWindowsEventViewer = n

[Settings]
LogPath = %userprofile%\Desktop\RegGuardSvc\Logs
RulesPath = %userprofile%\Desktop\RegGuardSvc\Rules
ExclusionsPath = %userprofile%\Desktop\RegGuardSvc\Exclusions
DeleteLogsOlderThanNDays = 30
PassiveMode = n

;[%OPR%: WRITE_VALUE] [%EXE%: *] [%KEY%: *\SYSTEM\ControlSet*\Services\*] [%VAL%: ImagePath]

;[%OPR%: DELETE_KEY] [%EXE%: *regedit.exe] [%KEY%: *DeleteKey*]
;[%OPR%: DELETE_VALUE] [%EXE%: *regedit.exe] [%KEY%: *\Software*] [%VAL%: *DeleteValue*]
;[%OPR%: READ_VALUE] [%EXE%: *regedit.exe] [%KEY%: *\Software*] [%VAL%: *ReadValue*]
;[%OPR%: WRITE_VALUE] [%EXE%: *regedit.exe] [%KEY%: *\Software*] [%VAL%: *WriteValue*]
;[%OPR%: CREATE_KEY] [%EXE%: *regedit.exe] [%KEY%: *\Software*] [%VAL%: *New Key #1*]

[%OPR%: WRITE_VALUE] [%EXE%: *Alchemy.exe] [%KEY%: *\CLSID\{B463A54B-8AD9-4511-9C70-94FB81B1EE6A}*] [%VAL%: *]

:luu file nhu .cmd hoac .bat
sc stop RegGuardSvc

sc start RegGuardSvc

Pause

@echo off

:: BatchGotAdmin (Run as Admin code starts)
REM  --> Check for permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    echo UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    if exist "%temp%\getadmin.vbs" ( del "%temp%\getadmin.vbs" )
    pushd "%CD%"
    CD /D "%~dp0"
:: BatchGotAdmin (Run as Admin code ends)
Color 1b
title Edit Code : Hamano Kaito
Cls
Taskkill /f /im IDMan.exe >nul
Taskkill /f /im IDMIntegrator64.exe >nul
Taskkill /f /im IDMIntegrator.exe >nul
Taskkill /f /im IEMonitor.exe >nul
Echo.
Echo               Nhan Phim Bat Ky De Tiep Tuc
Echo.
Pause >nul
Cls
Echo Vui long nhap vao cac thong tin ben duoi
Echo.
Set /p kaito1=Nhap ten 1:
Set /p kaito2=Nhap ten 2:
Set /p kaito3=Nhap mail bat ky:
Set /p kaito4=Nhap ma DK bat ky:
Echo.
Reg Add "HKEY_CURRENT_USER\Software\DownloadManager" /f /v "Email" /t reg_sz /d "%kaito3%" >nul
Reg Add "HKEY_CURRENT_USER\Software\DownloadManager" /f /v "FName" /t reg_sz /d "%kaito1%" >nul
Reg Add "HKEY_CURRENT_USER\Software\DownloadManager" /f /v "LName" /t reg_sz /d "%kaito2%" >nul
Reg Add "HKEY_CURRENT_USER\Software\DownloadManager" /f /v "Serial" /t reg_sz /d "%kaito4%" >nul
Echo Hoan Tat DK!
Timeout 3 >nul
Exit

HKEY_CLASSES_ROOT\CLSID\{B463A54B-8AD9-4511-9C70-94FB81B1EE6A}
HKEY_CLASSES_ROOT\Local Settings\Software\Origen Group\Alchemy Desktop

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B463A54B-8AD9-4511-9C70-94FB81B1EE6A}]
"License"=hex:45,42,c5,76,66,a4,7b,93,67,19,d5,0b,11,d6,88,d6,cb,49,8b,68,9f,\
  e6,ae,c1,cc,c8,3a,7c,dd,7e,e1,90,63,d2,ee,55,03,ac,2e,10,f0,43
[HKEY_CLASSES_ROOT\Local Settings\Software\Origen Group\Alchemy Desktop]
@="|Aﾵv￑}ﾐﾬaﾫ￤￐ￇHﾍsﾖﾔￜￅￗￄJy￝wﾖﾑX￱ﾟ[w￦"

mirillis.eu
mirillis.com

check.zemana.com #Bắc buộc phải block domain này
dl12.zemana.com #các bạn có thể block hoặc ko tùy các bạn

%userprofile%\AppData\Local\Zemana\Zemana AntiLogger\
%userprofile%\AppData\Local\Zemana\Zemana Antimalware\

Set /p kaito1=Nhap Bat Cu Gi Ma Ban Muon:
Reg Add "HKEY_LOCAL_MACHINE\SOFTWARE\Zemana\AntiMalware" /f /v "License" /t Reg_SZ /d "%kaito1%" >nul

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3714E1B-8CD3-05D8-36F7-F9F836E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9EBB1C7C-9574-FB68-65C7-F84101D6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{28F6FA91-BBA3-54C4-6B4D-8956886C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5C30089-E35E-4073-D92F-F7074C5F}

linjqbyk.kfl <== Tệp (bỏ ghi chú này)
~481407249.tmp <= Tệp (bỏ ghi chú này)
mntemp <= Thư mục (bỏ ghi chú này)

C:\ProgramData\mntemp
%userprofile%\AppData\Local\Temp\~481407249.tmp
C:\Windows\System\linjqbyk.kfl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9DC19843-2851-57DA-1C38-D0E6AE49}

@Echo Off
for /F "eol=E tokens=*" %%a IN ('reg query "HKEY_CLASSES_ROOT\CLSID" /v "AppID" /t "REG_BINARY" /s ^| find /v "REG_BINARY"') do  Reg Delete "%%a" /f
Del /f /q /a "C:\Windows\System\linjqbyk.kfl"
Del /f /q /a "C:\Windows\System\qiyetydl.edg"
Del /f /q /a %tmp%
MSG * Hoan Tat

reg delete  HKEY_CLASSES_ROOT\CLSID\{1b7e815d-bf62-4425-810a-240611c35fe3}
reg delete  HKEY_CLASSES_ROOT\CLSID\{3e481a39-29a1-4210-a66c-612d56e19000}
reg delete  HKEY_CLASSES_ROOT\CLSID\{4bff51f8-f921-4d04-b2ff-f3568f8704ca}
reg delete  HKEY_CLASSES_ROOT\CLSID\{a652fae0-d049-43e4-8b70-9d8de924398b}
reg delete  HKEY_CLASSES_ROOT\CLSID\{bef84488-560a-4f33-9a7b-36b1d7e73bde}
reg delete  HKEY_CLASSES_ROOT\CLSID\{3c9fb2bd-60ee-45ce-ae53-35771f9a6622}

ULYP5O85.ocx
JE9I4EW5.ocx

reg delete  HKEY_CLASSES_ROOT\CLSID\{1b7e815d-bf62-4425-810a-240611c35fe3}
reg delete  HKEY_CLASSES_ROOT\CLSID\{3e481a39-29a1-4210-a66c-612d56e19000}
reg delete  HKEY_CLASSES_ROOT\CLSID\{4bff51f8-f921-4d04-b2ff-f3568f8704ca}
reg delete  HKEY_CLASSES_ROOT\CLSID\{a652fae0-d049-43e4-8b70-9d8de924398b}
reg delete  HKEY_CLASSES_ROOT\CLSID\{bef84488-560a-4f33-9a7b-36b1d7e73bde}
reg delete  HKEY_CLASSES_ROOT\CLSID\{3c9fb2bd-60ee-45ce-ae53-35771f9a6622}

del /F /S /Q %windir%\ULYP5O85.ocx
del /F /S /Q %windir%\System32\JE9I4EW5.ocx

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuTipEx"=dword:749d5e80

; Code ben duoi la de block chan thay doi gia tri
[%OPR%: WRITE_VALUE] [%EXE%: *BWMonitor.exe] [%KEY%: *\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced*] [%VAL%: *]
; Neu cac ban co chay  them dich vu cua soft thi them code ben duoi nua.
[%OPR%: WRITE_VALUE] [%EXE%: *BWMonitorService.exe] [%KEY%: *\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced*] [%VAL%: *]

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{B38B19E8-A6B7-4B80-902F-1A3BFDEEAAFB}
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{B38B19E8-A6B7-4B80-902F-1A3BFDEEAAFB}
HKEY_CURRENT_USER\SOFTWARE\WinSTEP2000\WorkSHELF
HKEY_CURRENT_USER\Software\WinSTEP2000\NextSTART

taskkill /f /im WorkShelf.exe >nul
taskkill /f /im WsxService.exe >nul
taskkill /f /im Nextstart.exe >nul

reg delete "HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{B38B19E8-A6B7-4B80-902F-1A3BFDEEAAFB}" /va /f >nul
Reg delete "HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{B38B19E8-A6B7-4B80-902F-1A3BFDEEAAFB}" /va /f >nul
Echo "HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{B38B19E8-A6B7-4B80-902F-1A3BFDEEAAFB}" [8] >>%TEMP%\Kaito
Echo "HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{B38B19E8-A6B7-4B80-902F-1A3BFDEEAAFB}" [8] >>%TEMP%\Kaito
regini %TEMP%\Kaito
del %TEMP%\Kaito

Set /p kaito=Enter Value WorkSHELF:
Set /p kaito1=Enter Value NextSTART:
reg add "HKEY_CURRENT_USER\SOFTWARE\WinSTEP2000\WorkSHELF" /f /v "WsInfoA%kaito%" /t Reg_SZ /d "R<75514=426662736" >nul
Reg Add "HKEY_CURRENT_USER\SOFTWARE\WinSTEP2000\WorkSHELF" /f /v "WsInfoB%kaito%" /t Reg_SZ /d "Z>745:444:6=607067611" >nul
Reg Add "HKEY_CURRENT_USER\Software\WinSTEP2000\NextSTART" /f /v "NsInfoA%kaito1%" /t Reg_SZ /d "I70?0900010602050" >nul
Reg Add "HKEY_CURRENT_USER\Software\WinSTEP2000\NextSTART" /f /v "NsInfoB%kaito1%" /t Reg_SZ /d "J50>0209090=000606000" >nu

Set KEY=HKEY_CURRENT_USER\SOFTWARE\WinSTEP2000\WorkSHELF
Set KEY1=HKEY_CURRENT_USER\Software\WinSTEP2000\NextSTART
for /F "tokens=1,*" %%a in ('REG QUERY "%KEY%" ^| findstr "WsInfoA"') do ( Reg Add "%KEY%" /f /v "%%a" /t Reg_SZ /d "R<75514=426662736" )
for /F "tokens=1,*" %%a in ('REG QUERY "%KEY%" ^| findstr "WsInfoB"') do ( Reg Add "%KEY%" /f /v "%%a" /t Reg_SZ /d "Z>745:444:6=607067611" )
Echo.
Echo Hoan Tat Chinh Sua Key WorkSHELF....
Echo.
for /F "tokens=1,*" %%a in ('REG QUERY "%KEY1%" ^| findstr "NsInfoA"') do ( Reg Add "%KEY1%" /f /v "%%a" /t Reg_SZ /d "I70?0900010602050" )
for /F "tokens=1,*" %%a in ('REG QUERY "%KEY1%" ^| findstr "NsInfoB"') do ( Reg Add "%KEY1%" /f /v "%%a" /t Reg_SZ /d "J50>0209090=000606000" )
Echo.
Echo Hoan Tat Chinh Sua Key NsInfoA...
Echo.

HKEY_CURRENT_USER\CLSID\{2E8E446F-0CCC-41C5-8DCE-49A518F8FF6F}

Reg Delete "HKEY_CURRENT_USER\CLSID\{2E8E446F-0CCC-41C5-8DCE-49A518F8FF6F}" /f

Reg Delete "HKEY_CURRENT_USER\CLSID\{2E8E446F-0CCC-41C5-8DCE-49A518F8FF6F}" /f /va
Echo HKEY_CURRENT_USER\CLSID\{2E8E446F-0CCC-41C5-8DCE-49A518F8FF6F} [8] >>%TEMP%\Kaito
Regini %TEMP%\Kaito

icsxml <== Thư mục
ms-drivers <== Thư mục
13f75bd0579f500c3eade3.89562868 <== Tệp

@Echo Off

RD  /s /q "%userprofile%\AppData\Local\icsxml"
RD  /s /q "%userprofile%\AppData\Local\ms-drivers"
Del /f /s /q /a "%userprofile%\AppData\Local\13f75bd0579f500c3eade3.89562868"

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Compatibility

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Compatibility]
"NLEMPPP20"=",2488069"
"NLEMPPP20_LK"=",f0ef6e71bc5bbdb091206101700f79062f349fcf2c3eb83050c6bffda7eb815d"

Reg Delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Compatibility" /f

YHLS3-G9EPE-UTLOP-MIBQ8-A8G4L
6M5IG-HAFUO-OGKEM-SVAI3-D3DHG
I6HUX-U8I94-RWLDD-PFFRJ-MOD4J
NGBTQ-TWDP0-NVMHR-TGAJ9-L8KDK
2I0YD-S6KBE-OPNOE-SMET7-LFGDF
0K1GT-NWJ37-TQEA0-NLAJ5-GUH0I
W1E0U-BDATK-TOCI3-NNDFO-D4G0B
8JIQ0-4BH46-JKCBV-XREH6-HTJPN
25K16-06F4X-TXGX2-NEETK-ETD0A
F1HRU-ECI8E-PQNOO-RLCGO-BPGXM
13VX8-59FD3-SOBEE-ONFQM-LDBDG