[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor]"AutoRun"="*.bat"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options下的项。找到删除;注册表映像劫持
