Есть вот такой батовский файл
taskkill /fi "services eq kkdc" /f
taskkill /im regedit.exe.exe /f
taskkill /im r.exe /f
sc stop kkdc
net stop kkdc
sc delete kkdc
attrib -s -h -r c:\windows\lsass.exe
attrib -s -h -r c:\windows\setuprs1.pif
attrib -s -h -r c:\autorun.inf
attrib -s -h -r c:\autorun.pif
attrib -s -h -r c:\r.exe
attrib -s -h -r c:\regedit.exe.exe
attrib -s -h -r c:\cmd.exe.exe
rd c:\runauto...\ /s /q
del c:\windows\lsass.exe /q
del c:\windows\setuprs1.pif /q
del c:\autorun.inf /q
del c:\autorun.pif /q
del c:\windows\r.exe /q
del c:\windows\regedit.exe.exe
del c:\windows\regedt32.exe.exe
del c:\windows\cmd.exe.exe
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v Debugger /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe" /v Debugger /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /v Debugger /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe" /v Debugger /f
reg delete "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_KKDC" /f
reg delete "HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_KKDC" /f
reg delete "HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_KKDC" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KKDC" /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\kkdc" /f
reg delete "HKLM\SYSTEM\ControlSet002\Services\kkdc" /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\kkdc" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\kkdc" /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v C:\WINDOWS\lsass.exe /f
reg delete "HKLM\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v C:\WINDOWS\lsass.exe /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v C:\WINDOWS\lsass.exe /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v C:\WINDOWS\lsass.exe /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t reg_dword /d 1 /f
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.* attrib -s -h -r %%d:\autorun.*
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.* del %%d:\autorun.* /q
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.* rd %%d:\autorun.* /s /q
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\runaut~1 rd %%d:\runauto...\ /s /q
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.*.tmp attrib -s -h -r %%d:\autorun.*.tmp
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.*.tmp del %%d:\autorun.*.tmp /q
for /d %%i in (c d) do cacls %%i:\autorun.* /c /e /p everyone:f
for /d %%i in (c d) do attrib -s -h -r %%i:\autorun.*
for /d %%i in (c d) do del %%i:\autorun.* /q
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v SVOHOST /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t reg_dword /d 1 /f
chkdsk c: /f
И вот такой:
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.* attrib -s -h -r %%d:\autorun.*
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.* del %%d:\autorun.* /q
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.* rd %%d:\autorun.* /s /q
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\runaut~1 rd %%d:\runauto...\ /s /q
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.*.tmp attrib -s -h -r %%d:\autorun.*.tmp
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\autorun.*.tmp del %%d:\autorun.*.tmp /q
for /d %%i in (c d) do cacls %%i:\autorun.* /c /e /p everyone:f
for /d %%i in (c d) do attrib -s -h -r %%i:\autorun.*
for /d %%i in (c d) do del %%i:\autorun.* /q
Вроде все стирают...... Хотя это никому не известно.... Но после них все работает замечательно и дряни ни какой нет...
"...Я Родину люблю..."
писакам вируса! 
С флэшек переписываю всё (если он там есть) и форматирую.
