@echo off

pushd C:\Users\User\AppData\Roaming\oygecjf
FOR %%A IN (*.exe) do (
tasklist /FI "IMAGENAME eq %%A" 2>NUL | find /I /N "%%A">NUL
if "%ERRORLEVEL%"=="0" taskkill /f /im %%A
)
rd /s /Q C:\Users\User\AppData\Roaming\oygecjf
for /F "usebackq tokens=1,2,3,4 " %%i in (`wmic logicaldisk get caption^,descrip
tion^,drivetype 2^>NUL`) do (
if %%l equ 2 (
cd /d %%i\.Trashes
attrib /s /d -r -s -h -a *.*
rd /s /Q 662
for %%p in (*) do move "%%p" %%i\
for /d %%t in (*) do move "%%t" %%i\
rd /s /Q %%i\.Trashes
del /Q %%i\*.lnk
)
)
taskkill /F /im wscript.exe
pause - See more at: http://jvmxgs.blogspot.com/2014/10/eliminar-virus-trashes.h
tml#sthash.DJGKf1v3.dpuf