批处理应用:恢复Mcafee重命名的可疑病毒文件扩展名


Mcafee识别到可疑病毒文件,但病毒库里没有病毒定义,就会把文件扩展名命名为vir或vxe,固建立此批处理文件,用已恢复被修改掉的exe文件

MCAFEE更名原则:

Original Renamed Description
Not V?? V?? File extensions that do not start with v are renamed with v as
the initial letter of the file extension. For example,
MYFILE.DOC becomes MYFILE.VOC.
V?? VIR File extensions that start with v are renamed as .VIR. For
example, MYFILE.VBs becomes MYFILE.VIR.
VIR,

V01-V99

These files are recognized as already infected, and are not
renamed again.
VIR Files with no extensions are given the extension, .VIR.




@echo off

echo On Error Resume Next >%temp%\filesystem.vbs
echo Const wbemFlagReturnImmediately = ^&h10 >>%temp%\filesystem.vbs
echo Const wbemFlagForwardOnly = ^&h20 >>%temp%\filesystem.vbs

echo For Each strComputer In arrComputers >>%temp%\filesystem.vbs

echo Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") >>%temp%\filesystem.vbs >>%temp%\filesystem.vbs
echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalDisk", "WQL", _ >>%temp%\filesystem.vbs
echo wbemFlagReturnImmediately + wbemFlagForwardOnly) >>%temp%\filesystem.vbs

echo For Each objItem In colItems >>%temp%\filesystem.vbs
echo if objItem.DriverType=3 Then WScript.Echo objItem.Caption ^& "\" End if >>%temp%\filesystem.vbs
echo Next >>%temp%\filesystem.vbs
echo Next >>%temp%\filesystem.vbs

for /f %%i in ('cscript //nologo %temp%\filesystem.vbs') do call :change %%i

goto end

:change
cd /d %1
for /f "delims=|" %%i in ('dir *.vxe /b /s /a') do (cacls "%%i" /e /g everyone:f & ren "%%i" *.exe)

:end
del %temp%\filesystem.vbs



相关阅读:
VBS教程:运算符-乘运算符 (*)
让前端开发者价值百万的10项技能
ThinkPHP php 框架学习笔记
ajax无刷新上传图片实例
Windows Server 2008开发指南解析
不用数据库的多用户文件自由上传投票系统(2)
Oracle CBO中怎么计算调整MBRC
fleaphp下不确定的多条件查询的巧妙解决方法
Linux中如何知道谁在切换进程
sql走索引为什么始终有物理读
SQL Server帐号孤立的问题解决
Web标准学习资源(书籍、网站)推荐
windows 系统下关闭危险的445端口
介绍worpress博客header.php
快速导航

Copyright © 2016 phpStudy |