批处理应用:恢复Mcafee重命名的可疑病毒文件扩展名
2006-11-23 16:36
435 查看
Mcafee识别到可疑病毒文件,但病毒库里没有病毒定义,就会把文件扩展名命名为vir或vxe,固建立此批处理文件,用已恢复被修改掉的exe文件
MCAFEE更名原则:
@echo off
echo On Error Resume Next >%temp%/filesystem.vbs
echo Const wbemFlagReturnImmediately = ^&h10 >>%temp%/filesystem.vbs
echo Const wbemFlagForwardOnly = ^&h20 >>%temp%/filesystem.vbs
echo For Each strComputer In arrComputers >>%temp%/filesystem.vbs
echo Set objWMIService = GetObject("winmgmts://./root/CIMV2") >>%temp%/filesystem.vbs >>%temp%/filesystem.vbs
echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalDisk", "WQL", _ >>%temp%/filesystem.vbs
echo wbemFlagReturnImmediately + wbemFlagForwardOnly) >>%temp%/filesystem.vbs
echo For Each objItem In colItems >>%temp%/filesystem.vbs
echo if objItem.DriverType=3 Then WScript.Echo objItem.Caption ^& "/" End if >>%temp%/filesystem.vbs
echo Next >>%temp%/filesystem.vbs
echo Next >>%temp%/filesystem.vbs
for /f %%i in ('cscript //nologo %temp%/filesystem.vbs') do call :change %%i
goto end
:change
cd /d %1
for /f "delims=|" %%i in ('dir *.vxe /b /s /a') do (cacls "%%i" /e /g everyone:f & ren "%%i" *.exe)
:end
del %temp%/filesystem.vbs
MCAFEE更名原则:
Original Renamed | Description |
Not V?? V?? | File extensions that do not start with v are renamed with v as |
the initial letter of the file extension. For example, | |
MYFILE.DOC becomes MYFILE.VOC. | |
V?? VIR | File extensions that start with v are renamed as .VIR. For |
example, MYFILE.VBs becomes MYFILE.VIR. | |
VIR, V01-V99 | These files are recognized as already infected, and are not renamed again. |
VIR | Files with no extensions are given the extension, .VIR. |
echo On Error Resume Next >%temp%/filesystem.vbs
echo Const wbemFlagReturnImmediately = ^&h10 >>%temp%/filesystem.vbs
echo Const wbemFlagForwardOnly = ^&h20 >>%temp%/filesystem.vbs
echo For Each strComputer In arrComputers >>%temp%/filesystem.vbs
echo Set objWMIService = GetObject("winmgmts://./root/CIMV2") >>%temp%/filesystem.vbs >>%temp%/filesystem.vbs
echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalDisk", "WQL", _ >>%temp%/filesystem.vbs
echo wbemFlagReturnImmediately + wbemFlagForwardOnly) >>%temp%/filesystem.vbs
echo For Each objItem In colItems >>%temp%/filesystem.vbs
echo if objItem.DriverType=3 Then WScript.Echo objItem.Caption ^& "/" End if >>%temp%/filesystem.vbs
echo Next >>%temp%/filesystem.vbs
echo Next >>%temp%/filesystem.vbs
for /f %%i in ('cscript //nologo %temp%/filesystem.vbs') do call :change %%i
goto end
:change
cd /d %1
for /f "delims=|" %%i in ('dir *.vxe /b /s /a') do (cacls "%%i" /e /g everyone:f & ren "%%i" *.exe)
:end
del %temp%/filesystem.vbs
相关文章推荐
- 批处理应用:恢复Mcafee重命名的可疑病毒文件扩展名
- 批处理应用:根据文件内容进行重命名操作
- 批处理应用根据文件内容进行重命名操作
- 使用lsof处理文件恢复、句柄以及空间释放问题
- BAT批处理 文件重命名
- HTTP 错误 404.3 - Not Found 由于扩展配置问题而无法提供您请求的页面。如果该页面是脚本,请添加处理程序。如果应下载文件,请添加 MIME 映射
- IIS虚拟目录内的视频文件访问出错:HTTP 错误 404.3 - Not Found 由于扩展配置问题而无法提供您请求的页面。如果该页面是脚本,请添加处理程序。如果应下载文件,请添加 MIME 映射。
- 恢复被"维金"病毒感染的exe文件--我和病毒作斗争的3天
- svc 报“由于扩展配置问题而无法提供您请求的页面。如果该页面是脚本,请添加处理程序。如果应下载文件,请添加 MIME 映射。“的HTTP 错误 404.3 – Not Found
- Dos命令XCOPY在批处理文件中的应用,且生成的备份文件夹为年月日命名的
- ASP.NET Core应用针对静态文件请求的处理[2]: 条件请求与区间请求
- 网管知识[病毒木马修改注册表,导致可执行文件无法执行处理办法]
- windows计划任务+批处理文件实现oracle数据库的定时备份与恢复
- C++ 知识点(五):高级编程:文件和流,异常处理,动态内存,命名空间
- 文件上传后Apusic应用服务器内存溢出并宕机的一种处理方式
- WCF HTTP 错误 404.3 - Not Found(由于扩展配置问题而无法提供您请求的页面。如果该页面是脚本,请添加处理程序。如果应下载文件,请添加 MIME 映射。)
- U盘中病毒后文件变为屏幕保护程序恢复方法
- python3处理json文件中含有中文dumps的应用
- PHP处理Linux中生成文件目录及读取内容遍历应用
- gvim e303 无法打开 “[未命名]“的交换文件,恢复将不可能