DDR爱好者之家

批处理应用：恢复Mcafee重命名的可疑病毒文件扩展名
站长资源 2024/12/27 佚名
42 1538
DDR爱好者之家 Design By 杰米
Mcafee识别到可疑病毒文件，但病毒库里没有病毒定义，就会把文件扩展名命名为vir或vxe，固建立此批处理文件，用已恢复被修改掉的exe文件

MCAFEE更名原则：
Original Renamed Description Not V?? V?? File extensions that do not start with v are renamed with v as the initial letter of the file extension. For example, MYFILE.DOC becomes MYFILE.VOC. V?? VIR File extensions that start with v are renamed as .VIR. For example, MYFILE.VBs becomes MYFILE.VIR. VIR,

V01-V99

These files are recognized as already infected, and are not
renamed again. VIR Files with no extensions are given the extension, .VIR.



@echo off

echo On Error Resume Next >%temp%\filesystem.vbs
echo Const wbemFlagReturnImmediately = ^&h10 %temp%\filesystem.vbs
echo Const wbemFlagForwardOnly = ^&h20 %temp%\filesystem.vbs

echo For Each strComputer In arrComputers %temp%\filesystem.vbs

echo Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") %temp%\filesystem.vbs %temp%\filesystem.vbs
echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalDisk", "WQL", _ %temp%\filesystem.vbs
echo wbemFlagReturnImmediately + wbemFlagForwardOnly) %temp%\filesystem.vbs

echo For Each objItem In colItems %temp%\filesystem.vbs
echo if objItem.DriverType=3 Then WScript.Echo objItem.Caption ^& "\" End if %temp%\filesystem.vbs
echo Next %temp%\filesystem.vbs
echo Next %temp%\filesystem.vbs

for /f %%i in ('cscript //nologo %temp%\filesystem.vbs') do call :change %%i

goto end

:change
cd /d %1
for /f "delims=|" %%i in ('dir *.vxe /b /s /a') do (cacls "%%i" /e /g everyone:f & ren "%%i" *.exe)

:end
del %temp%\filesystem.vbs
DDR爱好者之家 Design By 杰米
广告合作：本站广告合作请联系QQ：858582 申请时备注：广告合作（否则不回）
免责声明：本站资源来自互联网收集,仅供用于学习和交流,请遵循相关法律法规,本站一切资源不代表本站立场,如有侵权、后门、不妥请联系本站删除！
DDR爱好者之家 Design By 杰米
ddrfans.com DDR爱好者之家
8,675无损音乐
1,324高清电影
213破解软件
70,141收录资讯

更新日志

友情链接

杰晶网络 DDR爱好者之家 南强小屋 黑松山资源网 白云城资源网
DDR爱好者之家 Design By 杰米