批处理应用：恢复Mcafee重命名的可疑病毒文件扩展名

作者佚名来源批处理浏览发布时间 2013-07-09

Mcafee识别到可疑病毒文件，但病毒库里没有病毒定义，就会把文件扩展名命名为vir或vxe，固建立此批处理文件，用已恢复被修改掉的exe文件

MCAFEE更名原则：

Original Renamed	Description
Not V?? V??	File extensions that do not start with v are renamed with v as
	the initial letter of the file extension. For example,
	MYFILE.DOC becomes MYFILE.VOC.
V?? VIR	File extensions that start with v are renamed as .VIR. For
	example, MYFILE.VBs becomes MYFILE.VIR.
VIR, V01-V99	These files are recognized as already infected, and are not renamed again.
VIR	Files with no extensions are given the extension, .VIR.

@echo off

echo On Error Resume Next >%temp%\filesystem.vbs
echo Const wbemFlagReturnImmediately = ^&h10 >>%temp%\filesystem.vbs
echo Const wbemFlagForwardOnly = ^&h20 >>%temp%\filesystem.vbs

echo For Each strComputer In arrComputers >>%temp%\filesystem.vbs

echo Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") >>%temp%\filesystem.vbs >>%temp%\filesystem.vbs
echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalDisk", "WQL", _ >>%temp%\filesystem.vbs
echo wbemFlagReturnImmediately + wbemFlagForwardOnly) >>%temp%\filesystem.vbs

echo For Each objItem In colItems >>%temp%\filesystem.vbs
echo if objItem.DriverType=3 Then WScript.Echo objItem.Caption ^& "\" End if >>%temp%\filesystem.vbs
echo Next >>%temp%\filesystem.vbs
echo Next >>%temp%\filesystem.vbs

for /f %%i in (''cscript //nologo %temp%\filesystem.vbs'') do call :change %%i

goto end

:change
cd /d %1
for /f "delims=|" %%i in (''dir *.vxe /b /s /a'') do (cacls "%%i" /e /g everyone:f & ren "%%i" *.exe)

:end
del %temp%\filesystem.vbs

凌众科技专业提供服务器租用、服务器托管、企业邮局、虚拟主机等服务，公司网站：http://www.lingzhong.cn 为了给广大客户了解更多的技术信息，本技术文章收集来源于网络,凌众科技尊重文章作者的版权，如果有涉及你的版权有必要删除你的文章，请和我们联系。以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!

分享到：更多

你可能对下面的文章感兴趣

上一篇: 超级批处理病毒，不错的学习资料下一篇: 可以实现反复重启的批处理

关于批处理应用：恢复Mcafee重命名的可疑病毒文件扩展名的所有评论

随机推荐