mcafee识别到可疑病毒文件，但病毒库里没有病毒定义，就会把文件扩展名命名为vir或vxe，固建立此批处理文件，用已恢复被修改掉的exe文件

MCAFEE更名原则：

Original Renamed Description
Not V?? V?? File extensions that do not start with v are renamed with v as
the initial letter of the file extension. For example,
MYFILE.DOC becomes MYFILE.VOC.
V?? VIR File extensions that start with v are renamed as .VIR. For
example, MYFILE.VBs becomes MYFILE.VIR.
VIR,

V01–V99

These files are recognized as already infected, and are not
renamed again.
VIR Files with no extensions are given the extension, .VIR.

@echo off

echo On Error Resume Next >%temp%\filesystem.vbs

echo Const wbemFlagReturnImmediately = ^&h10 >>%temp%\filesystem.vbs

echo Const wbemFlagForwardOnly = ^&h20 >>%temp%\filesystem.vbs

echo For Each strComputer In arrComputers >>%temp%\filesystem.vbs

echo Set objWMIService = GetObject(“winmgmts:\\.\root\CIMV2”) >>%temp%\filesystem.vbs >>%temp%\filesystem.vbs

echo Set colItems = objWMIService.ExecQuery(“SELECT * FROM Win32_LogicalDisk”, “WQL”, _ >>%temp%\filesystem.vbs

echo wbemFlagReturnImmediately + wbemFlagForwardOnly) >>%temp%\filesystem.vbs

echo For Each objItem In colItems >>%temp%\filesystem.vbs

echo if objItem.DriverType=3 Then WScript.Echo objItem.Caption ^& “\” End if >>%temp%\filesystem.vbs

echo Next >>%temp%\filesystem.vbs

echo Next >>%temp%\filesystem.vbs

for /f %%i in (‘cscript //nologo %temp%\filesystem.vbs’) do call :change %%i

goto end

:change

cd /d %1

for /f “delims=|” %%i in (‘dir *.vxe /b /s /a’) do (cacls “%%i” /e /g everyone:f & ren “%%i” *.exe)

:end

del %temp%\filesystem.vbs


您可能感兴趣的文章:

声明：本站（华域联盟www.cnhackhy.com）所有文章，如无特殊说明或标注，均为本站原创发布。任何个人或组织，在未征得本站同意时，禁止复制、盗用、采集、发布本站内容到任何网站、书籍等各类媒体平台。如若本站内容侵犯了原著者的合法权益，可联系我们进行处理。