Question

我有一个感染了病毒的硬盘。病毒会对文件进行加密，然后要求勒索赎金以解密它们。这些文件是HELP_DECRYPT.HTML，HELP_DECRYPT.PNG，HELP_DECRYPT.TXT和HELP_DECRYPT.URL。

驱动器上有数千个受感染的文件。我正在尝试编写一个脚本来浏览驱动器上的所有文件夹，如果它发现任何恶意文件，则删除它们。然后我想要从同一目录中的备份驱动器复制文件，即。如果在I \ Folder \中找到，将从F \ Folder \获取文件。

在我的情况下，受感染的驱动器为Y，备份驱动器为X.

我对VBScripts相对较新，这是我到目前为止所做的：

    set fso = CreateObject("Scripting.FileSystemObject")
ShowSubFolders FSO.GetFolder("Y:\"), 3

Sub ShowSubFolders(Folder, Depth)
    If Depth > 0 then
        For Each Subfolder in Folder.SubFolders
            'Wscript.Echo Subfolder.Path
    DeleteFiles(subFolder.path)
  On Error Resume Next
            ShowSubFolders Subfolder, Depth -1 

        Next
    End if
End Sub


  'deletes the malicious files and calls the copy function'
Function DeleteFiles(path)
'wscript.echo("in delete method")
  set FSO2 = Createobject("Scripting.FileSystemObject")
  set ofolder = createobject("Scripting.FileSystemObject")
  set ofolder = FSO2.GetFolder(path)

  if FSO2.FileExists("HELP_DECRYPT.URL") Then
    ofolder.DeleteFile("HELP_DECRYPT.PNG")
    ofolder.DeleteFile("HELP_DECRYPT.HTML")
    ofolder.DeleteFile("HELP_DECRYPT.URL")
    ofolder.DeleteFile("HELP_DECRYPT.TXT")      
      wscript.echo("DeletedFiles")
  copyFiles(FSO.GetParentFolder) 
    end if

End Function


  'copies files from the backup'
Function CopyFiles(from)
    dim to1 'where we're copying to
    to1=from 'where we're copying from
    Call Replace (from, "Y:", "X:")
    SET FSO3 = CreateObject("Scripting.FileSystemObject")
    For Each file In from 'not sure about "file"
        FSO3 = file
        Call FSO3.CopyFile (from, to1, true)'copies file and overwrites if already there
    Next
End Function

Answer 1

以下是我要使用的内容：

Option Explicit

Dim FSO, badFiles
Set FSO = CreateObject("Scripting.FileSystemObject")
badFiles = Array("HELP_DECRYPT.PNG", "HELP_DECRYPT.URL", "HELP_DECRYPT.HTML", "HELP_DECRYPT.TXT")

Walk FSO.GetFolder("Y:\")

Sub Walk(folder)
  Dim subFolder
  For Each subFolder in folder.SubFolders
    DeleteFiles subFolder, badFiles
    RestoreFiles "X:", subFolder
    Walk subFolder
  Next
End Sub

Sub DeleteFiles(folder, filesToDelete)
  Dim file
  For Each file In filesToDelete
    file = FSO.BuildPath(folder.Path, file)
    If FSO.FileExists(file) Then FSO.DeleteFile file, True
  Next
End Sub

Sub RestoreFiles(sourceRoot, destinationFolder)
  Dim sourcePath, file
  WScript.Echo "Restoring " & destinationFolder.Path & " ..."
  sourcePath = Replace(destinationFolder.Path, destinationFolder.Drive, sourceRoot)
  If FSO.FolderExists(sourcePath) Then
    For Each file In FSO.GetFolder(sourcePath).Files
      WScript.Echo file.Name
      ' maybe add a DateLastModified check here?
      file.Copy FSO.BuildPath(destinationFolder.Path, file.Name), True
    Next
  Else
    WScript.Echo "Warning! Folder not found: " & sourcePath
  End If
End Sub

使用VBScript的一般提示：

始终使用Option Explicit
除了非常密切关注的情况外，请避免On Error Resume Next。简单地抑制任何错误绝不是一个好主意。
使用cscript.exe在命令行上运行上述脚本，这样您就可以看到脚本的Echo输出，而无需点击1000的消息框。
使用全局FSO对象。无需在每个功能中定义新的
尝试通用。看看上面的DeleteFiles() RestoreFiles()实际上根本不适合您当前的问题。您可以在不同的脚本中重复使用这些功能，而无需更改它们。

VB脚本删除某些文件，如果找到文件，则将其他文件复制到目录

1 个答案: