virus

[Add]

my dumb assed little sister has got herself a virus, that's not my problem, i've fixed her pc, my problem is the **** of a virus has copied emails containing itself as an attachment into every folder on every network writable drive on our network (6pc's in this house). is there a quick way to delete all of these (don't say format, as one of these drives is my mp3 collection that has taken years to put together...)

[Dante Hicks]

Couldn't you just use the Windows Search facility (i.e. Start=>Search=>Files and Folders=>All Files and Folders) to search for every file of that name and then highlight/delete en massé?

If you want to search Network drives then you could just mount the drives as Network drives (and then search C:; D:; Z:;). Obviously it won't affect the Program Files/Windows dirs on affected PC's.

Unless you mean something else, I'm sure there's utilities which do the same thing, and you could easily roll your own in most languages.

[Add]

Originally posted by Dante Hicks
Couldn't you just use the Windows Search facility (i.e. Start=>Search=>Files and Folders=>All Files and Folders) to search for every file of that name and then highlight/delete en massé?

If you want to search Network drives then you could just mount the drives as Network drives (and then search C:; D:; Z:. Obviously it won't affect the Program Files/Windows dirs on affected PC's.

Unless you mean something else, I'm sure there's utilities which do the same thing, and you could easily roll your own in most languages.

ah, i forgot the mention, in every single occurance of the file i've found it has a different file name. however the size is always the same as is the extention. i tried del d:\*.eml but that did fk all. if all else fails i will have to install some anti virus software and see what that does (in 7/8 years of desktop pc use i've never once installed anti-virus software :/).

[Dante Hicks]

Originally posted by Add
ah, i forgot the mention, in every single occurance of the file i've found it has a different file name. however the size is always the same as is the extention. i tried del d:\*.eml but that did fk all. if all else fails i will have to install some anti virus software and see what that does (in 7/8 years of desktop pc use i've never once installed anti-virus software :/).

Search for *.eml then and just put file sizes as the conditions (you might also want to put in creation date if that's the same).

[Cyp]

Search "My computer" for *.eml (or whatever it is), and just delete them all? Or, if there are actually some useful .eml files (whatever .eml is supposed to be), add some of the contents of the file to the search. (That would mean opening one in Notepad.) The search function on mine seems to only be able to search for files bigger than, or smaller than, but not both, a size given in kilobytes, not bytes...

[Nodrog]

#!/usr/bin/perl -w
use strict;

my ($root, $ex, $size) = @ARGV;
&cleandir($root);

sub cleandir {
	my ($f, $s,@a);
	opendir(DIR, $_[0]) || die "Cannot open directory $_[0]"; chdir($_[0]);
	foreach $f (readdir(DIR)) {
		if ($f eq "." || $f eq "..") {next;}
		elsif (-d $f) {cleandir($f);}
		elsif ($f =~ /\.$ex$/) {@a=stat($f);if ($a[7] == $size) {unlink $f;}}
	}
	chdir("..");
}

will remove all files in a directory tree with a given extension and size

use it like

"perl cleaner.pl c:\ eml 56"

where c:\ is the directory to start in, eml is the extension, and 56 is the size of the file in bytes

[queball]

perl!!!!!!

perl -MFile::Find -e'File::Find::find(sub{/\.eml$/i&&-f&&-s==56&&unlink},"/some/directory");

(replace 56 and /some/directory)

[Structural Integrity]

eml? nimda?

Anyway, smartest thing would be to close all network folders, delete all EML files and reboot the systems a few times. If on one PC the eml files come back (as I had when I got nimda), then you know it's infected.
Deleting these files with the network folders still enabled might cause you more work if it wasn't cleaned properly.

[Mong]

Originally posted by Add
(in 7/8 years of desktop pc use i've never once installed anti-virus software :/).

And that's why you have a virus. In fact, I'm fairly confident you'll have plenty of stupid (and possibly not so stupid) viruses on your system. You just don't know, becuase you don't have a virus prog! Or indeed, if you use a *nix-type system

M.

[MT]

Originally posted by queball
perl!!!!!!

perl -MFile::Find -e'File::Find::find(sub{/\.eml$/i&&-f&&-s==56&&unlink},"/some/directory");

(replace 56 and /some/directory)

find /mount/samba -iname '*.eml' | xargs rm -rf