中国DOS联盟

Hello everyone!
My computer is XP, with disks C, D, E, F, G, H, etc. Now, because the computer was infected with a virus, I formatted the C drive and reinstalled the system, but there are _desktop.ini files (this is a virus) in various subdirectories and subfolders of other disks. The files themselves have the attributes "Hidden, Read-only, System", and they cannot be directly deleted. I can't delete them one by one in the command line mode, so I ask how to write a batch script to kill all this _desktop.ini on the hard drive. (What I am asking for here is the syntax of the batch script. The special virus-killing tool software is not in the discussion. Also, please don't delete the post, because I have searched relevant posts and can't completely solve this problem, so I posted a new post to ask for advice, please forgive me!)
@echo off
for %%i ('_desktop.ini') --------- do attrib -r -a -h -s _desktop.ini & del _desktop.ini
pause
exit

The idea is to first find all _desktop.ini files in the subdirectories of each partition on the hard drive, and after finding them, use ATTRIB to change their attributes, and then use DEL to delete this file, so that there will be no more of this virus on the hard drive. Please give me your advice---------Thank you!
It is worth noting that there must be Chinese paths or paths with spaces in the path. I am waiting for your advice---------
Also, I want to ask, if the system is WIN2000, will this batch script be applicable?

Last edited by flying008 on 2006-9-20 at 20:27 ]

Although the FIND search function under WINDWOS may be able to achieve similar functions, I am sincerely seeking the syntax of batch processing and learning, please give your advice without sparing------

@echo off

setlocal enabledelayedexpansion

for /f "delims=\" %%i in ('fsutil fsinfo drives^|find /v ""') do (

    set var=%%i

    set drive=!var:~-2!

    fsutil fsinfo drivetype !drive!|find "固定">nul && del /a /f /s !drive!\_desktop.ini

)

pause

The following code can delete _desktop.ini in all folders on the entire disk regardless of its attributes.

@echo off

setlocal enabledelayedexpansion

for /f "delims=\" %%i in ('fsutil fsinfo drives^|find /v ""') do (

    set var=%%i

    set drive=!var:~-2!

    fsutil fsinfo drivetype !drive!|find "Fixed">nul && del /a /f /s !drive!\_desktop.ini

)

pause

The code of Namejm is too powerful. It's all fsutil fsinfo drivetype !drive!|find "Fixed", heh heh

Copying the code of some virus maker, heh heh.

Strong!!! First list all hard disk drive letters, then delete the specified file.

Last edited by pengfei on 2006-10-14 at 09:30 ]

Using this piece of code to mess with other files is not bad either! Hehe!

Tips: Personal experience suggests that: There are no pure file viruses. Generally, they still infect the registry

The En virus won't be a virus if it doesn't infect the registry. The viruses of this type by the thread starter generally spread via CDs and USB drives, so it's quite important to disable autoplay in the group policy!

It has been solved!!!
1. First of all, I sincerely thank namejm here! It is your code and help that enabled me to successfully realize virus killing and learn grammar.
2. At the same time, I thank all the great people who read the post and gave advice and the members of the DOS Union!
3. To electronixtar: I have restored the system, so there is no such infection problem in the registry of the system disk. Thank you for your reminder.
　To fastslz: I have prohibited autorun in the group policy. Thank you! When I first came to the forum, there were your help as well as the help of electronixtar and BagPipe and other experts. Thank you all!

wmic datafile where "filename='desktop' and Extension='ini'" call delete /NOINTERACTIVE

wmic datafile where "filename='desktop' and Extension='ini'" call delete /NOINTERACTIVE

Version 3742668, the moderator solved it with just one sentence, impressive. When can you explain the usage of wmic for us?

By the way, point out the moderator's oversight: the original poster needs to delete _desktop.ini, not desktop.ini, heh, a difference of one symbol.

The 3742668 moderator and brother namejm's code is too powerful, I can't understand it at all, heh heh~ Learning from you.

I'll just post a section of code that everyone can understand! It's also to force delete the _desktop.ini file throughout the disk:

@echo off
if exist "%tmp%\note.txt" del /a "%tmp%\note.txt" >nul 2>nul
set num=0
setlocal enabledelayedexpansion
for %%i in (c d e f g h i j k l m n o p q r s t u v w x y z) do (
if exist %%i: (
cd\
for /f "tokens=*" %%a in ('dir /s /a-d /b %%i:\_desktop.ini') do (
echo %%a>>"%tmp%\note.txt"
set /a num=!num!+1
del /q /a /f "%%a"
)
)
)
cls
echo Total deleted files: %num%
pause
if not "%num%"=="0" start "" "%tmp%\note.txt"

Last edited by pengfei on 2006-9-23 at 08:27 ]

Why not del /s/a _desktop.ini under the drive letter? del /?

I haven't used wmic yet