Worm got my Windows OS today.. and it spawned 38,188 EXE files (360KB each file) in my external drive..
The logic of spawning is very common which it recurse to your entire drive and make a copy of the worm it self and has the same name of the current directory where the worm is located to.
I tried searching all of them and it returned 38,188 exe files. I tried deleting them all at once using File Explorer but am not sure why the Explorer hanged.. Tried it twice and same thing.
So to make things easier .. no UI at all .. I wrote a console app which it recurse all the directories in my external drive .. look for common pattern and delete! here’s the code ..
you’re free to tweak it.
using System;
using System.Collections.Generic;
using System.IO;
using System.Text;
namespace RemoveSpawner
{
class Program
{
static void Main(string[] args)
{
ScanAndRemove("E:\\");
Console.WriteLine("DONE");
Console.ReadLine();
}
public static void ScanAndRemove(string b)
{
int counter = 0;
Stack<string> stack = new Stack<string>();
stack.Push(b);
while (stack.Count > 0)
{
string dir = stack.Pop();
try
{
string[] files = Directory.GetFiles(dir, "*.exe");
foreach (string file in files)
{
DirectoryInfo di = new DirectoryInfo(dir);
if (di.Name.ToLower() == Path.GetFileNameWithoutExtension(file.ToLower()))
{
counter++;
Console.WriteLine(counter + ", " + file);
Console.Write("deleting ... ");
try
{
File.Delete(file);
Console.WriteLine("done!");
}
catch (Exception ex) { ; }
}
}
foreach (string dn in Directory.GetDirectories(dir))
{
stack.Push(dn);
}
}
catch
{
}
}
}
}
}
Cheers.
0 comments:
Post a Comment