☰

如何删除所有132kb的“*.exe”文件

tag-icon • tag-icon fedora find malware
如何删除所有132kb的“*.exe”文件

我的外部硬盘感染了 Windows 病毒，该病毒会生成大量filename.exe132.6 kb 的副本。

当我编写时，find . -type f -name "*.exe"它会发现数千个 .exe 文件，其中只有 100 或 200 个是我的文件。

您知道一种聪明的方法来提取病毒文件并一次性删除所有文件而不丢失我的数据吗？

答案1

find与选项一起使用-size：

find . -type f -iname '*.exe' -size 133k

或者

find . -type f -iname '*.exe' -size 135783c

确认这些文件是坏文件后，您可以-delete在命令中添加选项来删除这些文件。

从man find：

   -size n[cwbkMG]
          File uses n units of space, rounding up.  The following suffixes can be used:

          `b'    for 512-byte blocks (this is the default if no suffix is used)

          `c'    for bytes

          `w'    for two-byte words

          `k'    for Kibibytes (KiB, units of 1024 bytes)

          `M'    for Mebibytes (MiB, units of 1024 * 1024 = 1048576 bytes)

          `G'    for Gibibytes (GiB, units of 1024 * 1024 * 1024 = 1073741824 bytes)

          The size does not count indirect blocks, but it does count blocks in sparse files that are not  actu‐
          ally allocated.  Bear in mind that the `%k' and `%b' format specifiers of -printf handle sparse files
          differently.  The `b' suffix always denotes 512-byte blocks and never 1024-byte blocks, which is dif‐
          ferent to the behaviour of -ls.

          The  +  and  -  prefixes signify greater than and less than, as usual; i.e., an exact size of n units
          does not match.  Bear in mind that the size is rounded up to the next unit. Therefore  -size  -1M  is
          not  equivalent  to  -size  -1048576c.  The former only matches empty files, the latter matches files
          from 0 to 1,048,575 bytes.

答案2

使用 Python 完成。测试并运行良好。

#!/usr/bin/python
import os
import re
di=[]
fip=[]
o=re.compile(r'.exe$')
for i,j,k in os.walk('path'):
    di.append(i.strip())
    for q in k:
        fip.append(q.strip())
    
for n in di:
    for g in fip:
        u=os.path.join(n,g)
        if re.search(o,u):  #This step used to verify .exe file"
            if os.path.isfile(u):
                if str(os.stat(u).st_size) == "132":
                    os.remove(u)

相关内容