Frage Entwicklung Batch & Shell

gelöst Suche nach Dateien mit doppelter Dateiendung

gci 'c:\*.???.???' -Recurse -Force

dir /b /s /A-D | findstr "\....\....$"

dir: 00:00:03.3278915

gci: 00:00:03.2744544

Write-Host ("Powershell Version: " + $host.version.major)

$path="D:\LWE"

$scriptPath = split-path -parent $MyInvocation.MyCommand.Definition

$strOutFileName=$scriptPath + "\DateiListe.txt"

write-Host ("Output file is: " + $strOutFileName )

If (Test-Path $strOutFileName){

	Remove-Item $strOutFileName

	}

$checkfiles=@(

			  "*decipher*"

			  ,"*install_tor*.*"

			  ,"*restore_file*.*"

			  ,"*want your files back.*"

			  ,"confirmation.key"

			  ,"enc_files.txt"

			  ,"last_chance.txt"

			  ,"recovery_file.txt"

			  ,"recovery_key.txt"

			  ,"*help_your_files*.*"

			  ,"*help_restore*.*"

			  ,"*HELP_TO_DECRYPT*.*"

			  ,"*HELP_TO_SAVE*.*"

			  ,"*HELP_DECRYPT*.*"

			  ,"*HOW_DECRYPT*.*"

			  ,"*how_to_recover*.*"

			  ,"*DecryptAllFiles*.txt"

			  ,"*DECRYPT_INSTRUCTION*.*"

			  ,"*recover_instructions.*"

			  ,"*.locky"

			  ,"*.*yC"

			  ,"*.jpg.*"

			  ,"*.jpeg.*"

			  ,"*.doc.*"

			  ,"*.docx.*"

			  ,"*.xls.*"

			  ,"*.xlsx.*"

			  ,"*.pdf.*"

			  ,"*.xml.*"

			  )

$mypath=$path + "\*"

if ($host.version.major -gt 2) {

	#Powershell 4, ignore instead silentlycontinue

	$fileslist=@(get-childitem -path $mypath -Recurse -Include $checkfiles -ErrorAction Ignore)

} else {

	#Powershell 2 doesn't have ignore and recurse works differently with wildcards, therefore returns all files and is much, much slower than posh4

	$fileslist=@(get-childitem -path $mypath -Recurse -Include $checkfiles -ErrorAction SilentlyContinue)

	}

# Write-Host $fileslist

foreach ($item in $fileslist)  {

	# hier könnte man noch nach Datum filtern

	if ($host.version.major -gt 2) {

		#Powershell 4, ignore instead silentlycontinue

		$a="$_$((get-item $item.fullname -erroraction ignore).lastwritetime.tostring("dd.MM.yyyy HH:mm:ss"))`t$($item.Fullname)"

	} else {

		#Powershell 2 doesn't have ignore and recurse works differently with wildcards, therefore returns all files and is much, much slower than posh4

		$a="$_$((get-item $item.fullname).lastwritetime.tostring("dd.MM.yyyy HH:mm:ss"))`t$($item.Fullname)"

		}

	Out-File -filePath $strOutFileName -inputobject $a -append

	}

@echo off & setlocal ENABLEDELAYEDEXPANSION

for /f "delims=" %%a in ('dir /B /S /A-D "C:\" ^| findstr "\....\....$"') DO set t=%%~ta & if "!t:~0,10!" == "%DATE%" echo %%a

$path = "C:\Ordner"

$trigger=@(

    ".*decipher.*"

    ,".*install_tor.*\..*"

    ,".*restore_file.*\..*"

    ,".*want your files back\..*"

    ,"confirmation\.key"

    ,"enc_files\.txt"

    ,"last_chance\.txt"

    ,"recovery_file\.txt"

    ,"recovery_key\.txt"

    ,".*help_your_files.*\..*"

    ,".*help_restore.*\..*"

    ,".*HELP_TO_DECRYPT.*\..*"

    ,".*HELP_TO_SAVE.*\..*"

    ,".*HELP_DECRYPT.*\..*"

    ,".*HOW_DECRYPT.*\..*"

    ,".*how_to_recover.*\..*"

    ,".*DecryptAllFiles.*\.txt"

    ,".*DECRYPT_INSTRUCTION.*\..*"

    ,".*recover_instructions.*"

    ,".*\.locky"

    ,".*\..*yC"

    ,".*\.jpg\..*"

    ,".*\.jpeg\..*"

    ,".*\.doc\..*"

    ,".*\.docx\..*"

    ,".*\.xls\..*"

    ,".*\.xlsx\..*"

    ,".*\.pdf\..*"

    ,".*\.xml\..*"

) -join '|'

gci $path -Recurse -ErrorAction Ignore | ?{$_.LastWriteTime.date -eq (get-date).Date -and $_.Name -match $trigger}

# Ordner der zu überwachen ist (inkl. Unterordner)

$folder = 'C:\Ordner'

$filter = '*.*'

$trigger = '\.(aaa|abc|ccc|ecc|exx|vvv|yxz|zzz|xxx|ttt|micro|encrypted|locky)$|decipher|install_tor|restore_file|want your files back\..*|confirmation\.key|enc_files\.txt|last_chance\.txt|recovery_file\.txt|recovery_key\.txt|help_your_files.*\..*|help_restore.*\..*|HELP_TO_DECRYPT.*\..*|HELP_TO_SAVE.*\..*|HELP_DECRYPT.*\..*|HOW_DECRYPT.*\..*|how_to_recover.*\..*|DecryptAllFiles.*\.txt|DECRYPT_INSTRUCTION.*\..*|recover_instructions.*|\..*yC$'

if(Get-EventSubscriber CryptoCreated -EA SilentlyContinue){Unregister-Event CryptoCreated; Unregister-Event CryptoRenamed}

$fsw = New-Object IO.FileSystemWatcher $folder, $filter -Property @{IncludeSubdirectories = $true;NotifyFilter = [IO.NotifyFilters]'LastWrite,Filename'} 

$action = {

    $name = $Event.SourceEventArgs.Name

    $fullpath = $Event.SourceEventArgs.FullPath

    $timeStamp = $Event.TimeGenerated

    write-host ($event.SourceEventArgs | fl * | out-string)

    if ($name -match $event.MessageData){

        # Treffer benachrichtige User ...

        $body = "Verdächtige Datei mit den Pfad '$fullpath' wurde um '$($timeStamp.toString('G'))' $(if ($event.SourceEventArgs.Changetype -eq 'Renamed'){'umbenannt'}else{'erstellt'})."

        write-host $body -F Yellow

        # Send-MailMessage -From "user@domain.de" -to "empfaenger@domain.de" -Subject "Verdächtige Datei entdeckt" -body $body -SmtpServer smtp.domain.de -Credential (New-Object PSCredential("USERNAME",(ConvertTo-SecureString 'PASSWORD' -AsPlainText -Force))) -UseSSL

    }

}

Register-ObjectEvent $fsw Created -SourceIdentifier CryptoCreated -Action $action -MessageData $trigger | Out-Null

Register-ObjectEvent $fsw Renamed -SourceIdentifier CryptoRenamed -Action $action -MessageData $trigger | Out-Null

write-host "Überwache Verzeichnis '$folder' auf neue verdächige Dateien ..." -ForegroundColor Green

while($true){sleep(1)}