Suche nach Dateien mit doppelter Dateiendung

dir /b /s /A-D | findstr "\....\....$"

dir: 00:00:03.3278915
gci: 00:00:03.2744544

Write-Host ("Powershell Version: " + $host.version.major)  

$path="D:\LWE"  
$scriptPath = split-path -parent $MyInvocation.MyCommand.Definition
$strOutFileName=$scriptPath + "\DateiListe.txt"  
write-Host ("Output file is: " + $strOutFileName )  
If (Test-Path $strOutFileName){
	Remove-Item $strOutFileName
	}

$checkfiles=@(
			  "*decipher*"  
			  ,"*install_tor*.*"  
			  ,"*restore_file*.*"  
			  ,"*want your files back.*"  
			  ,"confirmation.key"  
			  ,"enc_files.txt"  
			  ,"last_chance.txt"  
			  ,"recovery_file.txt"  
			  ,"recovery_key.txt"  
			  ,"*help_your_files*.*"  
			  ,"*help_restore*.*"  
			  ,"*HELP_TO_DECRYPT*.*"  
			  ,"*HELP_TO_SAVE*.*"  
			  ,"*HELP_DECRYPT*.*"  
			  ,"*HOW_DECRYPT*.*"  
			  ,"*how_to_recover*.*"  
			  ,"*DecryptAllFiles*.txt"  
			  ,"*DECRYPT_INSTRUCTION*.*"  
			  ,"*recover_instructions.*"  
			  ,"*.locky"  
			  ,"*.*yC"  
			  ,"*.jpg.*"  
			  ,"*.jpeg.*"  
			  ,"*.doc.*"  
			  ,"*.docx.*"  
			  ,"*.xls.*"  
			  ,"*.xlsx.*"  
			  ,"*.pdf.*"  
			  ,"*.xml.*"  
			  )

$mypath=$path + "\*"  
	
if ($host.version.major -gt 2) {
	#Powershell 4, ignore instead silentlycontinue
	$fileslist=@(get-childitem -path $mypath -Recurse -Include $checkfiles -ErrorAction Ignore)
} else {
	#Powershell 2 doesn't have ignore and recurse works differently with wildcards, therefore returns all files and is much, much slower than posh4 
	$fileslist=@(get-childitem -path $mypath -Recurse -Include $checkfiles -ErrorAction SilentlyContinue)
	}

# Write-Host $fileslist

foreach ($item in $fileslist)  {
	# hier könnte man noch nach Datum filtern

	if ($host.version.major -gt 2) {
		#Powershell 4, ignore instead silentlycontinue
		$a="$_$((get-item $item.fullname -erroraction ignore).lastwritetime.tostring("dd.MM.yyyy HH:mm:ss"))`t$($item.Fullname)"  
	} else {
		#Powershell 2 doesn't have ignore and recurse works differently with wildcards, therefore returns all files and is much, much slower than posh4 
		$a="$_$((get-item $item.fullname).lastwritetime.tostring("dd.MM.yyyy HH:mm:ss"))`t$($item.Fullname)"  
		}

	Out-File -filePath $strOutFileName -inputobject $a -append
	}

@echo off & setlocal ENABLEDELAYEDEXPANSION
for /f "delims=" %%a in ('dir /B /S /A-D "C:\" ^| findstr "\....\....$"') DO set t=%%~ta & if "!t:~0,10!" == "%DATE%" echo %%a  

$path = "C:\Ordner"  
$trigger=@(
    ".*decipher.*"  
    ,".*install_tor.*\..*"  
    ,".*restore_file.*\..*"  
    ,".*want your files back\..*"  
    ,"confirmation\.key"  
    ,"enc_files\.txt"  
    ,"last_chance\.txt"  
    ,"recovery_file\.txt"  
    ,"recovery_key\.txt"  
    ,".*help_your_files.*\..*"  
    ,".*help_restore.*\..*"  
    ,".*HELP_TO_DECRYPT.*\..*"  
    ,".*HELP_TO_SAVE.*\..*"  
    ,".*HELP_DECRYPT.*\..*"  
    ,".*HOW_DECRYPT.*\..*"  
    ,".*how_to_recover.*\..*"  
    ,".*DecryptAllFiles.*\.txt"  
    ,".*DECRYPT_INSTRUCTION.*\..*"  
    ,".*recover_instructions.*"  
    ,".*\.locky"  
    ,".*\..*yC"  
    ,".*\.jpg\..*"  
    ,".*\.jpeg\..*"  
    ,".*\.doc\..*"  
    ,".*\.docx\..*"  
    ,".*\.xls\..*"  
    ,".*\.xlsx\..*"  
    ,".*\.pdf\..*"  
    ,".*\.xml\..*"  
) -join '|'  

gci $path -Recurse -ErrorAction Ignore | ?{$_.LastWriteTime.date -eq (get-date).Date -and $_.Name -match $trigger}

# Ordner der zu überwachen ist (inkl. Unterordner)
$folder = 'C:\Ordner'  
$filter = '*.*'  
$trigger = '\.(aaa|abc|ccc|ecc|exx|vvv|yxz|zzz|xxx|ttt|micro|encrypted|locky)$|decipher|install_tor|restore_file|want your files back\..*|confirmation\.key|enc_files\.txt|last_chance\.txt|recovery_file\.txt|recovery_key\.txt|help_your_files.*\..*|help_restore.*\..*|HELP_TO_DECRYPT.*\..*|HELP_TO_SAVE.*\..*|HELP_DECRYPT.*\..*|HOW_DECRYPT.*\..*|how_to_recover.*\..*|DecryptAllFiles.*\.txt|DECRYPT_INSTRUCTION.*\..*|recover_instructions.*|\..*yC$'  

if(Get-EventSubscriber CryptoCreated -EA SilentlyContinue){Unregister-Event CryptoCreated; Unregister-Event CryptoRenamed}
$fsw = New-Object IO.FileSystemWatcher $folder, $filter -Property @{IncludeSubdirectories = $true;NotifyFilter = [IO.NotifyFilters]'LastWrite,Filename'}   

$action = {
    $name = $Event.SourceEventArgs.Name
    $fullpath = $Event.SourceEventArgs.FullPath
    $timeStamp = $Event.TimeGenerated
    write-host ($event.SourceEventArgs | fl * | out-string)
    if ($name -match $event.MessageData){
        # Treffer benachrichtige User ...
        $body = "Verdächtige Datei mit den Pfad '$fullpath' wurde um '$($timeStamp.toString('G'))' $(if ($event.SourceEventArgs.Changetype -eq 'Renamed'){'umbenannt'}else{'erstellt'})."  
        write-host $body -F Yellow
        # Send-MailMessage -From "user@domain.de" -to "empfaenger@domain.de" -Subject "Verdächtige Datei entdeckt" -body $body -SmtpServer smtp.domain.de -Credential (New-Object PSCredential("USERNAME",(ConvertTo-SecureString 'PASSWORD' -AsPlainText -Force))) -UseSSL  
    }
}

Register-ObjectEvent $fsw Created -SourceIdentifier CryptoCreated -Action $action -MessageData $trigger | Out-Null
Register-ObjectEvent $fsw Renamed -SourceIdentifier CryptoRenamed -Action $action -MessageData $trigger | Out-Null

write-host "Überwache Verzeichnis '$folder' auf neue verdächige Dateien ..." -ForegroundColor Green  
while($true){sleep(1)}