还原被U盘病毒设定为系统隐藏文件的数据

还原U盘隐藏文件.bat

@echo off
powershell -ExecutionPolicy ByPass -File "还原U盘隐藏文件.ps1"
pause

还原U盘隐藏文件.ps1

#给MessageBox用的
#Add-Type -AssemblyName PresentationFramework;

# 获取全部卷
$volumes = Get-Volume | Where-Object {($_.DriveType -eq "Fixed" -or $_.DriveType -eq "Removable") -and $_.FileSystemType -ne "Unknown" -and $_.DriveLetter.Length};
#Write-Output $volumes;

$virusFolderName = "Usb Drivе"

# 显示隐藏扩的展名
Set-Itemproperty -path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name 'HideFileExt' -value 0

#函数：递归调用文件夹内的移动
function DirectoryRecurseMove {
	[CmdletBinding()]
	param(
		[Parameter(Mandatory, ValueFromPipeline)][System.IO.DirectoryInfo]$Path,
		[Parameter(Mandatory)][string]$Destination
	)
	process {
		$newPath = Join-Path $Destination $Path.Name;
		if (!(Test-Path $newPath)) {
			New-Item -Path $newPath -ItemType Directory -Force;
		};
		$Path | Get-ChildItem | ForEach-Object {
			$newSubPath = Join-Path $newPath $_.Name;
			if ($_.Attributes -band [System.IO.FileAttributes]::Directory -and (Test-Path $newSubPath)) {
				$_ | DirectoryRecurseMove -Destination $newSubPath;
			} else {
				$_ | Move-Item -Destination $newSubPath -Force;
			}
		}
		$_ | Remove-Item -Force -Recurse -Confirm:$false;
	}
}

# 输出每个卷的基本信息
foreach ($volume in $volumes) {
	$volumeLabel = $volume.DriveLetter + ":"
	if($volume.FileSystemLabel.Length) {
		$volumeLabel = $volumeLabel + "("+$volume.FileSystemLabel+")"
	}
    Write-Host "正在检测 $volumeLabel";

	$drivePath = $volume.DriveLetter+":\";

	# Usb Drivе 模式病毒
	if (Test-Path -Path (Join-Path $drivePath $virusFolderName) -PathType Container) {
		Write-Host "$volumeLabel 内发现病毒隐藏文件夹" -Foregroundcolor Red;
		# $messageBoxResult = [System.Windows.MessageBox]::Show("分区 $volumeLabel 内发现被 U 盘病毒隐藏到`“$virusFolderName`”文件夹内的文件，是否还原并删除病毒文件？" , '发现受害文件夹' , [System.Windows.MessageBoxButton]::YesNo , [System.Windows.MessageBoxImage]::Warning);
		# if ($messageBoxResult -eq [System.Windows.MessageBoxResult]::Yes)

		$virusExeName = $volume.FileSystemLabel + ".exe";
		$virusExeFullPath = Join-Path $drivePath $virusExeName;
		if (Test-Path -Path $virusExeFullPath -PathType Leaf) {
			Remove-Item -Path $virusExeFullPath -Force -Confirm:$false;
			
			Write-Host "删除病毒执行程序 $virusExeName" -Foregroundcolor Yellow;
		}

		$virusHiddenFolderPath = Join-Path $drivePath $virusFolderName;
		# #先删除储存病毒的 1.0 文件夹
		# $virusDataFolderPath = Join-Path $virusHiddenFolderPath "1.0";
		# if (Test-Path $virusDataFolderPath -PathType Container) {
		# 	Remove-Item -Path $virusDataFolderPath -Force;
		# 	Write-Output "已删除病毒本体文件夹 $virusDataFolderPath";
		# }
		$normalFiles = (Get-ChildItem -Path $virusHiddenFolderPath -Force) | Where-Object {!($_.Name -eq "1.0" -and ($_.Attributes -band [System.IO.FileAttributes]::Directory))};
		foreach ($normalFile in $normalFiles) {
			# 已经存在同名文件夹的情况下，调用递归移动
			if ($normalFile.Attributes -band [System.IO.FileAttributes]::Directory -and (Test-Path (Join-Path $drivePath $normalFile.Name))) {
				$normalFile | DirectoryRecurseMove -Destination $drivePath;
			} else {
			#直接移动
				$normalFile | Move-Item -Destination $drivePath -Force;
			}
			$itemType = "文件";
			if ($normalFile.Attributes -band [System.IO.FileAttributes]::Directory) { $itemType = "目录"}
			Write-Host "还原$itemType $($normalFile.Name) 到 $drivePath" -Foregroundcolor Green;
		}
		Remove-Item -Path $virusHiddenFolderPath -Force -Recurse -Confirm:$false;
		Write-Host "删除病毒隐藏数据用的文件夹 $virusHiddenFolderPath" -Foregroundcolor Yellow;
	}

	$systemDirectory = Get-ChildItem -Path $drivePath -Directory -System -Hidden -Attributes !ReparsePoint;
	# $executableFile = Get-ChildItem -Path (Join-Path $drivePath "*.exe");
	# 原来的只隐藏文件夹的病毒
	$systemDirectory | ForEach-Object {
		$virusExeName = Join-Path $drivePath ($_.Name+".exe");
		if (Test-Path $virusExeName) {
			Write-Host "$volumeLabel 内的 $virusExeName 可能是病毒" -Foregroundcolor Red -NoNewline;
			Remove-Item -Path $virusExeName -Force -Confirm:$false;
			Write-Host "，给你删了。" -Foregroundcolor Yellow;
		}
	}
	$systemDirectory | Where-Object {
		$_.Name -ne "System Volume Information" -and
		$_.Name -ne "`$Recycle.Bin" -and
		$_.Name -ne "Config.Msi" -and
		$_.Name -ne "Recovery" 
	} | ForEach-Object {
		$_.Attributes = $_.Attributes - [System.IO.FileAttributes]::System - [System.IO.FileAttributes]::Hidden;
		Write-Host "去除目录 $($_.Name) 的隐藏和系统属性" -Foregroundcolor Green;
	}
}