Scanns all local drives for files encrypted by the QQ Randsomware

ScanForVirusFiles.ps1

$drives = @(Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3')
Write-Host "Loading Logical Drives`n$drives" -ForegroundColor Cyan
$logfile = 'C:\temp\FoundFiles.log'
$logpath = 'C:\temp'
If (!$logpath) {New-Item -ItemType Directory -Name 'temp'}
#If (!$logfile) {New-Item -ItemType Directory -Name 'FoundFiles.log'}



Write-host "Scanning Directories for files" -ForegroundColor Cyan
Foreach ($drive in $drives) {
    Get-childitem -Path "$($drive.DeviceID)\" -Recurse -Filter '*QQ*.eth' -ErrorAction SilentlyContinue | Select-Object FullName,LastWriteTime | ForEach-Object {
        $string = "Found $($_.FullName) | last write time $($_.LastWriteTime)"
        Write-Host $string -ForegroundColor Yellow
        Add-Content -Value $string -Path $logfile
    }
        
}

If (!$logfile) {Write-Host "No files were found on this system"} Else {Invoke-Item $logfile}