You’re infected—if you want to see your data again, pay us $300 in Bitcoins

Re:You’re infected—if you want to see your data again, pay u... by fekberg on Thursday October 17, 2013 @06:37PM (#6568631)

Here's a command you can run to find out what executables exist in AppData:

    dir /S /P "%userprofile%\AppData\*.exe" > %userprofile%\Desktop\FoundFiles.txt

[ Parent | on HN ]

Re:You’re infected—if you want to see your data again, pay u... by m_myers on Thursday October 17, 2013 @07:19PM (#6568825)

Or for PowerShell:

    dir -Path "$env:userprofile\AppData" -Filter *.exe -Recurse > "$env:userprofile\Desktop\FoundFiles.txt"

Useful if your corporate security policy, like mine, has disabled the command prompt but left PowerShell intact.

[ Parent | on HN ]

Re:You’re infected—if you want to see your data again, pay u... by pjmlp on Friday October 18, 2013 @02:33AM (#6570093)

It still wonders me the amount of IT folks unaware of Powershell.

[ Parent | on HN ]

Re:You’re infected—if you want to see your data again, pay u... by Silhouette on Thursday October 17, 2013 @08:27PM (#6569085)

It's helpful to add /A (shows .exe files even if they have hidden/system attributes set) and maybe /B (bare format, just the path/filenames without all the header/footer information).

[ Parent | on HN ]