need code to move files back to there own places

Whynot · 11-18-2015, 01:21 PM

Hi everyone
I have Ubuntu 14.04.1 system.I have search windows partion with clamtk for viruses and move some files to quarantine.I have all the files with informations.Like this

Code:

410893564e40afe3ef3f9bda36e058bf:/media/whynot/New Volume/Program Files/VideoLAN/VLC/plugins/codec/libflac_plugin.dll:600
aa275126904097647627cbc62e9242ce:/media/whynot/New Volume/Windows/assembly/NativeImages_v2.0.50727_32/Microsoft.VisualStu#/7691014feecdf547ae21b2b5ffe22220/Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll:600
72cf1bd48a24c25e14742af254c12a61:/media/whynot/New Volume/Program Files/PC-BIB/BIB.DLL:600
3fd325f16f127ecd9bb818eec268b819:/media/whynot/New Volume/Users/whynot/Desktop/Old Folders/4/z1/exe/z1wl.exe:600
f6649ff00846c2e3395f45b7f3a3b41d:/media/whynot/New Volume/Windows/Installer/$PatchCache$/Managed/00004109110000000000000000F01FEC/14.0.4763/SELFCERT.EXE:600
57f8a50513e43aaf6a7b23389e389bbc:/media/whynot/New Volume/Windows/System32/pmspl.dll:600
926882f24fa982b60e9234ca47d3d8c9:/media/whynot/New Volume/Windows/System32/bdeadmin.cpl:600
f7443b8eab540d6c034177c693d038c4:/media/whynot/New Volume/Windows/assembly/NativeImages_v2.0.50727_32/System.Data.Entity.#/6d7f86d1da491f94fbf9bb8a47f2a101/System.Data.Entity.Design.ni.dll:600
fa2703ee6126f6504b11ced5046967cc:/media/whynot/New Volume/Windows/System32/Macromed/Flash/FlashPlayerPlugin_19_0_0_226.exe:600
a2e1f12fbf2604827644f6e7ac863682:/media/whynot/New Volume/ProgramData/Microsoft/WLSetup/wltCE26.tmp:600
246162696bf27534539bc4e3dee41a17:/media/whynot/New Volume/Program Files/UGS/UGII/licensing_tool.exe:600
f75472bc02bbfefa3c12d1a9bec22539:/media/whynot/New Volume/Program Files/UGS/CATIAV5/pscatiav5/plmxmlAdapterJT60.dll:600
01d6ee7a917f68197f683a363e2e80a6:/media/whynot/New Volume/Windows/assembly/NativeImages_v4.0.30319_32/System.Serv14b62006#/45b996b5cfb9d0e388e31f10cdfacd24/System.ServiceModel.Activation.ni.dll:600
7a468bc721c1d34e60389d3f2f87bbea:/media/whynot/New Volume/Windows/winsxs/x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_3502a036da3ba681/mshtml.dll:600
e9fe2a27361780efdcb0a37238e9bbdc:/media/whynot/New Volume/Program Files/Adobe/Acrobat 10.0/Acrobat/plug_ins/PaperCapture/drs832.dll:600
a6c27d877fe9622dabd15a15b45f089b:/media/whynot/New Volume/Windows/System32/atl71.dll:600
7d2fecac7bf1323b9e4c05f3f6edd0cb:/media/whynot/New Volume/Windows/System32/lsgc.dll:600
733c3098f01416fbf8fa1c7aadf5cd69:/media/whynot/New Volume/Windows/Installer/fd17a8.msp:600
bc9c0e8e585295451cafba171ddbb5ef:/media/whynot/New Volume/Windows/winsxs/x86_netfx-mscorwks_dll_b03f5f7f11d50a3a_6.1.7601.22740_none_efef673d052a727c/mscorwks.dll:600
3dfcbeee97df8bbaa749caacfc9c43e1:/media/whynot/New Volume/Windows/winsxs/x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.22280_none_6e71995b2bbf4e7d/ntkrnlpa.exe:600
45f3b385515ada09be218c3f4a160a41:/media/whynot/New Volume/Windows/assembly/NativeImages_v2.0.50727_32/Microsoft.Build.Eng#/935ff737d882f078e24cbf648b4b55ec/Microsoft.Build.Engine.ni.dll:600
...
...
...
...
.
..

I need a code under ubuntu to move this files all back to there own places.There are more than 3000 files.

wroom · 11-18-2015, 03:33 PM

I suggest you replace the QUOTE with CODE and then make a fresh cut & paste of the file you have listed.

Using CODE (see the posting rules) makes the file much more readable. And it looks like the file should be lines with:

Code:

<filehash>:<filepath>:<privilege>

Like:

Code:

57f8a50513e43aaf6a7b23389e389bbc:/media/whynot/New Volume/Windows/System32/pmspl.dll:600
926882f24fa982b60e9234ca47d3d8c9:/media/whynot/New Volume/Windows/System32/bdeadmin.cpl:600

But a bit down you have a line that seems to be:

Code:

/NativeImages_v2.0.50727_32/Microsoft.Build.Eng#/935ff737d882f078e24cbf648b4b55ec

This seem to be a combination of the QUOTE-tags wrapping the text, and a cut&paste error.

I think AWK is your friend here.
Take a look at this example:

For a file with hashes and filepaths made by hashdeep, that looks like this:

Code:

2019796,b6cc8b0de04d40adf11e05c755ce4cce,e6f314359ee87ad61a91ee75e3ee5e7ee729101d3ac34dbf0ecfb1457d180216,dir/ext/ory/file1.jpg
201,9bcd1a89ed68bd28ab14c233222feaed,e84735aa7358ae205ca4a3655b34f2226b60d79207536312f16b2e22076ff59e,dir/ext/ory2/file2.txt

...Where the fields are separated by commas, and are "filesize,md5-hash,sha256-hash,filenamepath".

The following bash command line filters out the filenamepath's from file 'tmpa1.lis' and puts them in the file 'tmpa1files.lis' :

Code:

cat tmpa1.lis | awk '{ gsub(/^[[:alnum:]]*,[[:alnum:]]*,[[:alnum:]]*,/,"",$0); print $0 }' > tmpa1files.lis

Like this:

Code:

dir/ext/ory/file1.jpg
dir/ext/ory2/file2.txt

What AWK actually does here, is to take one line at a time from 'tmpa1.lis', and remove the filesize and the hashes, including the separating commas, leaving only the filenamepath, which it writes to the output file 'tmpa1files.lis'.

The reason i have done it like that, is that the filenamepath's may contain commas, (','), which i want to preserve.
So, 'start of line' + 'some alphanumerics' + ',' + 'some alphanumerics' + ',' + 'some alphanumerics' + ',' is removed. And the rest is output, one line at a time.

I don't have the time now to adapt the concept for your case, but using AWK may be the simplest way to do what you ask for.
It is also possible to add quotes, ('"'), around the filenamepaths in the output file, merely by changing the "print $0" part of the AWK script.

syg00 · 11-18-2015, 04:17 PM

Code:

sed 's#^.*:/media/whynot#/windows/mountpoint#'

That will give you the target for a cp.
You should make an effort to solve the rest yourself.

Whynot · 11-18-2015, 06:26 PM

Quote:

Originally Posted by wroom

I suggest you replace the QUOTE with CODE and then make a fresh cut & paste of the file you have listed.

Using CODE (see the posting rules) makes the file much more readable. And it looks like the file should be lines with:

Code:

<filehash>:<filepath>:<privilege>

Like:

Code:

57f8a50513e43aaf6a7b23389e389bbc:/media/whynot/New Volume/Windows/System32/pmspl.dll:600
926882f24fa982b60e9234ca47d3d8c9:/media/whynot/New Volume/Windows/System32/bdeadmin.cpl:600

But a bit down you have a line that seems to be:

Code:

/NativeImages_v2.0.50727_32/Microsoft.Build.Eng#/935ff737d882f078e24cbf648b4b55ec

This seem to be a combination of the QUOTE-tags wrapping the text, and a cut&paste error.

I think AWK is your friend here.
Take a look at this example:

For a file with hashes and filepaths made by hashdeep, that looks like this:

Code:

2019796,b6cc8b0de04d40adf11e05c755ce4cce,e6f314359ee87ad61a91ee75e3ee5e7ee729101d3ac34dbf0ecfb1457d180216,dir/ext/ory/file1.jpg
201,9bcd1a89ed68bd28ab14c233222feaed,e84735aa7358ae205ca4a3655b34f2226b60d79207536312f16b2e22076ff59e,dir/ext/ory2/file2.txt

...Where the fields are separated by commas, and are "filesize,md5-hash,sha256-hash,filenamepath".

The following bash command line filters out the filenamepath's from file 'tmpa1.lis' and puts them in the file 'tmpa1files.lis' :

Code:

cat tmpa1.lis | awk '{ gsub(/^[[:alnum:]]*,[[:alnum:]]*,[[:alnum:]]*,/,"",$0); print $0 }' > tmpa1files.lis

Like this:

Code:

dir/ext/ory/file1.jpg
dir/ext/ory2/file2.txt

What AWK actually does here, is to take one line at a time from 'tmpa1.lis', and remove the filesize and the hashes, including the separating commas, leaving only the filenamepath, which it writes to the output file 'tmpa1files.lis'.

The reason i have done it like that, is that the filenamepath's may contain commas, (','), which i want to preserve.
So, 'start of line' + 'some alphanumerics' + ',' + 'some alphanumerics' + ',' + 'some alphanumerics' + ',' is removed. And the rest is output, one line at a time.

I don't have the time now to adapt the concept for your case, but using AWK may be the simplest way to do what you ask for.
It is also possible to add quotes, ('"'), around the filenamepaths in the output file, merely by changing the "print $0" part of the AWK script.

Sir it doesnt do anything

Code:

cat restore | awk '{ gsub(/^[[:alnum:]]*,[[:alnum:]]*,[[:alnum:]]*,/,"",$0); print $0 }' > restore_last

they have the same file size.

Quote:

Originally Posted by syg00

Code:

sed 's#^.*:/media/whynot#/windows/mountpoint#'

That will give you the target for a cp.
You should make an effort to solve the rest yourself.

Sorry but Im not good at command line commands .
Am I going to run some thing like this ?

Code:

cat restore | sed 's#^.*:/media/whynot#/windows/mountpoint#'

Thanks a lot

wroom · 11-18-2015, 08:13 PM

Quote:

Originally Posted by Whynot

Sir it doesnt do any thing

Code:

cat restore | awk '{ gsub(/^[[:alnum:]]*,[[:alnum:]]*,[[:alnum:]]*,/,"",$0); print $0 }' > restore_last

they have the same file size.

I am not surprised.

Read my post again, thoroughly, and you will find it does exactly what it is supposed to.
I adviced you to use AWK to filter out what you wanted from your input file.
I told you to do the actual work on adapting the AWK command for your own purpose.

Nobody will do the work for you, since this is not a "pro bono sweatshop for getting the hard work done".
I charge €100 per hour for doing such work, but you can probably find someone doing it for much less.
In fact, people being lazy with school work, or even worse, at the job, tend to take their difficult task to a forum like this one. They ask for "help" in doing their homework or their job task without ever getting paid. If you let someone else do your homework for you, then you will never learn anything.
That sort of behavior is kind of disliked in this forum. It is the lowest form of lazy. Sloth - One of the seven deadly sins.

We will gladly help you. But we will not do your work for you.

First thing you will have to do is changing the AWK script to start looking for colon, ':', as a delimiter, instead of a comma sign.

If you look at one line of your example input file:

Code:

410893564e40afe3ef3f9bda36e058bf:/media/whynot/New Volume/Program Files/VideoLAN/VLC/plugins/codec/libflac_plugin.dll:600

The line starts with an alphanumeric field "410893564e40afe3ef3f9bda36e058bf" containing letters and numbers. You match it with "[[:alnum:]]*". The '*' says to look for one or many alphanumerics, ("[[:alnum:]]").

Actually, the "regular expression" starts with a caret sign, '^', which is the code for "start of line".
So, "^[[:alnum:]]*" means to look for: Start of line, then one or many alphanumerics.

Next my script expects to find a comma. So "^[[:alnum:]]*," means to search for: Start of line, then letters and numbers, then a comma.

It continues to search for two more instances of "[[:alnum:]]*,".

So, when it sees a line starting with something like:

Code:

a1b2c3,111xxx,0987Ff,

...it will remove that from the line. Actually, it will in this case replace it with the empty string "" as you can see in the AWK script.

If the full line was:

Code:

a1b2c3,111xxx,0987Ff,/yes/i/know.dat

...it will remove the first three "[[:alnum:]]*," on the line.
Thus leaving the following output:

Code:

/yes/i/know.dat

But you have colons as delimiters instead of commas.
Try look for "^[[:alnum:]]*:" instead of "^[[:alnum:]]*,[[:alnum:]]*,[[:alnum:]]*,".

Did that help any?

The command used in the AWK script is gsub().
This is the command:

Code:

gsub(/^[[:alnum:]]*:/,"",$0);

What happens if you add another gsub command right after the first one that looks like this:

Code:

gsub(/:[[:alnum:]]*$/,"",$0);

?

It starts looking for a colon. Then some letters and/or numbers. Then we have the dollar sign, '$', last in the pattern to look for. The dollar sign means "end of line". So the pattern looks for a colon, then some alphanumerics, that is right at the end of line. It will replace this with an empty string, "", effectively removing it.

These gsub() commands are all working on a string named $0 which for AWK means "one full line".
AWK can also divide a line into fields, or columns, separated by a character like comma, colon, or whatever you like. The strings for each column from left to right is $1, $2, $3 and so on.
So why do we not use that, instead of searching for complex patterns?
It is because the field we are interested in, which in my application is comma separated from the other fields, but that it self can contain one or several commas in the file name. Simply splitting into fields with a comma separator would truncate a filename that contains the fully legitimate ','.

Are you with me so far?

Good info on how to use AWK, (and many other powerful unix/linux commands), is the grymoire, by Bruce Barnett.

http://www.grymoire.com/Unix/Awk.html

Good luck!

Whynot · 11-19-2015, 06:46 AM

Quote:

Originally Posted by wroom

I am not surprised.

Read my post again, thoroughly, and you will find it does exactly what it is supposed to.
I adviced you to use AWK to filter out what you wanted from your input file.
I told you to do the actual work on adapting the AWK command for your own purpose.

Nobody will do the work for you, since this is not a "pro bono sweatshop for getting the hard work done".
I charge 100 per hour for doing such work, but you can probably find someone doing it for much less.
In fact, people being lazy with school work, or even worse, at the job, tend to take their difficult task to a forum like this one. They ask for "help" in doing their homework or their job task without ever getting paid. If you let someone else do your homework for you, then you will never learn anything.
That sort of behavior is kind of disliked in this forum. It is the lowest form of lazy. Sloth - One of the seven deadly sins.

We will gladly help you. But we will not do your work for you.

First thing you will have to do is changing the AWK script to start looking for colon, ':', as a delimiter, instead of a comma sign.

If you look at one line of your example input file:

Code:

410893564e40afe3ef3f9bda36e058bf:/media/whynot/New Volume/Program Files/VideoLAN/VLC/plugins/codec/libflac_plugin.dll:600

The line starts with an alphanumeric field "410893564e40afe3ef3f9bda36e058bf" containing letters and numbers. You match it with "[[:alnum:]]*". The '*' says to look for one or many alphanumerics, ("[[:alnum:]]").

Actually, the "regular expression" starts with a caret sign, '^', which is the code for "start of line".
So, "^[[:alnum:]]*" means to look for: Start of line, then one or many alphanumerics.

Next my script expects to find a comma. So "^[[:alnum:]]*," means to search for: Start of line, then letters and numbers, then a comma.

It continues to search for two more instances of "[[:alnum:]]*,".

So, when it sees a line starting with something like:

Code:

a1b2c3,111xxx,0987Ff,

...it will remove that from the line. Actually, it will in this case replace it with the empty string "" as you can see in the AWK script.

If the full line was:

Code:

a1b2c3,111xxx,0987Ff,/yes/i/know.dat

...it will remove the first three "[[:alnum:]]*," on the line.
Thus leaving the following output:

Code:

/yes/i/know.dat

But you have colons as delimiters instead of commas.
Try look for "^[[:alnum:]]*:" instead of "^[[:alnum:]]*,[[:alnum:]]*,[[:alnum:]]*,".

Did that help any?

The command used in the AWK script is gsub().
This is the command:

Code:

gsub(/^[[:alnum:]]*:/,"",$0);

What happens if you add another gsub command right after the first one that looks like this:

Code:

gsub(/:[[:alnum:]]*$/,"",$0);

?

It starts looking for a colon. Then some letters and/or numbers. Then we have the dollar sign, '$', last in the pattern to look for. The dollar sign means "end of line". So the pattern looks for a colon, then some alphanumerics, that is right at the end of line. It will replace this with an empty string, "", effectively removing it.

These gsub() commands are all working on a string named $0 which for AWK means "one full line".
AWK can also divide a line into fields, or columns, separated by a character like comma, colon, or whatever you like. The strings for each column from left to right is $1, $2, $3 and so on.
So why do we not use that, instead of searching for complex patterns?
It is because the field we are interested in, which in my application is comma separated from the other fields, but that it self can contain one or several commas in the file name. Simply splitting into fields with a comma separator would truncate a filename that contains the fully legitimate ','.

Are you with me so far?

Good info on how to use AWK, (and many other powerful unix/linux commands), is the grymoire, by Bruce Barnett.

http://www.grymoire.com/Unix/Awk.html

Good luck!

Sir your are absulety correct.I apologize for my bad attitudes.I would like to add you in Youtube if you have a channel about this subjects.You are tremendous teacher.I have great respect.

I found this link https://regex101.com/#pcre . I think I better try some Regular Expressions here.Are they same as awk expression?

What about cut command

Code:

cat restore | cut -d : -f 2 > test
or
cut -d : -f 2 restore

Now Im geting

Code:

/media/whynot/New Volume/Program Files/VideoLAN/VLC/plugins/codec/libflac_plugin.dll
/media/whynot/New Volume/Windows/assembly/NativeImages_v2.0.50727_32/Microsoft.VisualStu#/7691014feecdf547ae21b2b5ffe22220/Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
/media/whynot/New Volume/Program Files/PC-BIB/BIB.DLL
/media/whynot/New Volume/Users/whynot/Desktop/Old Folders/4/z1/exe/z1wl.exe
/media/whynot/New Volume/Windows/Installer/$PatchCache$/Managed/00004109110000000000000000F01FEC/14.0.4763/SELFCERT.EXE
/media/whynot/New Volume/Windows/System32/pmspl.dll
/media/whynot/New Volume/Windows/System32/bdeadmin.cpl
/media/whynot/New Volume/Windows/assembly/NativeImages_v2.0.50727_32/System.Data.Entity.#/6d7f86d1da491f94fbf9bb8a47f2a101/System.Data.Entity.Design.ni.dll
/media/whynot/New Volume/Windows/System32/Macromed/Flash/FlashPlayerPlugin_19_0_0_226.exe
/media/whynot/New Volume/ProgramData/Microsoft/WLSetup/wltCE26.tmp
/media/whynot/New Volume/Program Files/UGS/UGII/licensing_tool.exe
/media/whynot/New Volume/Program Files/UGS/CATIAV5/pscatiav5/plmxmlAdapterJT60.dll
/media/whynot/New Volume/Windows/assembly/NativeImages_v4.0.30319_32/System.Serv14b62006#/45b996b5cfb9d0e388e31f10cdfacd24/System.ServiceModel.Activation.ni.dll
/media/whynot/New Volume/Windows/winsxs/x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_3502a036da3ba681/mshtml.dll
/media/whynot/New Volume/Program Files/Adobe/Acrobat 10.0/Acrobat/plug_ins/PaperCapture/drs832.dll
/media/whynot/New Volume/Windows/System32/atl71.dll
/media/whynot/New Volume/Windows/System32/lsgc.dll
/media/whynot/New Volume/Windows/Installer/fd17a8.msp
/media/whynot/New Volume/Windows/winsxs/x86_netfx-mscorwks_dll_b03f5f7f11d50a3a_6.1.7601.22740_none_efef673d052a727c/mscorwks.dll
/media/whynot/New Volume/Windows/winsxs/x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.22280_none_6e71995b2bbf4e7d/ntkrnlpa.exe
/media/whynot/New Volume/Windows/assembly/NativeImages_v2.0.50727_32/Microsoft.Build.Eng#/935ff737d882f078e24cbf648b4b55ec/Microsoft.Build.Engine.ni.dll

Thank you for your time and efforts.

wroom · 11-19-2015, 07:54 AM

Quote:

Originally Posted by Whynot

Sir your are absulety correct.I apologize for my bad attitudes.I would like to add you in Youtube if you have a channel about this subjects.You are tremendous teacher.I have great respect.

Thank you.

Quote:

Originally Posted by Whynot

I found this link https://regex101.com/#pcre . I think I better try some Regular Expressions here.Are they same as awk expression?

There are some different variants on regular expressions. One must verify that the application use the language variant the regular expression was written for.
Always read the manual, and make sure the installed application will do what is expected. Is the particular OS using 'nawk' or the plain vanilla, ancient, limited 'awk'? Should i use 'grep', or 'egrep' or 'fgrep'? Will 'grep' do the same on Solaris or BSD as on Linux?

Better make sure.

Quote:

Originally Posted by Whynot

What about cut command

Code:

cat restore | cut -d : -f 2 > test
or
cut -d : -f 2 restore

Great!

You have on your own found an even simpler solution to your problem than what i proposed.

Looking at your filelists i see that you handle files and directories on a Windows disk.
In Windows/NTFS a filename may not contain the following characters:

Code:

\ / : * ? " < > |

So your filenames will not contain any colon. Therefore you can use cut with colon as a separator.
Be aware that in Unix/Linux it is allowed to have colon in a filename.
The following is legal:

Code:

# touch abdcef\:0123
# ls
abdcef:0123

As long as you only handle filenames on an NTFS filesystem you are fine with using cut.

Otherwise you may need a more complex solution. Like the one i proposed.

Habitual · 11-19-2015, 08:51 AM

Open clamtk and hit Ctrl+M
and restore the files from clamtk.

Emerson · 11-19-2015, 09:19 AM

If these files are infected, what's the point restoring them?

Whynot · 11-19-2015, 09:37 AM

Quote:

Originally Posted by Emerson

If these files are infected, what's the point restoring them?

I know but my windows system doesnt boot so I thought better I handle it under windows.

Quote:

Originally Posted by Habitual

Open clamtk and hit Ctrl+M
and restore the files from clamtk.

I copied some of them back to there placeses but Im going to tried it.

Thanks.

Habitual · 11-19-2015, 12:37 PM

Quote:

Originally Posted by Emerson

If these files are infected, what's the point restoring them?

I suspect he scanned with PUA enabled, Got alarmed and quarantined them.
They may not be infected.
virustotal.com would be my next recourse for suspect files.

surely. VideoLAN (VLC) for Windows is an infection?

Whynot · 11-19-2015, 06:31 PM

Quote:

Originally Posted by Habitual

I suspect he scanned with PUA enabled, Got alarmed and quarantined them.
They may not be infected.
virustotal.com would be my next recourse for suspect files.

surely. VideoLAN (VLC) for Windows is an infection?

No that file is not infected i just checked with virustotal but I think most of them are infected files.

Quote:

Originally Posted by Whynot

Originally Posted by Habitual View Post
Open clamtk and hit Ctrl+M
and restore the files from clamtk.

With clamtk there is about 3000 files and I have to restore them one by one

Now I have all files with path I need to move this files from local drive but I have to take file names with file extensions
I can't go farther.
test file content

Code:

/media/whynot/New\ Volume/Program\ Files/VideoLAN/VLC/plugins/codec/libflac_plugin.dll
/media/whynot/New\ Volume/Windows/assembly/NativeImages_v2.0.50727_32/Microsoft.VisualStu#/7691014feecdf547ae21b2b5ffe22220/Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
/media/whynot/New\ Volume/Program\ Files/PC-BIB/BIB.DLL
/media/whynot/New\ Volume/Users/whynot/Desktop/Old Folders/4/z1/exe/z1wl.exe
/media/whynot/New\ Volume/Windows/Installer/$PatchCache$/Managed/00004109110000000000000000F01FEC/14.0.4763/SELFCERT.EXE
/media/whynot/New\ Volume/Windows/System32/pmspl.dll
/media/whynot/New\ Volume/Windows/System32/bdeadmin.cpl
/media/whynot/New\ Volume/Windows/assembly/NativeImages_v2.0.50727_32/System.Data.Entity.#/6d7f86d1da491f94fbf9bb8a47f2a101/System.Data.Entity.Design.ni.dll
/media/whynot/New\ Volume/Windows/System32/Macromed/Flash/FlashPlayerPlugin_19_0_0_226.exe
/media/whynot/New\ Volume/ProgramData/Microsoft/WLSetup/wltCE26.tmp
/media/whynot/New\ Volume/Program\ Files/UGS/UGII/licensing_tool.exe
/media/whynot/New\ Volume/Program\ Files/UGS/CATIAV5/pscatiav5/plmxmlAdapterJT60.dll
/media/whynot/New\ Volume/Windows/assembly/NativeImages_v4.0.30319_32/System.Serv14b62006#/45b996b5cfb9d0e388e31f10cdfacd24/System.ServiceModel.Activation.ni.dll
/media/whynot/New\ Volume/Windows/winsxs/x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_3502a036da3ba681/mshtml.dll
/media/whynot/New\ Volume/Program\ Files/Adobe/Acrobat\ 10.0/Acrobat/plug_ins/PaperCapture/drs832.dll
/media/whynot/New\ Volume/Windows/System32/atl71.dll
/media/whynot/New\ Volume/Windows/System32/lsgc.dll
/media/whynot/New\ Volume/Windows/Installer/fd17a8.msp
/media/whynot/New\ Volume/Windows/winsxs/x86_netfx-mscorwks_dll_b03f5f7f11d50a3a_6.1.7601.22740_none_efef673d052a727c/mscorwks.dll
/media/whynot/New\ Volume/Windows/winsxs/x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.22280_none_6e71995b2bbf4e7d/ntkrnlpa.exe
/media/whynot/New\ Volume/Windows/assembly/NativeImages_v2.0.50727_32/Microsoft.Build.Eng#/935ff737d882f078e24cbf648b4b55ec/Microsoft.Build.Engine.ni.dll

I stuck here.

Code:

whynot@whynot-System-Product-Name:~/.clamtk/viruses$ while read line; do mv "$line"; done < test

It has to be something like this.
mv file "$line"
I would greatly appreciate any help
Thanks.

wroom · 11-19-2015, 07:44 PM

Quote:

Originally Posted by Whynot

With clamtk there is about 3000 files and I have to restore them one by one

Quote:

Originally Posted by Whynot

Now I have all files with path I need to move this files from local drive but I have to take file names with file extensions
I can't go farther.

What about using tar?

Example (run as root):

Code:

cd ~/.clamtk/viruses
tar --one-file-system --atime-preserve -cv -T ~/list-of-cleanfiles.lis -f ~/noviruses.tar
cd /media/whynot/New\ Volume
tar -x -f ~/noviruses.tar

This will make a tar file with only the files listed in the file "~/list-of-cleanfiles.lis".

It will not store any directories in the archive, unless they are explicitly stated on it's own line in the list file. This is good, since you do not want to clobber the directories you restore to.

It will preserve the path in the file list.

The file list must use relative paths, so the tar archive is created with relative paths.
Your file list has absolute paths. Maybe you can use 'cut' to remove the leading "/media/whynot/New Volume/" from every line in the list?

When you 'cd' to the root directory of the volume you want to restore to, and issue the tar restore command, the files will be restored relative to that directory, "/media/whynot/New\ Volume".

Tar will create the necessary directories in the path of the files restored if they do not exist.
If the directories exist, tar will just add the files into the existing directories.
Directories created by tar, (if necessary), will inherit owner/priv from its parent directory when created.

You can list the contents of the tar file before restoring using:

Code:

tar -t -f ~/noviruses.tar

Please note that this method will preserve privileges/ownership of the files.
I mention this because the original virus list had a privileges column to the right.
I guess it doesn't matter much, since ownerchip probably will be clobbered by the method you have mounted the NTFS filesystem in Linux. This can be tricky to get right. Have you made a backup of the volume you will restore to?
You will probably have to check the privileges/ownership of these restored files when running the Windows volume again.

It is of course possible to just copy over the tar file to the NTFS, and then boot the Windows system up, and use WinRAR to restore the files from the tar file to the correct destinations.

Using tar to copy/(move) the files like the above will also at the same time give you an archive file of the restored files.

Quote:

Originally Posted by Whynot

I stuck here.

Well, maybe not anymore.

Quote:

Originally Posted by Whynot

Code:

whynot@whynot-System-Product-Name:~/.clamtk/viruses$ while read line; do mv "$line"; done < test

It has to be something like this.
mv file "$line"
I would greatly appreciate any help
Thanks.

One alternative way to do the copy/move would be to use SED or AWK to reformat every line of the file list to a copy/move command, like "cp <sourceFilePath> <destinationFilePath>" with a nifty print command - Thus making a bash script file that you can source.

But using tar is probably both safer and easier.

syg00 · 11-19-2015, 07:45 PM

Now you're getting somewhere - but you need both the source file location (as in your first post, but the full pathname) as well as your destination.
Looking at where you're going with this (trimming the path, escaping the blanks then constructing a command), I'd be using something like awk. That way you can do the lot on each line without having to read the file multiple times or use more than one tool. Using you initial file list, try this - it'll generate stdout you can redirect to a file. Have a look and make sure it is ok, then simply "source" it to run the mv's.

Code:

awk '{gsub(/ /, "\\ ") ; split($0,fname,":") ; print "mv "$0,fname[2]}' movem.txt

Note: this assumes the colon is a valid separator, and you want all blanks escaped.