Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

recently I found back door on my laptop. I t was generating many files with random names only 2-3 characters only. The most of them is empty. How can I find files only with 1 to 3 characters generated in the last 30 days? Thanks Arman.

share|improve this question

migrated from serverfault.com May 16 '10 at 15:48

This question came from our site for professional system and network administrators.

4 Answers 4

up vote 7 down vote accepted

Use the search facility in Windows Explorer and use the '?' wildcard character.

Search for files names matching ?, ?? and ???. If the files have extensions, try ?.*, ??.* and ???.*.

You can also specify the created date.

If your laptop has/had a backdoor, you really should be less concerned with the files on the system and more concerned with reinstalling your laptop, as it is the only sure way to close the back door and remove any root kits.

share|improve this answer
    
+1 nuke it from orbit. It's the only way to be sure. Don't expect anti-virus software to reliably remove all today's huge range of stealthy malware. 'Cos it won't. It'll just give you a nice false sense of security. –  bobince May 16 '10 at 12:42
    
@Bryan: the method '??' does not find the files. but I can see in the windows/system32/ file named: 'hÏ'. –  Arman May 16 '10 at 13:30
    
@Bryan: Well the double quotes "??" are solving the problem. Maybe it depends on locals? I am using the French WinXP. –  Arman May 16 '10 at 13:32
    
@bobince: Yes, I agree with the clean install, but it is not always possible to reinstall all packages. –  Arman May 16 '10 at 13:34
    
@Arman: Sorry, I didn't explain that very well, don't use any quotes as part of your search string. I've removed them from my answer and used highlighting instead. –  Bryan May 16 '10 at 14:04

I think that this would work:

C:\>dir /s/b ???
share|improve this answer

It's probably easier to find empty files generated in the last 30 days.

Go to Start menu - Search

Click When was it modified select Past month or manually pick the dates.

Click What size is it select Specify size at most 1KB

share|improve this answer

Using Powershell:

$date = get-date

$olddate = $date.adddays(-30)

get-childitem -path c:\ -Recurse | where-object {$_.basename.length -lt "4" -and $_.creationtime -gt $olddate}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.