Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I often use a Linux LiveCD (or Puppy on a pen drive) to disinfect Windows machines that are infested with various malware. However, once the malware is gone, you still need to deal with the modifications it might have made, and sadly Linux isn't so great for that.

The recent crop of FakeAV programs try to freak the user out by making everything disappear - they set the "Don't show hidden or system files" option (and protect it with a Group Policy), and then they set the hidden/system attributes on every file in Documents and Settings\UserName.

What I'd like - but haven't found - is a Linux tool to reset those attributes. I suppose if I ran Samba, and shared the NTFS volume, and set my options correctly, I could probably do this from a DOS or Windows client... but that's a real pain, and anyway I'm not so sure about sharing an NTFS volume via Samba. Any way to do it directly?

OK - sounds like setfattr(1) is what I need; however, it looks to me like I'd be setting a value bitmap directly, rather than applying a mask. Am I understanding that correctly - and if so, what (if anything) could I do to implement a mask?
In other words, some files might legitimately be Read-Only; some might have the Archive bit set. How do I only unset Hidden or System, without touching the others - like attrib -s -h at the Windows command line? If the only way to do it is to getfattr first, and then decide which parameters to pass to setfattr... well, I would hope not.

share|improve this question
So it might be my security centered frame of mind... but the words "disinfect" and "infested" make me want to immediately state "wipe and reinstall/reimage". – Goblinlord Mar 18 '15 at 2:36

NTFS-3G includes the setfattr command:

setfattr -h -v 0x00000000 -n system.ntfs_attrib_be target-file

should clear all attributes (the last argument target-file should be changed, of course.) See here for a list of available attributes and how to set them.

share|improve this answer
The link no longer works – Vineet Menon Oct 31 '15 at 14:17

setfattr probably works for NTFS file systems, but in case someone needs to do the same for FAT (vfat/fat16/fat32) file systems, see mtools package. That will do the job!

share|improve this answer

If you're mounting the filesystem with a suitably recent version of NTFS-3G, you can use getfattr and setfattr to access those attributes.

share|improve this answer

Try my shell script, which is a (mostly) re-implementation of attrib command in Windows.

This uses system.ntfs_attrib_be attribute from NTFS-3G, so you need gatfattr and setfattr utilities from your distro (in Debian/Ubuntu: sudo apt-get install attr).

But after that, just use it without remembering the bit masks, e.g.

./ -h -s some_file_in_ntfs_volume


/L option in attrib in Windows is implemented here, see the help in script for details.

/S and /S /D are (intentionally) not implemented. Try find(1) with this script instead.

share|improve this answer
I'm not in a place where I can test it at the moment, but this sounds like EXACTLY what I had in mind. Upvoting now, will accept as soon as I've tested it. Thanks! ( – MT_Head Mar 18 '15 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .