I often use a Linux LiveCD (or Puppy on a pen drive) to disinfect Windows machines that are infested with various malware. However, once the malware is gone, you still need to deal with the modifications it might have made, and sadly Linux isn't so great for that.
The recent crop of FakeAV programs try to freak the user out by making everything disappear - they set the "Don't show hidden or system files" option (and protect it with a Group Policy), and then they set the hidden/system attributes on every file in Documents and Settings\UserName.
What I'd like - but haven't found - is a Linux tool to reset those attributes. I suppose if I ran Samba, and shared the NTFS volume, and set my options correctly, I could probably do this from a DOS or Windows client... but that's a real pain, and anyway I'm not so sure about sharing an NTFS volume via Samba. Any way to do it directly?
OK - sounds like setfattr(1) is what I need; however, it looks to me like I'd be setting a value bitmap directly, rather than applying a mask. Am I understanding that correctly - and if so, what (if anything) could I do to implement a mask?
In other words, some files might legitimately be Read-Only; some might have the Archive bit set. How do I only unset Hidden or System, without touching the others - like attrib -s -h at the Windows command line? If the only way to do it is to getfattr first, and then decide which parameters to pass to setfattr... well, I would hope not.