Qt-interest Archive, May 2008
Set Windows file attributes from a Qt4 app
Message 1 in thread
Hi all,
I'm trying to develop a small QCoreApplication tool intended to remove
some files from a few Windows boxes here in our organization. This has
to do with a common but very annoying trojan, and I've found some
recipes on how to do it manually and it solves the issue just well.
But it becomes really tedious as I find the systems "reinfected" in a
few days (even hours), so I want to try to do it programmatically,
possibly from a scheduled task and at boot time.
I'm stuck in the point where I need to programmatically set/remove
windows file attributes (system/hidden), since this trojan hides
himself from casual users this way (along other tricks in windows
registry). What I need to do is the exact equivalent of the command:
X:\attrib -S -H -R thefile
but be able to react to a failed attemp.
I've thought of a possible solution by relying on QProcess starting
the attrib program externally, but didn't even tried, as it looks to
me like a cheap trick.
I've seen the QFile documentation and noticed that apparently there's
no way to do this directly from Qt4. What I (wrongly) expected to find
is an additional QFlag in QFile::Permissions or just other functions
similar to QFile::setPermissions() (maybe not a great idea, though)
Does anyone knows how I can address this?
Thanks in advance for any help!
--
[ signature omitted ]
Message 2 in thread
Diego Schulz schrieb:
> Hi all,
>
> I'm trying to develop a small QCoreApplication tool intended to remove
> some files from a few Windows boxes here in our organization. This has
> to do with a common but very annoying trojan, and I've found some
> recipes on how to do it manually and it solves the issue just well.
> But it becomes really tedious as I find the systems "reinfected" in a
> few days (even hours), so I want to try to do it programmatically,
> possibly from a scheduled task and at boot time.
>
> I'm stuck in the point where I need to programmatically set/remove
> windows file attributes (system/hidden), since this trojan hides
> himself from casual users this way (along other tricks in windows
> registry). What I need to do is the exact equivalent of the command:
>
> X:\attrib -S -H -R thefile
>
> but be able to react to a failed attemp.
>
> I've thought of a possible solution by relying on QProcess starting
> the attrib program externally, but didn't even tried, as it looks to
> me like a cheap trick.
> I've seen the QFile documentation and noticed that apparently there's
> no way to do this directly from Qt4. What I (wrongly) expected to find
> is an additional QFlag in QFile::Permissions or just other functions
> similar to QFile::setPermissions() (maybe not a great idea, though)
>
> Does anyone knows how I can address this?
>
The only way is through WinAPI (SetFileAttributes). But shouldn't be
that hard.
Christian
--
[ signature omitted ]
Message 3 in thread
On Sat, May 24, 2008 at 2:59 AM, Christian Ehrlicher
<Ch.Ehrlicher@xxxxxx> wrote:
> Diego Schulz schrieb:
>>
>> Hi all,
>>
>> I'm trying to develop a small QCoreApplication tool intended to remove
>> some files from a few Windows boxes here in our organization. This has
>> to do with a common but very annoying trojan, and I've found some
>> recipes on how to do it manually and it solves the issue just well.
>> But it becomes really tedious as I find the systems "reinfected" in a
>> few days (even hours), so I want to try to do it programmatically,
>> possibly from a scheduled task and at boot time.
>>
>> I'm stuck in the point where I need to programmatically set/remove
>> windows file attributes (system/hidden), since this trojan hides
>> himself from casual users this way (along other tricks in windows
>> registry). What I need to do is the exact equivalent of the command:
>>
>> X:\attrib -S -H -R thefile
>>
>> but be able to react to a failed attemp.
>>
>> I've thought of a possible solution by relying on QProcess starting
>> the attrib program externally, but didn't even tried, as it looks to
>> me like a cheap trick.
>> I've seen the QFile documentation and noticed that apparently there's
>> no way to do this directly from Qt4. What I (wrongly) expected to find
>> is an additional QFlag in QFile::Permissions or just other functions
>> similar to QFile::setPermissions() (maybe not a great idea, though)
>>
>> Does anyone knows how I can address this?
>>
> The only way is through WinAPI (SetFileAttributes). But shouldn't be that
> hard.
>
>
> Christian
>
Thanks Christian. I've found the documentation on SetFileAttributes.
The only magic trick remaining will be to abstract this WinApi
specific operation in a convenient function. I'll do the pertinent
research, first in QFile's sources.
BTW, I never had the need to use Windows specific routines thus far,
so I can't predict how this will end :)
Thanks again, Christian
--
[ signature omitted ]
