Deleting a file if exists or another file if exists

Content Authoring
1

I am trying to use the if statement to see if a file exists two different file names. I check with the debugger and all statements return that the action completed successfully. Running the action against a server that has one of the files fails. Below is the action. I am not sure where the failure is taking place as the action fails but reviewing the failure all actions completed. Thank for any help.

// Enter your action script here
action uses wow64 redirection false
if {exists “C:\windows\system32\mrt-kb890830.exe”}
delete "C:\windows\system32\MRT-KB890830.exe"
else
if {exists “c:\windows\system32\mrt.exe”}
delete "C:\windows\system32\mrt.exe"
endif

2

Are the two files mutually exclusive?

If both exist then mrt-kb890830.exe will be removed and mrt.exe will survive.

3

One or the other is what I found so far.

4

aha - if {exists “C:\windows\system32\mrt-kb890830.exe”}

it will always exist - you are checking the string, not looking for a file of that name

2 Likes
5

This qualys scan keeps finding the Microsoft Malicious Software Removal Tool to be update and we do not use it so we want it deleted from all servers.

6

Just thought the same, try

action uses wow64 redirection false
if {exists files "C:\windows\system32\mrt-kb890830.exe"}
delete "C:\windows\system32\MRT-KB890830.exe"
else if {exists files "c:\windows\system32\mrt.exe"}
delete "C:\windows\system32\mrt.exe"
endif
2 Likes
7

The ‘action uses wow64 redirection false’ I think only applies to the spawned processes and commands, the actual relevance substitutions still need to handle the redirection. So I think we should use ‘native files’ rather than ‘files’ inspectors…

action uses wow64 redirection false
if {exists native files "C:\windows\system32\mrt-kb890830.exe"}
delete "C:\windows\system32\MRT-KB890830.exe"
else if {exists native files "c:\windows\system32\mrt.exe"}
delete "C:\windows\system32\mrt.exe"
endif

But I’m still unsure whey we only want to delete one or the other, if you really want it gone, just delete them; the ‘delete’ statement will silently succeed if the file you want to delete is not present

action uses wow64 redirection false
delete "C:\windows\system32\MRT-KB890830.exe"
delete "C:\windows\system32\mrt.exe"
1 Like
8

This actually deletes the MRT-KB890830 but will come back as failed and so will the the other statement.
I had tried the second previously and found it did work but comes back as failed

9

The Fixlet Relevance is usually what’s used to determine whether it was Failed or Fixed. What’s the Relevance you’re using for this fixlet?

10

If you just want to get rid of either/both of those files, you don’t need to check for their existence - the delete fails silently if the file doesn’t exist

So you just need relevance to check for either of the files

exists files ("mrt-kb890830.exe"; "mrt.exe") of native system folder

1 Like
11

Well the issue was that I did not have my Relevance checking after the delete of the files. Completely skipped that step. Thank Jason and Trn.

1 Like