Deleting multiple files in one directory

roberteastman 2021-09-02 13:04:30 UTC #1

I have a need to delete multiple files out of the system 32 directory. We had an instance where someone created a baseline which included the Malicious Software Removal Tool. I used the uninstall fixlet to remove it but it has some remaining files that Qualys is picking up. I have the following “piece meal” script but no files are being removed. Reviewing post in here have led me down many rabbit holes with nothing working.

// Delete the left over remaining MSRT files in the %windir%\system32 directory
//mrt.exe, mrt_map.dll, MRT-KB890830.exe & mrt100.dll files
//action uses wow64 redirection false

action uses wow64 redirection false

createfile until eof
{(“del %22” & pathname of it & “%22 /q%0a”) of files whose (name of it contains “mrt*.*”) of folder “C:\windows\system32”}
eof

delete delfiles.cmd
copy __createfile delfiles.cmd
waithidden delfiles.cmd

trn 2021-09-02 14:58:02 UTC #2

Your wildcard is in command line format, not relevance.

You then need to concatenate the results with cr/lf to create a correctly formatted batch file

action uses wow64 redirection {not x64 of operating system}

delete __createfile

createfile until eof
{concatenation "%0d%0a" of ("del %22" & pathname of it & "%22 /q") of files whose (name of it as lowercase starts with "mrt") of native system folder}
eof

delete delfiles.cmd
copy __createfile delfiles.cmd
waithidden delfiles.cmd

With a small, known set of target files you could also consider

action uses wow64 redirection {not x64 of operating system}

delete __appendfile
if {exists file "mrt.exe" of native system folder}
	appendfile del /q "{pathname of file "mrt.exe" of native system folder}"
endif
if {exists file "mrt_map.dll" of native system folder}
	appendfile del /q "{pathname of file "mrt_map.dll" of native system folder}"
endif
if {exists file "MRT-KB890830.exe" of native system folder}
	appendfile del /q "{pathname of file "MRT-KB890830.exe" of native system folder}"
endif
if {exists file "mrt100.dll" of native system folder}
	appendfile del /q "{pathname of file "mrt100.dll" of native system folder}"
endif
delete delfiles.cmd
copy __createfile delfiles.cmd
waithidden delfiles.cmd

which would avoid deletion of an unexpected “mrt*” file

or even

action uses wow64 redirection {not x64 of operating system}
if {exists file "mrt.exe" of native system folder}
	delete "{pathname of file "mrt.exe" of native system folder}"
endif
if {exists file "mrt_map.dll" of native system folder}
	delete "{pathname of file "mrt_map.dll" of native system folder}"
endif
if {exists file "MRT-KB890830.exe" of native system folder}
	delete "{pathname of file "MRT-KB890830.exe" of native system folder}"
endif
if {exists file "mrt100.dll" of native system folder}
	delete "{pathname of file "mrt100.dll" of native system folder}"
endif

which dodges the batch file completely

FDA 2021-09-02 15:06:23 UTC #3

Also consider that multiple file object, that cannot be passed to the actionscript delete command. You need to delete each file if multiple are returned. You may want to test the content of your directory using the Qna fixlet debugger as shown in the following example

Q:names of files whose (name of it contains “Sha1”)of folder "c:\TEM"
A: Sha1.exe

roberteastman 2021-09-02 16:14:08 UTC #4

The first script will delete the two mrt*.exe files but the two dll’s are not deleted.

The second suggestion of deleting all of the files by name deletes the two exe files only
The third suggestion does not delete any of the files. I have looked over the script and i do not find any issue with it.

roberteastman 2021-09-02 17:19:29 UTC #5

The two .dll files are in use so that is why they will not delete. And looking into it further they do not belong to the Microsoft Malicious Software Removal tool!

Thank you for your help