Not sure why relevance isn't working

Content Authoring
1

(imported topic written by flayofish91)

Hello,

I am trying to leverage BigFix to help mitigate some of our virus and malware issues. I created a fixlet with a simple task, to delete crss.exe from C:\windows folder.

Here is how I created the fixlet:

In Console, went to “My Custom Fixlet Messages”, right-clicked and created new fixlet.

On the Relevance tab, I selected “Computers which match the condition below”.

On the dropdown menus:

Relevance Expression, is true, Edit Relevance…

On the “Edit Relevance…” I entered: exists file “crss.exe” of folder “c:\windows”

On the Actions tab, I set the default action to: delete “c:\windows\crss.exe” /F /Q

I then opened new notepad, put in some letters, then saved it as crss.exe and placed it in the c:\windows folder of my PC. It showed up as relevant, no problem.

When we changed the names of some .exe’s to crss.exe and saved them to the c:\windows folder on several test machines, none of them show relevant.

Any help with this is greatly appreciated.

-thanks

EDIT: Running Big Fix version: 7.2.5.22 if that helps.

2

(imported comment written by NoahSalzman)

Some troubleshooting to try:

  1. What does

files whose (name of it contains “exe”) of folder “c:\windows”

return?

  1. Are these x64 machines? Try “x64 folder” in instead of “folder” in your Relevance.

  2. Install the Fixlet debugger on a suspect machine and play with the Relevance there… you get much faster iterations on fixing the Relevance

3

(imported comment written by flayofish91)

Thank you for the response.

  1. I created another variant of the fixlet with relevance: exists file “c:\windows\crss.exe”

It only shows the same single PC out of the 8 test machines.

  1. The file is located on the root of C:\windows From a folder structure standpoint, this remains the same regardless of being x64 or x86 architechture. Interestingly the one machine reporting properly is x64 windows 7 and the other test boxes are x86 Windows XP machines. Is there really a difference where bigfix is concerned? If so, how should the code look?

  2. I have not tried this step yet. I’ll test it and report findings.

-thanks

4

(imported comment written by NoahSalzman)

This might be a silly question, but is “c:” the correct drive? It’s better to use “windows folder” instead of “c:\windows”. Example:

exists file “crss.exe” of windows folder

5

(imported comment written by flayofish91)

Tried the relevance debugger against a target PC that is not reporting relevance for this fixlet and the return is “true”.

Went back to the console and ran refresh against target PC, still not showing up as relevant.

Edit: same results for suggested exists file “crss.exe” of windows folder

6

(imported comment written by flayofish91)

Issue resolved. Thank you for helping!