Shell script to automatically delete files with the same name as the parent directory

pratap.iisc · 10-09-2009, 08:54 PM

Hi aall,
I am facing a problem in Windows due to a virus called Newfolder.exe which creats files with the same name as it's parent directory and an extension .exe and this happens for every directory in the entire hierarchy in the infected pen drive. The antivirus detects them, but is sucking slow. So I thought this is a good opportunity to use the concepts of the all mighty shell script to remove those as they follow the same pattern.
Can anybody help me in writing the script?
Let me just give an example.

Say my complete path is

Code:

/home/pkd/fol1/

The virus would have created an file with complete paths

Quote:

/home/pkd/fol1.exe

If fol1 has two more directories fol11 and fol12
Then there would be two more .exe(virus created) in the following path

Quote:

/home/pkd/fol11/fol11.exe
/home/pkd/fol12/fol12.exe

Waiting for some useful suggestions.
Thanks in advance.
-pratap

nadroj · 10-09-2009, 09:07 PM

heres some pseudocode for this:

Code:

- set initial/starting path (i.e. "/home/pkd/" in your example)
- for each directory, "dir", in starting directory (and recursively): 
  - delete the file with name dir.exe (you already know the initial/starting directory, and the file to delete, "dir", so just append ".exe" to it)

you can use "ls" to list only directories, and you can also have it do list recursively. the "rm" command can be used to delete the file. you may want to include a simple check before the delete, to make sure youre deleting a file that actually exists (otherwise youll get error messages when you run the script, which is probably fine if you dont care about that).

i dont think you mentioned which scripting language, but just pick any one you are comfortable with (and that you have available, of course). the general idea is the same for any one you choose.

i imagine youre doing this on a "production" machine, i.e. one with important data. if this is the case then make sure to manually follow the flow of the code you write, in order to make sure it is "bug-free", otherwise very bad things will happen (you loose important files you didnt think it would delete).

pratap.iisc · 10-09-2009, 11:43 PM

Hi,
after some trial I have come up with a working code.

But I would appreciate any other suggestion too and feedback on this code.

Quote:

mkdir -p /tmp/affected/; find -type d | cat | while read LINE; do k=`echo "$LINE"| sed 's/.*\///g'` ; j="$LINE""/""$k"".exe"; mv "$j" /tmp/affected/.; done;

Regards,
Pratap

smeezekitty · 10-10-2009, 12:05 AM

whats the | cat | for

vonbiber · 10-10-2009, 02:03 AM

If I understand correctly you want to remove all the
foo.exe under a certain directory (/home/pkd/foll) if the
directory above has the same name (minus the extension).
In which case, the following script would do the job
(adjust the variable TOP to your actual top directory).
If some of your directories or files have spaces or
spurrious characters use double quotes ("$f" instead of $f).

Code:

#!/bin/sh

TOP=/home/pkd/foll

find $TOP/* | while read f
do
        if [ -d $f ]; then
                name=${$f##*/}
                if [ -e $f/$name.exe ]; then
                        rm -f $f/$name.exe
                fi
        fi
done

this script recurses thru the entire tree under the
top directory and every time it finds a directory it
checks the presence of a file that has the same name
as the base directory and an 'exe' extension. If it finds
any it removes it.

pratap.iisc · 10-11-2009, 01:47 AM

Quote:

Originally Posted by smeezekitty

whats the | cat | for

Oh yes...That's not required.
Thanks for pointing that out.

pratap.iisc · 10-11-2009, 01:55 AM

Quote:

Originally Posted by vonbiber

If I understand correctly you want to remove all the
foo.exe under a certain directory (/home/pkd/foll) if the
directory above has the same name (minus the extension).
In which case, the following script would do the job
(adjust the variable TOP to your actual top directory).
If some of your directories or files have spaces or
spurrious characters use double quotes ("$f" instead of $f).

Code:

#!/bin/sh

TOP=/home/pkd/foll

find $TOP/* | while read f
do
        if [ -d $f ]; then
                name=${$f##*/}
                if [ -e $f/$name.exe ]; then
                        rm -f $f/$name.exe
                fi
        fi
done

this script recurses thru the entire tree under the
top directory and every time it finds a directory it
checks the presence of a file that has the same name
as the base directory and an 'exe' extension. If it finds
any it removes it.

Hi vonbiber,
I am getting the following error if I run the code with the suggested modifications.

Quote:

line 8: ${$f##*/}: bad substitution

Do I need to make any further change?

lutusp · 10-11-2009, 02:03 AM

Quote:

Originally Posted by pratap.iisc

Hi vonbiber,
I am getting the following error if I run the code with the suggested modifications.

Do I need to make any further change?

The previous poster made a mistake. This line:

Code:

name=${$f##*/}

Should look like this:

Code:

name=${f##*/}

I won't vouch for the prior poster's script, which I haven't read. But this error is obvious. I wish people would test the code they post.

catkin · 10-11-2009, 02:53 AM

The looping code can be speeded up a little by using find's -d option (as already done in the one liner) and made robust in the case of directory names containing spaces by adding double quotes

Code:

#!/bin/sh

TOP=/home/pkd/foll

find $TOP/* -type d | while read dir
do
    name="${dir##*/}"
    if [ -e "$dir/$name.exe" ]; then
        rm -f "$dir/$name.exe"
    fi
done

vonbiber · 10-12-2009, 10:17 AM

Quote:

Originally Posted by pratap.iisc

Hi vonbiber,
I am getting the following error if I run the code with the suggested modifications.

Do I need to make any further change?

sorry about that
yeah the line

Code:

                name=${$f##*/}

should have read

Code:

                name=${f##*/}