Read the properties of all lnk files found on disk

[antmar904]

Hi.

I am trying to find a way to read the properties of all link files found on the specified drive letter provided when running the script.  Ultimately if the lnk file "Arguments" contain a special string I would like to delete the lnk file and log it to a log file.  I'm stuck on the looking for a way to loop through all the lnk files found.

#include <Array.au3>
#include <File.au3>

Find()

Func Find()

    Local $LogFile = @ScriptDir & "\Outputfile.txt", $hFileOpen = FileOpen($LogFile, 9)

    If $CmdLine[0] = 0 Then
        FileWriteLine($LogFile, "No directory specified.  You need to specifiy a directory like C:\, D:\, E:\")
        FileClose($hFileOpen)
        Exit
    EndIf

    Local $aArray = _FileListToArrayRec($CmdLine[1], "*.lnk", $FLTAR_FILES, $FLTAR_RECUR, $FLTAR_SORT, $FLTAR_FULLPATH)
    
    ;Debug
    _ArrayDisplay($aArray, "")
    
    ;Loop through lnk files, search for string "/bad.exe" located in the "Arguments" propertie of the lnk file and write it to a log file.
    For $i to UBound($aArray) -1
        

EndFunc

 

Edited March 5, 2021 by antmar904

[antmar904]

I think I got it working:

#include <Array.au3>
#include <File.au3>

Find()

Func Find()

    Local $LogFile = @ScriptDir & "\Outputfile.txt", $hFileOpen = FileOpen($LogFile, 9)

    If $CmdLine[0] = 0 Then
        FileWriteLine($LogFile, "No directory specified.  You need to specifiy a directory like C:\, D:\, E:\")
        FileClose($hFileOpen)
        Exit
    EndIf

    Local $Files = _FileListToArrayRec($CmdLine[1], "*.lnk", $FLTAR_FILES, $FLTAR_RECUR, $FLTAR_SORT, $FLTAR_FULLPATH)
    If @error Then
        MsgBox(0, "", @error & @extended & $CmdLine[1])
        Exit
    EndIf

    ;Debug
    ;_ArrayDisplay($Files, "")

    ;Loop through lnk files, search for string "/bad.exe" located in the "Arguments" propertie of the lnk file and write it to a log file.
    For $i = 0 to UBound($Files) -1
        Local $FileDetails = FileGetShortcut($files[$i])
            If Not @error Then
                FileWriteLine($hFileOpen, $files[$i] & "|" & $FileDetails[2] & @CRLF)
        EndIf
        Next

EndFunc

 

[antmar904]

I have a filemask defined "*.lnk" but I see my script reading the $MFT file.  Can I exclude it by adding "*.lnk|$MFT" ?

 

;List only .lnk files and exclude the $MFT file.
    Local $Files = _FileListToArrayRec($CmdLine[1], "*.lnk|$MFT", $FLTAR_FILES, $FLTAR_RECUR, $FLTAR_SORT, $FLTAR_FULLPATH)

 

Edited March 5, 2021 by antmar904

[pseakins]

8 hours ago, antmar904 said:

Can I exclude it by adding "*.lnk|$MFT"

The help says you can exclude it this way, did you try it? Is the file extension really ".$MFT"? Don't forget the wildcard and the period, ie; "*.lnk|*.$MFT"

Strictly speaking the first mask should exclude all other combinations but I have found Windoze to be a bit iffy about certain files and folders.

Edited March 6, 2021 by pseakins
more

[Nine]

$MFT is the master file table under NTFS.  It is not an extension.  I believe the way OP did the exclusion, it should work.

[antmar904]

ok i got this to work however i want to be able to run this on a computer and NOT have to specify a drive letter like I am doing today, example "PE.exe C:\".  I'm stuck on querying FIXED drives only then looping through each drive letter found for .lnk files only and if found with a specific argument delete that lnk file.

Edited March 10, 2021 by antmar904

[Nine]

Local $aDrive = DriveGetDrive ("FIXED")

 

[antmar904]

yes I got that I guess i'm stuck on working with two different arrays (DriveGetDrive and _FileListToArrayRec) at that same time.

[Nine]

Put some code together, post it here, we will help you out from that attempt...

[Subz]

You can use something like (untested):

#include <Array.au3>
#include <File.au3>

Global $LogFile = @ScriptDir & "\Outputfile.txt", $hFileOpen = FileOpen($LogFile, 9)

Global $aDrives = DriveGetDrive("Fixed")
If @error Then
    FileWriteLine($LogFile, "No fixed drives found.")
    FileClose($hFileOpen)
    Exit
EndIf

For $i = 1 To $aDrives[0]
    Find($aDrives[$i] & "\")
Next

Func Find($_sDrive)
    Local $aFileDetails, $aFiles = _FileListToArrayRec($_sDrive, "*.lnk", $FLTAR_FILES, $FLTAR_RECUR, $FLTAR_SORT, $FLTAR_FULLPATH)
    If @error Then
        MsgBox(0, "", @error & @extended & " " & $_sDrive)
        Exit
    EndIf

    For $i = 1 to $aFiles[0]
        $aFileDetails = FileGetShortcut($aFiles[$i])
        If Not @error Then
            FileWriteLine($hFileOpen, $aFiles[$i] & "|" & $aFileDetails[2] & @CRLF)
        EndIf
    Next
EndFunc

 

[antmar904]

#include <Array.au3>
#include <File.au3>

Find()

Func Find()

    Local $LogFile = @ScriptDir & "\Outputfile.txt", $hFileOpen = FileOpen($LogFile, 9)

    ;List all fixed drives
    Local $aDrives = DriveGetDrive($DT_FIXED)

    If @error Then
        ; An error occurred when retrieving the drives.
        FileWriteLine($LogFile, "A error occured reading drives.")
        FileClose($hFileOpen)
        Exit
    Else
        For $i = 1 To $aDrives[0]
            ;List only .lnk files
            Local $Files = _FileListToArrayRec(StringUpper($aDrives[$i]) & "\", "*.lnk", $FLTAR_FILES, $FLTAR_RECUR, $FLTAR_SORT, $FLTAR_FULLPATH)

            ;Debug
            ;_ArrayDisplay($Files, "")

            For $x = 0 To UBound($Files) - 1
                Local $FileDetails = FileGetShortcut($Files[$i])
                If Not @error Then
                If StringInStr($FileDetails[2], "bad.exe") Then
                    FileDelete($Files[$i])
                    FileWriteLine($hFileOpen, $Files[$i] & "," & $FileDetails[2] & ",lnk file removed" & @CRLF)
                EndIf
            EndIf
        Next
    EndIf
EndFunc   ;==>Find

 

[antmar904]

@Subz

This seems to work, thank you!  Does it look ok or can it be optimized?

#include <Array.au3>
#include <File.au3>

Global $LogFile = @ScriptDir & "\Outputfile.txt", $hFileOpen = FileOpen($LogFile, 9)

Global $aDrives = DriveGetDrive("Fixed")
If @error Then
    FileWriteLine($LogFile, "No fixed drives found.")
    FileClose($hFileOpen)
    Exit
EndIf

For $i = 1 To $aDrives[0]
    Find($aDrives[$i] & "\")
Next

Func Find($_sDrive)
    Local $aFileDetails, $aFiles = _FileListToArrayRec($_sDrive, "*.lnk", $FLTAR_FILES, $FLTAR_RECUR, $FLTAR_SORT, $FLTAR_FULLPATH)
    If @error Then
        FileWriteLine($LogFile, "Error searching: " & $_sDrive)
        FileClose($hFileOpen)
        Exit
    EndIf

    For $i = 1 To $aFiles[0]
        $aFileDetails = FileGetShortcut($aFiles[$i])
        If Not @error Then
            If StringInStr($aFileDetails[2], "--badboy") Then
                FileDelete($aFiles[$i])
                FileWriteLine($hFileOpen, $aFiles[$i] & "," & $aFileDetails[2] & ",lnk file removed" & @CRLF)
            EndIf
        EndIf
    Next
EndFunc   ;==>Find

 

[Subz]

It looks fine to me, although you may want to close the log after the first loop + rather than exit after _FileListToArrayRec just return.  You could also use ternary to say whether or not the shortcut was deleted successfully, example (untested):

#include <Array.au3>
#include <File.au3>

Global $sLogFile = @ScriptDir & "\Outputfile.txt", $hFileOpen = FileOpen($sLogFile, 9)

Global $aDrives = DriveGetDrive("Fixed")
If @error Then
    FileWriteLine($sLogFile, "No fixed drives found.")
    FileClose($hFileOpen)
    Exit
EndIf

For $i = 1 To $aDrives[0]
    Find($aDrives[$i] & "\")
Next

FileClose($hFileOpen)

Func Find($_sDrive)
    Local $aFileDetails, $aFiles = _FileListToArrayRec($_sDrive, "*.lnk", $FLTAR_FILES, $FLTAR_RECUR, $FLTAR_SORT, $FLTAR_FULLPATH)
    If @error Then
        FileWriteLine($sLogFile, "Error searching: " & $_sDrive)
        Return
    EndIf

    For $i = 1 To $aFiles[0]
        $aFileDetails = FileGetShortcut($aFiles[$i])
        If Not @error Then
            If StringInStr($aFileDetails[2], "--badboy") Then
                FileDelete($aFiles[$i])
                FileWriteLine($hFileOpen, (FileExists($aFiles[$i]) ? "Failed to remove: " : "Successfully removed: ") & $aFiles[$i] & ", " & $aFileDetails[2] & @CRLF)
            EndIf
        EndIf
    Next
EndFunc   ;==>Find

 

[antmar904]

13 minutes ago, Subz said:

It looks fine to me, although you may want to close the log after the first loop + rather than exit after _FileListToArrayRec just return.  You could also use ternary to say whether or not the shortcut was deleted successfully, example (untested):

#include <Array.au3>
#include <File.au3>

Global $sLogFile = @ScriptDir & "\Outputfile.txt", $hFileOpen = FileOpen($sLogFile, 9)

Global $aDrives = DriveGetDrive("Fixed")
If @error Then
    FileWriteLine($sLogFile, "No fixed drives found.")
    FileClose($hFileOpen)
    Exit
EndIf

For $i = 1 To $aDrives[0]
    Find($aDrives[$i] & "\")
Next

FileClose($hFileOpen)

Func Find($_sDrive)
    Local $aFileDetails, $aFiles = _FileListToArrayRec($_sDrive, "*.lnk", $FLTAR_FILES, $FLTAR_RECUR, $FLTAR_SORT, $FLTAR_FULLPATH)
    If @error Then
        FileWriteLine($sLogFile, "Error searching: " & $_sDrive)
        Return
    EndIf

    For $i = 1 To $aFiles[0]
        $aFileDetails = FileGetShortcut($aFiles[$i])
        If Not @error Then
            If StringInStr($aFileDetails[2], "--badboy") Then
                FileDelete($aFiles[$i])
                FileWriteLine($hFileOpen, (FileExists($aFiles[$i]) ? "Failed to remove: " : "Successfully removed: ") & $aFiles[$i] & ", " & $aFileDetails[2] & @CRLF)
            EndIf
        EndIf
    Next
EndFunc   ;==>Find

 

ok.

for some reason I am seeing my program read the $MFT file while using Resource Monitor even though I supplied a filemask in _filelisttoarrayrec.

[Subz]

Try changing the $iReturn to $FLTAR_FILES(1) + Hidden(4) + System Files(8) example:

Local $aFiles = _FileListToArrayRec("C:\", "*.lnk", 13, 1, 1, 2)

 

[Nine]

I think OP wants to omit $MFT, not include it.  @antmar904 I believe you see the usage of $MFT because it it always use in any access to any file...

Edited March 10, 2021 by Nine

[Subz]

 

The $iReturn flags, should omit those files, assuming the files have hidden or system attributes.

$iReturn

[optional] Specifies whether to return files, folders or both and omit those with certain attributes
    $FLTAR_FILESFOLDERS (0) - (Default) Return both files and folders
    $FLTAR_FILES (1) - Return files only
    $FLTAR_FOLDERS (2) - Return Folders only
Add one or more of the following to $iReturn to omit files/folders with that attribute
    + $FLTAR_NOHIDDEN (4) - Hidden files and folders
    + $FLTAR_NOSYSTEM (8) - System files and folders
    + $FLTAR_NOLINK (16) - Link/junction folders

[Nine]

@Subz  you are right