Find shortcuts of hidden files in the same directory.

Welcome Forums General PowerShell Q&A Find shortcuts of hidden files in the same directory.

This topic contains 3 replies, has 4 voices, and was last updated by

 
Participant
3 years, 4 months ago.

  • Author
    Posts
  • #29366

    Inactive
    Points: 0
    Rank: Member

    We have found a Shylock botnet on one of our servers and one of the symptoms is it replaces all files in a share with identically named shortcuts and then hiding the original files.
    I need to be able to run a script to see which directories have these shortcuts in.
    So there will be a logmein.exe and logmein shortcut in the same location.
    Please help!

  • #29377

    Participant
    Points: 0
    Rank: Member

    You could use Get-ChildItem to get a Recursive listing of all of your files, excluding those with the .lnk extension. Then use ForEach-Object on the returned list to loop though all the returned files and replace the extension on the FullName property with .lnk and check for the existance of that file. If found. Out-Default that object.

  • #29391

    Participant
    Points: 0
    Rank: Member

    Try something like this:

    $dir = Get-ChildItem c:\test -Directory 
    foreach ($Folder in $dir){
    
       Get-ChildItem $Folder.FullName | where {$_.Extension -eq '.lnk'}
    }
    
  • #29392

    Participant
    Points: 0
    Rank: Member

    Keep in mind that Get-ChildItem does not get hidden items by default. To do that you must use the -Force switch.

The topic ‘Find shortcuts of hidden files in the same directory.’ is closed to new replies.