batch-filecmdfilehash

How to remove a part of a string with batch script?


I want to remove a part of this code: set hash=certutil -hashfile %%A MD5. I mean that I need to remove MD5 hash of cmd.exe: and CertUtil: -hashfile command completed successfully. from the output of this code.

my full code ( it is an antivirus but not complete yet... ):

For /f "tokens=*" %%A in ('dir /b /s') do (
      set hash=certutil -hashfile %%A MD5
      findstr %hash% C:\Users\Sepehr\Desktop\data.txt && (
      echo %%A is Infected!
      echo Deleting %%A
      del /f /q %%A
      ) || (
      echo %%A is Clean!
      )
)
pause

No idea how to remove those parts?


Solution

  • Both lines you want to remove contain a colon (language independent), so you can filter your hash with find /v ":". Then simply look that up in your data.txt with `findstr /g:"":

    For /r "C:\" "delims=" %%A in (*) do (
      certutil -hashfile "%%A" MD5|find /v ":"|findstr /G:"C:\Users\Sepehr\Desktop\data.txt" && (
        echo hash is stored for %%A
      ) || (
        echo hash is unknown for %%A
      )
    ) 
    

    There certainly is room for improvement, but this is a working skeleton.

    A word of advice: Don't delete "infected" files, at least not in the Windows and Program folders (and double-check in other locations as well)! You might make your system unusable (and remove any new or intentionally changed files).