2

Because of a ransomware attack (no big deal, all recovered from backup) I want to clean up the directories and sub directories on the network share where the attack happened to create a lot of scrambeled files. They are all owned by the user who works on the PC that was infected.

My best attempt up to now looks like this:

Get-ChildItem Z:\ -Recurse | get-acl | where {($_.Owner -eq "DOMAIN\username")} | foreach { $_.Delete()}

But it does not work because of get-acl does not support $_.Delete()


This $ or $_ is not my problem I think. I do have some other commands that are a bit likely. They run.

Like this one here:

Get-ChildItem -filter "~*.*" -path Z:\ -recurse | where {($_.LastWriteTime -lt (get-date).AddDays(-7))} | foreach { $_.Delete()}

I use this since days in order to delete files that were created by restoring files from backup that were untouched by the malware. I simply restored the whole share

But I'll give it a try.

Concerning your other hint I have to explain that the user account which ran the ransomware has no self-created files on that network drive. Read permission would have been enough for that user.

Unfortunately this share has Change Access for everyone. That is from earlier days where we all did not have too much to do with ransomware. Of course I will change these access rights when the main work is done.

So please I need advice in order to delete files owned by this special account.

1 Answer 1

6

First of all, you had some typos in your code. The individual object of a list within a where-clause is addressed by $_, not $.

And you were thinking around the corner. Your approach was a little complicated. Try this instead :)

Get-ChildItem Z:\ -Recurse | where { $_.GetAccessControl().Owner -eq "DOMAIN\username"} | Remove-Item

Although personally, I don't feel like this is really the best approach, as the Owner may not always be who you think it is.

3
  • 2
    Agreed, I would also just to be safe limit the files to a time frame unless it is a ransom-ware infection that randomizes that stuff.
    – Nick Young
    Jan 12, 2016 at 3:15
  • What a mess. I did not read carefully. Your command line Get-ChildItem Z:\ -Recurse | where { $_.GetAccessControl().Owner -eq "DOMAIN\username"} | Remove-Item works absolutely perfect. Sorry. Thank you a lot.
    – Anna Nuema
    Jan 13, 2016 at 14:04
  • 1
    @AnnaNuema If the answer solves your problem, please click the checkmark below the voting buttons to mark it "Accepted" Jan 13, 2016 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .