When pushing the Symantec Management Agent to a group of desktops, a file is created in the C:\Windows directory named _slfdel.bat. What is it?
ITMS 8.x
"_slfdel.bat" is part of a process used for quite some time for our SMAgent (aka Altiris Agent).
_slfdel.bat is our self-deleting mechanism used during the agent uninstalls and the push install.
The bat script removes the agent uninstaller AeXTemp.exe when it’s done.
The file is generated in run-time, it’s very old and has not been modified in years. It is started with parameters “_slfdel.bat aextemp.exe”
This is the info contained in the batch file:
@echo off
REM delay some time to settle
ping 127.0.0.1 -n 5 -w 1000 > nul
REM repeat on error 20 times
set COUNT=!!!!!!!!!!!!!!!!!!!!
set ITER=
:loop
set ITER=%ITER%!
del .\\%1
if not exist %1 goto end
if %ITER%==%COUNT% goto end
goto loop
:end
del %0
REM cleanup
set COUNT=
set ITER=
Here is the list of our executable files that are started during the push installation:
C:\Windows\AltirisAgentInstSvc.exe
C:\Windows\AeXNSC.exe
C:\Windows\TEMP\AeX_{1C795C8E-332E-479F-81F7-A79C051D5091}_2176.tmp\AeXInstallPrecheck.exe
C:\Windows\TEMP\AeX_{1C795C8E-332E-479F-81F7-A79C051D5091}_2176.tmp\AeXNSAgentInst.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\Program Files\Altiris\Altiris Agent\x86\AeXNSAgentHostSurrogate32.exe
C:\Program Files\Altiris\Altiris Agent\x86\AeXAgentUIHostSurrogate32.exe
C:\Program Files\Altiris\Altiris Agent\Agents\WMIProviderAgent\AltirisAgentProvider.exe
C:\Windows\AltirisAgentInstSvc_del.exe
C:\Windows\system32\cmd.exe /C _slfdel.bat AltirisAgentInstSvc_del.exe
Note: The GUIDs in the paths above will be different each time this is run. We mention our executables but we don't mention what the regsvr32.exe, rundll32.exe, mofcomp.exe and a couple of other system exes do during the installation/uninstall process.