@echo off
cls & color 9E & Mode 95,5
Title Running Processes - Scheduled Tasks - Services - Startup items by Hackoo 2020
If [%1] NEQ [Admin] Goto RunAsAdmin
echo(
echo( ===========================================================
echo( Please wait a while ... Working is in progress....
echo( ===========================================================
Set "Filter_Ext=%Temp%\Filter_Ext"
Call :GetFileNameWithDateTime MyDate
Set "Log=%~dpn0_%Computername%_%MyDate%.txt"
Set "Lnk_Target_Path_Log=%~dp0Lnk_Target_Path_Log.txt"
Set "All_Users=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"
Set "Current_User=%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
set "Winlogonkey=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
Set StartupFolders="%All_Users%" "%Current_User%"
If Exist "%Log%" Del "%Log%"
Set "VbsFile=%Tmp%%~n0.vbs"
Call :Generate_VBS_File
Powershell ^
Get-WmiObject Win32_Process ^
| where commandline -NE $null ^
| Select-Object ProcessID,Name,CommandLine ^
| Out-String -Width 450 ^
| Findstr /I /V "Admin" ^
| Findstr /I /V "Get-WmiObject" ^
| Out-File "%Log%" -Encoding ASCII
Powershell ^
Get-CimInstance Win32_StartupCommand ^
| Select-Object Name,command,Location,user ^
| Format-List ^
| Out-File -Append "%Log%" -Encoding ASCII
>"%Lnk_Target_Path_Log%" (
@For %%A in (%StartupFolders%) Do (
Call :Execute_VBS_File "%%~A"
)
)
>> "%Log%" (Type "%Lnk_Target_Path_Log%")
> "%Filter_Ext%" (
echo .vbs
echo .vbe
echo .js
echo .jse
echo .hta
echo .bat
echo .cmd
echo .ps1
)
@for /f "delims=" %%a in ('Type "%Lnk_Target_Path_Log%" ^| Findstr /I /G:"%Filter_Ext%"') do (
@for /f "tokens=2 delims==" %%b in ('echo %%a') do (
>> "%Log%" 2>&1 (
echo(
echo ===================================================================================
echo( Source code of TargetPath=%%b
echo ===================================================================================
Type %%b
)
)
)
Del "%Filter_Ext%" /F >nul 2>&1
Del "%Lnk_Target_Path_Log%" >nul 2>&1
SetLocal EnableDelayedExpansion
>> "%Log%" (
echo(
echo ****************************************************************************************************
echo( No Microsoft Scheduled Tasks List
echo ****************************************************************************************************
@For /F "tokens=2,9,17,19,20,21,22 delims=," %%a in ('SCHTASKS /Query /NH /FO CSV /V ^|find /I /V "Microsoft" ^|findstr /I /C:"VBS" /C:"EXE"') do (
Set TaskName=%%~a
Set TaskPath=%%~b
Call :Trim_Dequote !TaskName! TaskName
Call :Trim_Dequote !TaskPath! TaskPath
echo "!TaskName!"
echo "!TaskPath!"
echo %%c;%%d;%%f;%%g
echo( ---------------------------------------------------------------------------------------------------
)
)
>> "%Log%" (
echo(
echo ****************************************************************************************************
echo( No Microsoft Services List
echo ****************************************************************************************************
@for /f "tokens=*" %%a in (
'WMIC service where "Not PathName like '%%Micro%%' AND Not PathName like '%%Windows%%'" get Name^,DisplayName^,PathName^,Status'
) do (
@for /f "delims=" %%b in ("%%a") do (
echo %%b
)
)
)
>> "%Log%" (
echo(
echo ****************************************************************************************************
Reg Query "%Winlogonkey%" | find /I "userinit"
)
If Exist "%Log%" Start /MAX "Log" "%Log%" & Exit
::-----------------------------------------------------------------------------------
:Trim_Dequote <Var> <NewVar>
(
echo Wscript.echo Trim_Dequote("%~1"^)
echo Function Trim_Dequote(S^)
echo If Left(S, 1^) = """" And Right(S, 1^) = """" Then Trim_Dequote = Trim(Mid(S, 2, Len(S^) - 2^)^) Else Trim_Dequote = Trim(S^)
echo End Function
)>"%VbsFile%"
for /f "delims=" %%a in ('Cscript //nologo "%VbsFile%"') do (
set "%2=%%a"
)
Del "%VbsFile%" /F >nul 2>&1
exit /b
REM ------------------------------------------------------------------------------
:GetFileNameWithDateTime <FileName>
for /f "skip=1" %%x in ('wmic os get localdatetime') do if not defined MyDate set "MyDate=%%x"
set "%1=%MyDate:~0,4%-%MyDate:~4,2%-%MyDate:~6,2%-%MyDate:~8,2%-%MyDate:~10,2%"
Exit /B
REM -----------------------------------------------------------------------------
:Generate_VBS_File
>"%VbsFile%" (
echo Option Explicit
echo Dim Ws,objStartFolder,objFSO,objFolder,colFiles
echo Dim objFile,strFilePath,Lnk,Title
echo Title = "Extracting Target Path from .lnk and .url files by Hackoo 2020"
echo Set Ws = CreateObject("Wscript.Shell"^)
echo If WSH.Arguments.Count = 0 Then MsgBox "Missing Arguments",vbExclamation,Title : Wscript.Quit(1^)
echo objStartFolder = WSH.Arguments(0^)
echo Set objFSO = CreateObject("Scripting.FileSystemObject"^)
echo Set objFolder = objFSO.GetFolder(objStartFolder^)
echo Set colFiles = objFolder.Files
echo For Each objFile in colFiles
echo strFilePath = objFile.Path
echo If Ucase(objFSO.GetExtensionName(strFilePath^)^) = "LNK"_
echo Or Ucase(objFSO.GetExtensionName(strFilePath^)^) = "URL" Then
echo Call ExtractTargetPath(strFilePath^)
echo End If
echo Next
echo '-------------------------------------------------------------
echo Sub ExtractTargetPath(Lnk^)
echo set Lnk = Ws.Createshortcut(Lnk^)
echo WScript.echo "Link="^& DblQuote(Lnk^) ^& vbcrlf ^&_
echo "Target="^& DblQuote(Lnk.TargetPath^) ^& vbcrlf ^&_
echo String(100,"-"^)
echo End Sub
echo '-------------------------------------------------------------
echo Function DblQuote(Str^)
echo DblQuote = Chr(34^) ^& Str ^& Chr(34^)
echo End Function
echo '-------------------------------------------------------------
)
Exit /B
REM -----------------------------------------------------------------------------
:Execute_VBS_File
cscript //nologo "%VbsFile%" "%~1"
Exit /B
REM -----------------------------------------------------------------------------
:RunAsAdmin
cls & color 9E & Mode 95,5
echo(
echo( ===========================================================
echo( Please wait a while ... Running as Admin ....
echo( ===========================================================
Powershell start -verb runas '%0' Admin & Exit
REM -----------------------------------------------------------------------------
