1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
| @echo off
Title Create report by Hackoo 2016
Mode con cols=90 lines=5
cls & color 9E & echo.
Set "TmpLogFile=%Tmp%\TmpLogkey.txt"
Set "LogFile=%UserProfile%\Desktop\%UserName%_Log.txt"
If Exist %TmpLogFile% Del %TmpLogFile%
If Exist %LogFile% Del %LogFile%
echo(
echo(
Echo(
ECHO **********************************************
ECHO Please wait..... We generate the report.....
ECHO **********************************************
Call :Speak "Please wait . . . We generate the report !"
Call :PS_Sub 'Warning' 100 '"Please wait . . . "' "'Please wait . . . We generate the report !'" 'Warning' 5
(
Echo.
Echo **************************** General info ****************************
Echo.
Echo Running under: %username% on profile: %userprofile%
Echo Computer name: %computername%
Echo.
Echo Operating System:
wmic os get caption | findstr /v /r /c:"^$" /c:"^Caption"
Echo Boot Mode:
wmic COMPUTERSYSTEM GET BootupState | find "boot"
Echo Antivirus software installed:
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName | findstr /v /r /c:"^$" /c:"displayName"
Echo.
Echo Executed on: %date% @ %time%
Echo.
Echo **************************** Drive info *******************************
Echo.
Echo Listing currently attached drives:
wmic logicaldisk get caption,description,volumename | find /v ""
Echo.
Echo Physical drives information:
for /F "tokens=1-3" %%A in ('fltmc volumes^|find ":"') do echo %%A %%B %%C
Echo.
Echo ************************************************************************
Echo.
)>"%TmpLogFile%"
(
Echo.
Echo ******************************************************************************
echo "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"
Dir /b "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"
Echo.
Echo ******************************************************************************
)>>%TmpLogFile% 2>&1
(
Echo ******************************************************************************
Echo STARTUP List
Echo ******************************************************************************
)>>%TmpLogFile% 2>&1
wmic /APPEND:%TmpLogFile% STARTUP get /format:list>Nul
(
Echo.
Echo ******************************************************************************
Echo Process List
Echo ******************************************************************************
)>>%TmpLogFile% 2>&1
powershell.exe Get-WmiObject Win32_Process ^| select ProcessID,ProcessName,Handle,commandline,ExecutablePath ^| Out-File -Append %TmpLogFile% -Encoding ascii
(
Echo.
Echo ******************************************************************************
Echo Scheduled task list
Echo ******************************************************************************
Schtasks /query /fo LIST
)>>%TmpLogFile% 2>&1
echo **************************************************NetWork Connections***************************************************************** >> %TmpLogFile%
echo *********************************************** Toutes les connexions **************************************************************** >> %TmpLogFile%
Netstat -abnov >> %TmpLogFile%
echo le contenu du fichier Hosts >> %TmpLogFile%
echo ************************************************************************************************************************************** >> %TmpLogFile%
Type %Windir%\System32\drivers\etc\hosts >> %TmpLogFile%
echo *************************************************************************************************************************************** >> %TmpLogFile%
Cmd /U /C Type %TmpLogFile% > %LogFile%
Start "" %LogFile%
:*************************************************************************
:Trim <String>
(
echo Wscript.echo Trim("%~1"^)
)>"%tmp%\%~n0.vbs"
for /f "delims=" %%a in ('Cscript /nologo "%tmp%\%~n0.vbs"') do (
set "KeyName=%%a"
)
exit /b
::**************************************************************************
:PS_Sub $notifyicon $time $title $text $icon $Timeout
PowerShell ^
[reflection.assembly]::loadwithpartialname('System.Windows.Forms') ^| Out-Null; ^
[reflection.assembly]::loadwithpartialname('System.Drawing') ^| Out-Null; ^
$notify = new-object system.windows.forms.notifyicon; ^
$notify.icon = [System.Drawing.SystemIcons]::%1; ^
$notify.visible = $true; ^
$notify.showballoontip(%2,%3,%4,%5); ^
Start-Sleep -s %6; ^
$notify.Dispose()
%End PowerShell%
exit /B
::*************************************************************************
::**********************************************
:Speak <msg>
Cls
echo(
(
echo WScript.StdOut.Write +vbTab+"******************************************************************************" + vbcrlf
echo strText=wscript.arguments(0^)
echo intTextLen = Len(strText^)
echo intPause = 100
echo WScript.StdOut.Write vbTab
echo For x = 1 to intTextLen
echo strTempText = Mid(strText,x,1^)
echo WScript.StdOut.Write strTempText
echo WScript.Sleep intPause
echo Next
echo wscript.echo vbcrlf +vbTab+ "******************************************************************************"
echo Set Voice=CreateObject("SAPI.SpVoice"^)
echo voice.speak strText
)>%tmp%\%~n0.vbs
@cscript.EXE /noLogo "%tmp%\%~n0.vbs" "%~1"
Exit /B
::************************************************************** |
PC qui s’arrête normalement lors d'une déconnexion d'une clé USB
Répondre avec citation
Envoyé par chrtophe
Partager