Clicked on this script from a SSD I bought second hand. Is it malicious? - vbscript

I clicked without thinking and it didn't appear to do anything but shut the windows. Looking at the code I'm too noob to work out what it does but I'm paranoid it's done something behind the scenes.
Option Explicit
'On Error Resume Next
Dim strComputer
Dim objWmiService
Dim colMonitoredProcesses
Dim objLatestProcess
Dim colProcesses
Dim objProcess
strComputer = "."
Set objWmiService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colProcesses = objWmiService.ExecQuery _
("Select * From Win32_Process Where Name = 'explorer.exe'")
For Each objProcess In colProcesses
objProcess.Terminate
Next
Set colMonitoredProcesses = objWmiService.ExecNotificationQuery _
("Select * From __InstanceCreationEvent " _
& "Within 1 Where TargetInstance Isa 'Win32_Process' " _
& "And (TargetInstance.Name = 'iexplore.exe' " _
& "Or TargetInstance.Name = 'notepad.exe')")
Do
Set objLatestProcess = _
colMonitoredProcesses.NextEvent.TargetInstance
If LCase(objLatestProcess.Name) = "iexplore.exe" Then
objLatestProcess.Terminate
End If
Loop

Looks like it might be some code that "waits for a process to start, terminates the process and exits when it sees a particular process start."
(Essentially, it just closes notepad and internet explorer processes, it seems)
Here's a link to a blog post on a Microsoft forum with almost exactly that code.
(Background vbscript that waits for a process to start, terminates the process and exits when it sees a patricular process start)
I think you are ok!
In the future don't click random stuff!

First it closes all explorer.exe instances (this is the Windows shell, basically taskbar and desktop). It then watches for Notepad or Internet Explorer to start and if it's Internet Explorer, shuts it down. Why it is also checking for Notepad to start but not doing anything, I don't know.

Related

Script to display a pop-up and then kills a windows process

I'm trying to deploy an application through SCCM 2012 for Windows7 (x86 and x64) that requires to notify the user that his Microsoft Outlook should be closed before to continue with the installation. It could be either with a Timer or a (Yes / No) choice, then if the user press Yes then it will close Outlook and will continue with the installation otherwise it will send a log file saying the the user cancelled the installation but it can be retried at any time.
So far I just have the installation script that works only to install the applications using a command line script. So, it will just execute some MSI's installations and Windows updates, and then it quits.
The script I have that creates the pop up and that can be called by my CMD file is the following VBScript and was taken from a TechNet article.
Const TIMEOUT = 7
Set objShell = WScript.CreateObject("WScript.Shell")
Set objFS = WScript.CreateObject("Scripting.FileSystemObject")
strPath = Wscript.FullName
strFileVersion = objFS.GetFileVersion(strPath)
iRetVal = objShell.Popup(Wscript.FullName & vbCrLf & _
"File Version: " & _
strFileVersion & vbCrLf & _
"Would you like to close Outlook application and continue with the installation?" _
,TIMEOUT,"Outlook Validation",vbYesNo + vbQuestion)
Select Case iRetVal
Case vbYes
Set objFile = objFS.GetFile(strPath)
objShell.Popup WScript.FullName & vbCrLf & vbCrLf & _
"File Version: " & strFileVersion & vbCrLf & _
"File Size: " & Round((objFile.Size/1024),2) & _
" KB" & vbCrLf & _
"Date Created: " & objFile.DateCreated & vbCrLf & _
"Date Last Modified: " & objFile.DateLastModified & _
vbCrLf,TIMEOUT
Wscript.Quit
Case vbNo
Wscript.Quit
Case -1
WScript.StdOut.WriteLine "Popup timed out."
Wscript.Quit
End Select
So I don't know if there's any useful example that I can use and customize it from there. I'm clueless, blindfolded, I don't see the light. Well you understand my frustration.
Any ideas, examples or links will be really appreciated!!
Thanks & kind regards.
Joel.
This is one way.
Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * From Win32_Process")
For Each objItem in colItems
'msgbox objItem.name & " " & objItem.CommandLine
If LCase(objItem.name) = "outlook.exe" then
If Msgbox("Close Outlook", 33, "Install") = 1 then
objItem.terminate
End If
End If
Next
VBScript's Help file - https://www.microsoft.com/en-au/download/details.aspx?id=2764
For help with the WMI object use wmic at the command prompt.
wmic process get /? (same as wmic path win32_process get /?) and wmic process call /? list properties and methods.
Here my procedure which closes outlook before modifying the profile.
Is is part of a logon script. The show is a logging and informing procedure.
sub CloseOutlook
on error resume next 'to be able to log and continue
dim objWMIService, colProcessList, objProcess, sResult, oShell
set oShell = WScript.CreateObject("WScript.Shell")
set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
set colProcessList = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = 'OUTLOOK.EXE'")
for Each objProcess in colProcessList
show "outlook is being closed"
objProcess.Terminate()
if Err <> 0 then
show "Error while closing outlook: " & err.Description
end if
sResult = oShell.Popup("Outlook is being closed, profile is configured")
next
end sub
If you want confirmation from the user you will have to use a MsgBox instead.
I'd recommend not faffing about with warnings and closing Outlook, but instead configure the advert to run when no users are logged in. Less chance for problems or accidentally miss-clicked "oh no you lost my emails" situations.

VBScript and sendkeys not working with DirectX?

I am playing GTA SA:MP. It uses DirectX, and if you are AFK on the server you get automatically kicked, and I would like to let it AFK on the server while I'm left.
I tried creating a VBScript that automatically after 8 minutes presses W and then loops but it actually doesn't work. The player doesn't move.
Code:
Dim a
Dim antiafk
set antiafk=createobject("wscript.shell")
msgbox "Atentie! Ca sa opriti scriptul, trebuie sa il opriti NUMAI din Task Manager. Nu exista alta cale."
Do until a=5
wscript.sleep 480000
antiafk.sendkeys "w"
Loop
Any ideas?
SendKeys method sends one or more keystrokes to the active window. Use AppActivate method to activate your application window first.
The script is a simplified version of your one, with no 8 minutes loop and notepad.exe instead of your application name.
option explicit
On Error Goto 0
Dim antiafk
set antiafk=createobject("wscript.shell")
Dim lngPID, booSuccess, foo
lngPID = getlngPID()
If lngPID = 0 Then
foo = antiafk.Popup( "No instance found", 5, _
"29445451", vbOKOnly + vbCritical)
Else
booSuccess = antiafk.AppActivate( lngPID)
If not booSuccess Then
foo = antiafk.Popup( "AppActivate Method unsuccesfull", 5, _
"29445451", vbOKOnly + vbExclamation)
Else
antiafk.sendkeys "w"
End If
End If
Function getLngPID()
getLngPID = 0
Dim strComputer
Dim objWMIService, colProcessList, objProcess
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = 'Notepad.exe'")
'find appropriate and suitable Process ID
For Each objProcess in colProcessList
getLngPID = objProcess.ProcessId
Next
End Function

VBScript - Multiple Issues

So I've been thrown in the deep end of the shark tank without even my arm floaters and I don't know how to swim (Translation - I don't know VBS).
So I find myself here because I keep hitting my scripts with the two sticks I have it still doesn't work. When I fix one issue another appears and when I fix that one the other returns (feel like I'm chasing my tail).
So below is the latest iteration of my code (I keep moving crap around thinking it might magically work).
'---- Set Constant for Reading
Const ForReading = 1
'----- Define at the Variables for the scripts
Set objDictionary = CreateObject("Scripting.Dictionary")
Set objFSO = CreateObject("Scripting.FileSystemObject")
'------ Path for File below is Explicit (meaning you need to enter the complete path)
Set objTextFile = objFSO.OpenTextFile("c:\users\me\documents\Small- ComputerList.txt", ForReading)
'---- Begin Loop for reading the Array
Do Until objTextFile.AtEndOfStream
strNextLine = objTextFile.Readline
arrServiceList = Split(strNextLine , ",")
' ------- strComputer = "usms-w-ksd68598" Commented out from original script
' ------- Reading from the Array
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & arrServiceList(0) & "\root\cimv2")
' ------- Running the Command to find all the printers
Set colPrinters = objWMIService.ExecQuery _
("Select * from Win32_Printer")
For Each objPrinter in colPrinters
objDictionary.RemoveAll
objDictionary.Add objPrinter.PortName, objPrinter.PortName
Next
' ------ Running the Command to find all the TCP/IP Printer Ports
Set colPorts = objWMIService.ExecQuery _
("Select * from Win32_TCPIPPrinterPort")
For Each objPort in colPorts
If objDictionary.Exists(objPort.Name) Then
strUsedPorts = strUsedPorts & _
objDictionary.Item(objPort.Name) & VbCrLf
Else
strFreePorts = strFreePorts & objPort.Name & vbCrLf
End If
Next
'----- Printing out the Results to the screen
For i = 1 to Ubound(arrServiceList)
& arrServiceList(i)
Next
Loop
Wscript.Echo "System Name: " & arrServiceList(0)
Wscript.Echo "The following ports are in use for: " & VbCrLf & strUsedPorts
Wscript.Echo "The following ports are not used for: " & VbCrLf & strFreePorts
If my crazy ducted taped scripts make no sense please don't be shocked. I've been stuck in a cave hitting the keyboard with two sticks and this is the result I've come up with. Not too bad for a caveman but it still doesn't work.
Any help, assistance, advice, comment, jokes, sarcasm, ranting appreciated. Any trolling will be swiftly dealt with a big mallet over the head.
Thank you,
Ed Medina
Lo and behold the gods of code have shine their light upon my path and provided me with an answer.
Anyway, Thanks to Big Chris and Mr. Roryap for their questions. I want to also thank the Academy, all of my fellow coders, my mom, coffee, the mailman, my wife, my cat and all the little people.
Here is a code that will work which will read from a file in your Temp Folder (file is named Computers.txt) and then against that file it will run and test to find all the printers ports in that computer in your Domain (Network).
The output is a simple Echo out giving it to you in the window. I just kept hitting the keyboard with my two sticks in my dark, smelly cave and out came out the code.
The only caveat is that if you have a wrong computer name or a computer turned off the script will fail at that point and won't continue (yeah, yeah, working on it).
'---- Set Constant for Reading
Const ForReading = 1
'----- Define at the Variables for the scripts
Set objDictionary = CreateObject("Scripting.Dictionary")
Set objFSO = CreateObject("Scripting.FileSystemObject")
'------ Path for File below is Explicit (meaning you need to enter the complete path)
Set objFile = objFSO.OpenTextFile("c:\Temp\Computers.txt", ForReading)
'---- Begin Loop for reading the Array
Do Until objFile.AtEndOfStream
strComputer = objFile.ReadLine
' ------- Reading from the Array
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
' ------- Running the Command to find all the printers
Set colPrinters = objWMIService.ExecQuery _
("Select * from Win32_Printer")
For Each objPrinter in colPrinters
objDictionary.RemoveAll
objDictionary.Add objPrinter.PortName, objPrinter.PortName
Next
' ------ Running the Command to find all the TCP/IP Printer Ports
Set colPorts = objWMIService.ExecQuery _
("Select * from Win32_TCPIPPrinterPort")
For Each objPort in colPorts
If objDictionary.Exists(objPort.Name) Then
strUsedPorts = strUsedPorts & _
objDictionary.Item(objPort.Name) & VbCrLf
Else
strFreePorts = strFreePorts & objPort.Name & vbCrLf
End If
Next
'---- Output to Screen
Wscript.Echo "System Name: " & strComputer
Wscript.Echo "The following ports are in use for: " & VbCrLf & strUsedPorts
Wscript.Echo "The following ports are not used for: " & VbCrLf & strFreePorts
Loop
Thank you.
BTW if anyone know how to throw an error and keep working give feel free to post. Thanks again everyone.

Starting a process in VBS: path not found

I need to make a simple vbs script to run some process' automatically. I found the following script on microsoft's website. It works fine to run notepad.exe the way the original example shows, but I'm trying to modify it to run myprog.exe. The full path to this program is: C:\myprogdir\myprog.exe
Const SW_NORMAL = 1
strComputer = "."
strCommand = "myprog.exe"
strPath = "C:\myprogdir\"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
' Configure the Notepad process to show a window
Set objStartup = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = objStartup.SpawnInstance_
objConfig.ShowWindow = SW_NORMAL
' Create Notepad process
Set objProcess = objWMIService.Get("Win32_Process")
intReturn = objProcess.Create _
(strCommand, strPath, objConfig, intProcessID)
If intReturn <> 0 Then
Wscript.Echo "Process could not be created." & _
vbNewLine & "Command line: " & strCommand & _
vbNewLine & "Return value: " & intReturn
Else
Wscript.Echo "Process created." & _
vbNewLine & "Command line: " & strCommand & _
vbNewLine & "Process ID: " & intProcessID
End If
I keep getting Return value: 9, which indicates "Path Not Found". However the path is correct. Is there something I'm not getting?
You don't need all that to start a process, you just need the Shell object. Also, be sure to wrap the path of your executable in quotes (in case the path has spaces). Like this:
Option Explicit
Dim shl
Set shl = CreateObject("Wscript.Shell")
Call shl.Run("""C:\myprogdir\myprog.exe""")
Set shl = Nothing
WScript.Quit
Unless the path to your program is included in the system's %PATH% environment variable you need to specify the commandline with the full path to the executable. Specifying the path just as the working directory will not work.
strProgram = "myprog.exe"
strPath = "C:\myprogdir"
Set fso = CreateObject("Scripting.FileSystemObject")
strCommand = fso.BuildPath(strPath, strProgram)
...
intReturn = objProcess.Create(strCommand, strPath, objConfig, intProcessID)
Using the BuildPath method will save you the headaches caused by having to keep track of leading/trailing backslashes.
Note that you need to put double quotes around a path that contains spaces, e.g. like this:
strCommand = Chr(34) & fso.BuildPath(strPath, strProgram) & Chr(34)
As others have already pointed out, there are simpler ways to start a process on the local computer, like Run:
Set sh = CreateObject("WScript.Shell")
sh.Run strCommand, 1, True
or ShellExecute:
Set app = CreateObject("Shell.Application")
app.ShellExecute strCommand, , strPath, , 1
There are some notable differences between Run and ShellExecute, though. The former can be run either synchronously or asynchronously (which means the command either does or doesn't wait for the external program to terminate). The latter OTOH always runs asynchronously (i.e. the method returns immediately without waiting for the external program to terminate), but has the advantage that it can be used to launch programs with elevated privileges when UAC is enabled by specifying the verb "runas" as the 4th argument.
However, these methods only allow for launching processes on the local computer. If you want to be able to launch processes on remote computers you will have to use WMI:
strComputer = "otherhost"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
See here for more information about WMI connections to remote hosts.

VB script Kill process and delete folder

I am a noop when it comes to vbscript but I managed to make something. But now I am kinda stuck.
Let me try to explain what I am trying to do
I need to kill a process on a computer [That part I know and made] VBpart 1
When the process is killed I need to delete a folder with all it content [ That I managed also] VB part 2
VB part 1
Option Explicit
Dim objWMIService, objProcess, colProcess
Dim xComputer, xProcessKill
xComputer = "."
xProcessKill = "'diamant client.exe'"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& xComputer & "\root\cimv2")
Set colProcess = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = " & xProcessKill)
For Each objProcess in colProcess
objProcess.Terminate()
next
VB part 2
strFolder = "\\srvad01\DFS\Sandbox$\username\sandbox\DiaSoft Framework Diamant Client 1.0 NL"
set objFSO = createobject("Scripting.FileSystemObject")
objFSO.DeleteFolder strFolder
But somehow I can't merge these 2 in 1 file While they work separate fine
What am I doing wrong?
Kind regarts Arie

Resources