display the modules loaded into the running processes

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

display the modules loaded into the running processes

Logged in as: Guest

arrSession:exec spGetSession 2,16,58687

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> Post a VBScript >> display the modules loaded into the running processes
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

display the modules loaded into the running processes - 4/2/2008 4:58:58 AM

somebody

Posts: 4
Score: 0
Joined: 10/23/2007
From: Guangzhou,China
Status: offline

display the modules loaded into the running processes with their executablepath,creationTime,Manufacturer to help make your analysis easier.

1. with a one left click on the screen of the CMD window,you can pause the program,and with a right click,you can continue the program.
2. and the end of the program,with a right click on the screen of the CMD window and then press enter you can run the program again.
3.a popup window with the URL about:blank will appear if you run this program when your IE browser is working at the same time.
4.finally,you can figure out which module(*.dll) was loaded into the process by a virus or the service started by a virus with executablepath,creationtime and manufacturer all together.

you can also download the script here: http://kimhoo.lin.googlepages.com/module.vbs

That's all I have to say,hope it works for you guys.

const HKEY_CURRENT_USER = &H80000001
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
strKeyPath = "Console\%SystemRoot%_system32_cmd.exe"
oReg.CreateKey HKEY_CURRENT_USER,strKeyPath
strValueName1 = "CodePage"
dwValue1 = 936
strValueName2 = "ScreenBufferSize"
dwValue2 = 98304200
strValueName3 = "WindowSize"
dwValue3 = 2818173
strValueName4 = "HistoryNoDup"
dwValue4 = 0
strValueName5 = "WindowPosition"
dwValue5 = 131068
strValueName6 = "QuickEdit"
dwValue6 = 2048
oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName1,dwValue1
oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName2,dwValue2
oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName3,dwValue3
oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName4,dwValue4
oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName5,dwValue5
oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName6,dwValue6
Dim objWSH, FinalPath
Set objWSH = WScript.CreateObject("WScript.Shell")
If (Lcase(Right(WScript.Fullname,11))="wscript.exe") Then
FinalPath = "'" & WScript.ScriptFullName & "'"
objWSH.Run("cmd.exe /k cscript //nologo " &Replace(FinalPath,"'",""""))
WScript.Quit
End If
oReg.DeleteKey HKEY_CURRENT_USER, strKeyPath
Set oReg = nothing
Wscript.Sleep 1000
Mystr = Array(115,111,109,101,98,111,100,121)
for i=0 to Ubound(Mystr)
 author=author&chr(Mystr(i))
next
Wscript.Echo vbCr
Wscript.echo "  Function: display the modules loaded into the running processes with their executablepath,creationTime,Manufacturer"
Wscript.echo "            to help make your analysis easier."
Wscript.Sleep 5000
Wscript.Echo vbCr
Wscript.echo "  code by " & author
Wscript.Echo vbCr
Wscript.Sleep 2000
Wscript.echo "  Email: [email=kumho.lin@gmail.com]kumho.lin@gmail.com[/email]"
Wscript.Echo vbCr
Wscript.Sleep 1000
Wscript.echo "  LastModified: 18:50,28-3-2008"
Wscript.Sleep 3000
Wscript.Echo vbCr
str1 = "                               �q�����r�q�����r�q�q���r�q�����r�q�����r�q�����r�������r�q�r�q�r"
str4 = "                               �t���r�������������q�r�����q���s���q�r�r����������������� ����� "
str6 = "                               �t�����s�t�����s�t�s�t�s�t�����s�t�����s�t�����s�������s� �t�s� "
str3 = "                               ���t���r�������������������t���r���t�s�s�����������������t�r�q�s"
str5 = "                               �q���s�����t�s�������������t���r���t�s�����t�s�����t�s��� ����� "
str2 = "                               ���q���s���q�r����� � �����q���s���q�r�����q�r�����q�r�����t�s��"
myArray = Array(str1,str2,str3,str4,str5,str6)
For each str in myArray
 Wscript.Echo str
Next
WScript.Echo
WScript.Sleep 4000
WScript.Echo "Summary information of the running processes:"
WScript.Echo vbCrLf
WScript.Sleep 2000
Dim MyOBJProcessName
Set OBJWMIProcess = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * From Win32_Process")
      WScript.Echo "Name:               Priority:   PID:    Owner:" &vbTab&vbTab&"ExecutablePath: "
      WScript.Echo "---------------------------------------------------------------------------------------"
For Each OBJProcess in OBJWMIProcess
      MyOBJProcessName=OBJProcess.Name&"                    "
colProperties = OBJProcess.GetOwner(strNameOfUser,strUserDomain)
      WScript.Echo Mid(MyOBJProcessName,1,20) &vbTab& OBJProcess.Priority &vbTab& OBJProcess.ProcessID &vbTab& strNameOfUser &vbTab&vbTab& OBJProcess.ExecutablePath
      Next

WScript.Sleep 5000
WScript.Echo vbCrLf
WScript.Echo "Detail information of the modules loaded into the running processes:"
WScript.Echo vbCrLf
WScript.Sleep 3000
WScript.Echo vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab& vbTab&"CreationTime          Manufacturer"
Set OBJWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set OBJRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = OBJRefresher.AddEnum(OBJWMIService,"Win32_PerfFormattedData_PerfProc_FullImage_Costly").ObjectSet
OBJRefresher.Refresh
For Each OBJItem In colItems
 Dim originalPath, ModulePath, WMIPathMode, FileManufacturer, LCaseModulePath
Dim FileExtension, mark, MyLCaseModulePath, FinalModulePath
 originalPath = OBJItem.Name
 ModulePath = Split(originalPath,"/")
 WMIPathMode = Replace(ModulePath(1),"\","\\")
 Set OBJWMI = GetObject("winmgmts:\\.\root\CIMV2")
 Set colManufacturer = OBJWMI.ExecQuery("SELECT * FROM CIM_DataFile Where Name='" & WMIPathMode & "'")
 For Each OBJManufacturer In colManufacturer
 FileManufacturer=Trim(OBJManufacturer.Manufacturer)
 LCaseModulePath=LCase(Trim(OBJManufacturer.Name))
 FileExtension=Right(LCaseModulePath, 3)
 MyLCaseModulePath=LCaseModulePath & "                                                                                                                "
  Set FSO = CreateObject("Scripting.FileSystemObject").GetFile(LCaseModulePath)
     If FileExtension="exe" Then
       mark="����"
    FinalModulePath=Mid(MyLCaseModulePath,1,118)
    WScript.Echo "��"    
   Else 
             mark="������"
    FinalModulePath=Mid(MyLCaseModulePath,1,116)
   End If
  WScript.Echo mark & FinalModulePath & FSO.DateCreated &vbTab& FileManufacturer    
Next
Next
MyVBSPath = "'" & WScript.ScriptFullName & "'" 
Myclipboard = "cscript //nologo " & Replace(MyVBSPath,"'","""")
Set objIE = CreateObject("InternetExplorer.Application")  
objIE.Navigate("about:blank")  
objIE.document.parentwindow.clipboardData.SetData "text", Myclipboard

preview:
I'm a Chinese,so maybe you can't understand some of the Chinese characters in the preview screenshots,but it doesn't bother you to understand.

< Message edited by somebody -- 4/2/2008 5:07:17 AM >

_____________________________

anti-virus software is dying if there is no update of its technology ,I believe.

Revisions: 2 | Post #: 1

RE: display the modules loaded into the running processes - 4/6/2008 2:10:56 AM

wanghuok

Posts: 17
Score: 0
Joined: 10/13/2005
Status: offline

wonderful, the script you write is very goog,i am chinese too, and my english is very poor.

< Message edited by wanghuok -- 4/6/2008 2:14:24 AM >

_____________________________

I come from China,This is a very beautiful country.

Welcome to China.

(in reply to somebody)

Revisions: 1 | Post #: 2

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.

All Forums >> [Scripting] >> Post a VBScript >> display the modules loaded into the running processes

Page: [1]

Jump to:

New Messages	No New Messages
Hot Topic w/ New Messages	Hot Topic w/o New Messages
Locked w/ New Messages	Locked w/o New Messages

Post New Thread

Reply to Message

Post New Poll

Submit Vote

Delete My Own Post

Delete My Own Thread

Rate Posts