Welcome to PcCare.com

Home Support Self Help

PcCare Logger

Keep an eye on your IT environment.

Prepare for your next root cause analysis! Free downloadable command file executes suite of Microsoft Resource and SysInternals utilities.

Answers the question, What's the last change made to this workstation or server?

Login using an account assigned Administrator access level (Administrators group) before running PcCare installation. System may require Microsoft .net Framework 4 Client install, when complete, re-visit pccare and restart installation.

Download

Download Microsoft's Sysinternals utilities separately. Uzip contents of downloaded SysinternalsSuite.zip file to directory "xxx:\Program Files\TechnoChill Incorporated\PcCare" or on 64 bits systems C:\Program Files (x86)\TechnoChill Incorporated\PcCare (you must have administrative rights during file unzip and copy).

Sysinternals Suite

Download Microsoft's Windows® Server 2003 Resource Kit Tools. Install to default directory "xxx:\Program Files\Windows Resource Kits\Tools".

Windows Server 2003 Resource Kit Tools Download Microsoft's Windows® Server 2003 Resource Kit Tools. Install to default directory "xxx:\Program Files\Windows Resource Kits\Tools".

subInAcl.exe installed during last step requires an updated version. Install into same directory as Resource kit above, "xxx:\Program Files\Windows Resource Kits\Tools".

SubInACL (SubInACL.exe)

Viewer under development. Download with Inernet Explorer.

PcCare runs as a service and will not start until your next reboot. It can also be started by using Windows Management Console. Once started, logs should start appearing in xxx:\windows\temp\pccare. Note that pccare runs on a timer and can sleep up to 10 minutes after startup before creating logs.

Sysinternals Suite logs files are written to subdirectory PcCare inside %TEMP%, normally "c:\windows\temp".

Why use PcCare?

Rootkit Detection

Adds sophisticated logging to your servers and workstations.

Quickly identifies differences between servers.

Quickly identifies timing of changes to individual servers.

Uncovers changes made by viruses.

Perfect for server file and registry audits.

Verification of existing and new server builds.

Discover dll inconsistancies.

Simple command file executes Microsoft tools.

Server infomation at your finger tips.

Historical time sensitive context. Answers what, when and how.

Provides system snapshots, not available through normal system event and audit logs.

Root cause analysis.

Crash analysis.

Performance analysis.

Indespensible tool for Microsoft Windows workstation/server maintenance, don't be infected without it!

Description of services

Command file executes as Windows Service (install utility included), calls diagnostic utilities and sleeps.

Monthly:

Sigcheck.exe - Program version comparisons and virus detection.
Registry dump to text file, for comparisons, not backup.
Streams.exe - Hidden file streams
accesschk.exe - As a part of ensuring that they've created a secure environment Windows administrators often need to know what kind of accesses specific users or groups have to resources including files, directories, Registry keys, global objects and Windows services. AccessChk quickly answers these questions with an intuitive interface and output.
Dir.exe - File list.
SubInACL.exe - Registry and file permissions.

Daily (differences) and Montly:

OH.exe - Process open handles. Diagnose system resource usage.
ListDlls.exe - Lists process dlls. Useful for dll mismatches.
Autorunsc.exe - System startup programs. Useful for virus detection and slow restart analysis.
tcpvcon.exe - Network connections.
System drive directory listing.
Psinfo.exe - Programs and various system infomation.
Psfile.exe - Lists remotely opened files.

PcCareRun.cmd

echo on

Rem *******************************************************************
rem
rem PcCareLoggerRun 
rem
rem 		Executes re-occuring resource and sysinternal utilities
rem
rem PcCareLoggerRun -force 
rem 
rem		forces all utilites to run a single time, useful for triaging errors
rem
rem PcCareLoggerRun -offline
rem 
rem		creates text dumps of offline registry 
rem 
rem PcCareLoggerRun -force -offline
rem 
rem		runs both switches
rem 
rem
rem For custom script changes, Visit PcCare.com.
rem
rem /* ================================================================================ 
rem  * Copyright (C) 2010, Mark Naughton, TechnoChill Inc. (http://www.PcCare.com)
rem  * All rights reserved.
rem  * 
rem  * Redistribution and use in source and binary forms, with or without modification, 
rem  * are permitted provided that the following conditions are met:
rem  * 
rem  *		* Neither the names of Mark Naughton or TechnoChill nor the names of its 
rem  *		  contributors may be used to endorse or promote products derived from this 
rem  *		  software without specific prior written permission. 
rem  * 
rem  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
rem  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
rem  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 
rem  * IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 
rem  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 
rem  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 
rem  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY 
rem  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 
rem  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, 
rem  * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
rem  * ================================================================================ */
rem
rem ******************************************************************

set Path=C:\Program Files\Windows Resource Kits\Tools;%Path%

set TempPath=%LogDir%

if not exist %TempPath% mkdir %TempPath%

set TempPathMonth=%TempPath%\%YearMon%

if not exist %TempPathMonth% mkdir %TempPathMonth%

set TempPathToday=%TempPathMonth%\%today%

if not exist %TempPathToday% mkdir %TempPathToday%
 
 
set PcCare_Cmd_Output=%TempPath%\PcCare_Cmd_Output.txt
set PcCareLogger_Temp_Today=%TempPathToday%\PcCareLogger_Temp_Today.txt
set PcCareLogger_Temp_Month=%TempPathMonth%\PcCareLogger_Temp_Month.txt

rem check if output logs have been hung open by a previous proces
rem if so kill all  open listdlls,oh,sigcheck processes

if exist "%PcCareLogger_Temp_Today%" del /q "%PcCareLogger_Temp_Today%"
if exist "%PcCareLogger_Temp_Month%" del /q "%PcCareLogger_Temp_Month%"

rem kill all processes which may have open handles to these files

if exist "%PcCareLogger_Temp_Today%" pskill  -accepteula oh.exe
if exist "%PcCareLogger_Temp_Today%" pskill  -accepteula listdlls.exe
if exist "%PcCareLogger_Temp_Today%" pskill  -accepteula autorunsc.exe
if exist "%PcCareLogger_Temp_Today%" pskill  -accepteula tcpvcon.exe
if exist "%PcCareLogger_Temp_Month%" pskill  -accepteula sigcheck.exe
if exist "%PcCareLogger_Temp_Month%" pskill  -accepteula regedit.exe

if exist "%PcCareLogger_Temp_Today%" del /q "%PcCareLogger_Temp_Today%"
if exist "%PcCareLogger_Temp_Month%" del /q "%PcCareLogger_Temp_Month%"

if exist "%PcCareLogger_Temp_Today%" echo File handle open from previous incomplete run >> "%ErrorLog%"
if exist "%PcCareLogger_Temp_Today%" goto :Status

if exist "%PcCareLogger_Temp_Month%" echo File handle open from previous incomplete run >> "%ErrorLog%"
if exist "%PcCareLogger_Temp_Month%" goto :Status

set PcCareLoggerAutoruns=%TempPathToday%\AutoRuns_PcCareLogger.txt
set PcCareLoggerSigCheck=%TempPathMonth%\SigCheck_PcCareLogger.txt
set PcCareLoggerFailed=%TempPath%\PcCareLogger_Failed_%DateAndTime%.txt
set PcCareLoggerSuccess=%TempPath%\PcCareLogger_Success_%DateAndTime%.txt

set PcCareLoggerListDLLs=%TempPathToday%\ListDLLs_PcCareLogger.txt
set PcCareLoggerOH=%TempPathToday%\OH_PcCareLogger.txt
set PcCareLoggertcpvcon=%TempPathToday%\tcpvcon_PcCareLogger.txt
set PcCareLoggerFileList=%TempPathMonth%\Dir_PcCareLogger.txt

set PcCareLoggerStreams=%TempPathMonth%\Streams_PcCareLogger.txt
set PcCareLoggerPsFile=%TempPathToday%\PsFile_PcCareLogger.txt
set PcCareLoggerPsInfo=%PcCareLogger_Temp_Month%\PsInfo_PcCareLogger.txt

set PcCareLoggerAccessChkHKLM=%TempPathToday%\AccessChk_Hklm_PcCareLogger.txt
set PcCareLoggerAccessChkHKCR=%TempPathToday%\AccessChk_Hkcr_PcCareLogger.txt
set PcCareLoggerAccessChkHKUS=%TempPathToday%\AccessChk_Hkus_PcCareLogger.txt
set PcCareLoggerAccessChkHKCU=%TempPathToday%\AccessChk_Hkcu_PcCareLogger.txt
set PcCareLoggerAccessChkFILES=%TempPathToday%\AccessChk_Files_PcCareLogger.txt

set PcCareLoggerRegistry=%TempPathMonth%\Registry_HKLM.Reg

set Perm_File=Registry_subInACL.txt

set TempFile=%TempPath%\TempFile_%DateAndTime%.txt

rem must add paths when in offline mode
set path=%path%;C:\Program Files\Windows Resource Kits\Tools;c:\windows

Rem custom setup

if exist "Custom.cmd" Call Custom.cmd

:PsFile

if exist "%PcCareLoggerPsFile%" goto :PsFileEnd

rem check if sigcheck available
PsFile -accepteula /? 1> "%PcCareLogger_Temp_Today%" 2>&1
type "%PcCareLogger_Temp_Today%"  | find  /I "not recognized" 
if not errorlevel 1 echo PsFile.exe utility not found. download from "http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx" >> "%ErrorLog%"
if not errorlevel 1 goto :PsFileEnd

set command=PsFile -accepteula
echo PsFile start  >> con
%command% > "%PcCareLogger_Temp_Today%"
echo PsFile end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :PsFileEnd

ren "%PcCareLogger_Temp_Today%" PsFile_PcCareLogger.txt

if '%force%' == 'false' goto :Status

:PsFileEnd

:PsInfo

if exist "%PcCareLoggerPsInfo%" goto :PsInfoEnd

rem check if sigcheck available
PsInfo -accepteula /? 1> "%PcCareLogger_Temp_Month%" 2>&1
type "%PcCareLogger_Temp_Month%"  | find  /I "not recognized" 
if not errorlevel 1 echo PsInfo.exe utility not found. download from "http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx" >> "%ErrorLog%"
if not errorlevel 1 goto :PsInfoEnd

set command=psinfo -accepteula -h -s -d
echo PsInfo start  >> con
%command% > "%PcCareLogger_Temp_Month%"
echo PsInfo end  >> con
rem No errorcheck, returns errorlevel = 1

ren "%PcCareLogger_Temp_Month%" PsInfo_PcCareLogger.txt

if '%force%' == 'false' goto :Status

:PsInfoEnd

:PsInfoDiffs

if exist "%TempPathToday%\PsInfo_diffs.txt" goto :PsInfoDiffsEnd

rem must have monthly file to compare against
if not exist  "%PcCareLoggerPsInfo%" goto :PsInfoDiffsEnd

set command=psinfo -accepteula -h -s -d
echo PsInfo Diff start  >> con
%command% > "%PcCareLogger_Temp_Today%"
echo PsInfo Diff end  >> con
rem No errorcheck, returns errorlevel = 1

fc /l "%PcCareLogger_Temp_Today%"  "%PcCareLoggerPsInfo%" > "%TempPathToday%\PsInfo_diffs.txt"

:PsInfoDiffsEnd

:Streams

if exist "%PcCareLoggerStreams%" goto :StreamsEnd

rem check if AccessChk available
Streams -accepteula /? 1> "%PcCareLogger_Temp_Today%" 2>&1
type "%PcCareLogger_Temp_Today%"  | find  /I "not recognized" 
if not errorlevel 1 echo Streams.exe utility not found. download from "http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx" >> "%ErrorLog%"
if not errorlevel 1 goto :StreamsEnd

set command=Streams -accepteula -s %SysDrive%\
echo Streams FILES start  >> con
%command% > "%PcCareLogger_Temp_Month%"
echo Streams FILES end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :StreamsEnd

ren "%PcCareLogger_Temp_Month%" Streams_PcCareLogger.txt

if '%force%' == 'false' goto :Status

:StreamsEnd

:ListFilesStart

if exist "%PcCareLoggerFileList%" goto :ListDLLsEnd

set command=dir /b /s /AH /AS %SysDrive%\*.*
echo File List start  >> con
%command%  1>  "%PcCareLogger_Temp_Month%"  2>&1
echo File List end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :ListFilesEnd

ren "%PcCareLogger_Temp_Month%" Dir_PcCareLogger.txt

if '%force%' == 'false' goto :Status

:ListFilesEnd

:ListFileDiffs

if exist "%TempPathToday%\Dir_diffs.txt" goto :ListFileDiffsEnd

rem must have monthly file to compare against
if not exist  "%PcCareLoggerFileList%" goto :ListFileDiffsEnd

rem see if we have the monthly autoruns to compare against

set command=dir /b /s /AH /AS %SysDrive%\*.*
echo File List start  >> con
%command%  1>  "%PcCareLogger_Temp_Today%"  2>&1
echo File List end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :ListFileDiffsEnd

fc /l "%PcCareLogger_Temp_Today%"  "%PcCareLoggerFileList%" > "%TempPathToday%\Dir_diffs.txt"

:ListFileDiffsEnd

:ListDLLStart

if exist "%PcCareLoggerListDLLs%" goto :ListDLLsEnd

rem check if ListDLLs available

rem can't run listdlls test, it pops up a eula window, fix is to add this reg key
reg add HKCU\Software\Sysinternals\ListDLLs /v EulaAccepted /t REG_DWORD /d 1 /f  1> "%TempFile%" 2>&1

set command=ListDLLs
echo ListDLLs start  >> con
%command%  1>  "%PcCareLogger_Temp_Today%"  2>&1
echo ListDLLs end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :ListDLLsEnd
ren "%PcCareLogger_Temp_Today%" ListDLLs_PcCareLogger.txt

if '%force%' == 'false' goto :Status

:ListDLLsEnd

:tcpvcon

if exist "%PcCareLoggertcpvcon%" goto :tcpvconEnd

rem check if tcpvconEnd available
tcpvcon -accepteula  /? 1> "%PcCareLogger_Temp_Today%" 2>&1
type "%PcCareLogger_Temp_Today%"  | find  /I "not recognized" 
if not errorlevel 1 echo tcpvcon utility not found. download from "http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx" >> "%ErrorLog%"
if not errorlevel 1 goto :tcpvconEnd

set command=tcpvcon -accepteula -a -c 
echo tcpvcon start  >> con
%command%  1> "%PcCareLogger_Temp_Today%" 2>&1
echo tcpvcon end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :tcpvconEnd
ren "%PcCareLogger_Temp_Today%" tcpvcon_PcCareLogger.txt

if '%force%' == 'false' goto :Status

:tcpvconEnd

:OH

if exist "%PcCareLoggerOH%" goto :oHEnd

rem check if OH available
oh +otl 1> "%PcCareLogger_Temp_Today%" 2>&1
type "%PcCareLogger_Temp_Todayd%"  | find  /I "not recognized" 
if not errorlevel 1 echo oH utility not found. download from "http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx" >> "%ErrorLog%"
if not errorlevel 1 goto :oHEnd

set command=OH
echo oh start  >> con
%command%  1> "%PcCareLogger_Temp_Today%"  2>&1
echo oh end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :oHEnd
ren "%PcCareLogger_Temp_Today%" OH_PcCareLogger.txt

if '%force%' == 'false' goto :Status

:oHEnd

:RegOfflineDump

if '%Offline%' == 'false' goto :RegOfflineDumpEnd

set UserHive=false

Call :RegOfflineLoadHive "C:\Windows\System32\config\SOFTWARE"
Call :RegOfflineLoadHive "C:\Windows\System32\config\COMPONENTS"
Call :RegOfflineLoadHive "C:\Windows\System32\config\DEFAULT"
Call :RegOfflineLoadHive "C:\Windows\System32\config\SAM"
Call :RegOfflineLoadHive "C:\Windows\System32\config\SECURITY"
Call :RegOfflineLoadHive "C:\Windows\System32\config\SYSTEM"

set UserHive=true

if not exist c:\users goto :xpRegDump

for /f "tokens=*" %%i in ('dir /b /ah /s c:\users\ntuser*.DAT') do call :RegOfflineLoadHive %%i

for /f "tokens=*" %%i in ('dir /b /s c:\users\ntuser*.DAT') do call :RegOfflineLoadHive %%i

goto :RegDumpLog

:xpRegDump

for /f "tokens=*" %%i in ('dir /b /ah /s "c:\documents and settings\ntuser*.DAT"') do call :RegOfflineLoadHive %%i

for /f "tokens=*" %%i in ('dir /b /s "c:\documents and settings\ntuser*.DAT"') do call :RegOfflineLoadHive %%i

:RegDumpLog

if '%force%' == 'false' goto :Status

goto :RegOfflineDumpEnd

:RegOfflineLoadHive

echo %* | find /i "pccarelogger"
if not errorlevel 1 goto :EOF

for /f "tokens=*" %%i in ('echo %*') do set lDrive=%%~di&set lPath=%%~pi&set lname=%%~nxi

if '%UserHive%' == 'true' for /f "tokens=1,2,3,* delims=\"  %%i in ('echo %*') do set UserName=%%k

if exist %TempPathMonth%\%lPath%%lname% goto :CheckRegTextDump

if not exist %TempPathMonth%\%lPath% mkdir %TempPathMonth%\%lPath%

set command=xcopy  /y /h %lDrive%\%lPath%%lname% %TempPathMonth%\%lPath%Temp
echo Backup file %lDrive%\%lPath%%lname% start  >> con
%command%  1> "%PcCareLogger_Temp_Month%"  2>&1
echo Backup file %lDrive%\%lPath%%lname% end   >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :RegOfflineDumpCleanup

ren %TempPathMonth%\%lPath%Temp %lname%

:CheckRegTextDump

if exist %TempPathMonth%\%lPath%%lname%.Reg goto :CheckRegPerms

if not exist %TempPathMonth%\%lPath% mkdir %TempPathMonth%\%lPath%

reg UNLOAD HKLM\PcCareLogger_Key

set command=reg LOAD HKLM\PcCareLogger_Key %lDrive%\%lPath%%lname%
echo Reg Load %lname% start  >> con
%command%  1> "%PcCareLogger_Temp_Month%"  2>&1
echo Reg Load %lname% end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :RegOfflineDumpCleanup

set command=cmd /c regedit /e "%TempPathMonth%\%lPath%temp.Reg" HKLM\PcCareLogger_Key

rem If you want to create a new registry from the exported text file and replace the existing registry files
rem type the following command at the command prompt, and then press ENTER: 
rem regedit /c registry.txt

echo Reg Text Dump HKLM\%lname% start  >> con
%command%
echo Reg Text Dump HKLM\%lname%  end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :RegOfflineDumpCleanup

if '%UserHive%' == 'false' type "%TempPathMonth%\%lPath%temp.Reg" | cscript /nologo ReplaceText.vbs PcCareLogger_Key %lname% | "%TempPathMonth%\%lPath%tempFix.Reg"

if '%UserHive%' == 'false' ren "%TempPathMonth%\%lPath%tempFix.Reg" %lname%.Reg

if '%UserHive%' == 'false' del "%TempPathMonth%\%lPath%temp.Reg"

if '%UserHive%' == 'true' ren "%TempPathMonth%\%lPath%temp.Reg" %lname%.Reg

:CheckRegPerms

if exist %TempPathMonth%\%lPath%%lname%.txt goto :RegOfflineDumpCleanup

if not exist %TempPathMonth%\%lPath% mkdir %TempPathMonth%\%lPath%

set command=subInACL /noverbose /output="%TempPathMonth%\%lPath%temp.Reg" /subkeyreg HKEY_LOCAL_MACHINE\PcCareLogger_Key /display=sddl

echo subInACL start  >> con
%command%
echo subInACL end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :RegOfflineDumpCleanup

ren "%TempPathMonth%\%lPath%temp.Reg" %lname%.txt

:RegOfflineDumpCleanup

reg UNLOAD HKLM\PcCareLogger_Key

goto :EOF

:RegOfflineDumpEnd

:RegOnlineDump

if '%Offline%' == 'true' goto :RegOnlineDumpEnd

set UserHive=false

for /f "tokens=*" %%i in ('reg query HKLM') do call :RegDumpHive "%%i"

set UserHive=true

for /f "tokens=*" %%i in ('reg query HKU') do call :RegDumpHive "%%i"

:RegEnd

if '%force%' == 'false' goto :Status

goto :RegOnlineDumpEnd

:RegDumpHive

echo %* | findstr /i "HKEY_LOCAL_MACHINE HKEY_USERS"
if errorlevel 1 goto :EOF

set key=%*

set key=%key:"=%

for /f "tokens=1,2,* delims=\."  %%i in ('echo %key%') do set UserName=%%j

set Sid=%UserName%

echo %UserName% | find /i "Default"
if not errorlevel 1 goto :RegOnlineNoSid

if '%UserHive%' == 'true' for /f "tokens=1,2,* delims=\"   %%i in ('psgetsid  -accepteula  "%UserName%" ^| findstr /i "User Group" ') do set UserName=%%j

:RegOnlineNoSid

rem remove quote
set UserName=%UserName:"=%

echo %key% | find /i "Classes"
if not errorlevel 1 set UserName=%UserName%_Classes

:RegistrySave

rem this step hangs xp
if '%oSystem%' == 'Xp' goto :RegistrySaveEnd

if exist "%TempPathMonth%\%UserName%" goto :RegistrySaveEnd

if not exist "%TempPathMonth%" mkdir "%TempPathMonth%"

if exist "%PcCareLogger_Temp_Month%" del "%PcCareLogger_Temp_Month%"

set command=reg save %key% "%PcCareLogger_Temp_Month%"    
echo reg save start  >> con
%command% 
echo reg save end   >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :RegistrySaveEnd

ren "%PcCareLogger_Temp_Month%" "%UserName%"

:RegistrySaveEnd

:CheckText

if exist "%TempPathMonth%\%UserName%.reg" goto :CheckTextEnd

if not exist "%TempPathMonth%" mkdir "%TempPathMonth%"

if exist "%PcCareLogger_Temp_Month%" del "%PcCareLogger_Temp_Month%"

set command=reg export %key% "%PcCareLogger_Temp_Month%"    
echo reg export start  >> con
%command%  
echo reg export end   >> con

ren "%PcCareLogger_Temp_Month%" "%UserName%.reg"

:CheckTextEnd

:RegOnlinePerms

if exist "%TempPathMonth%\%UserName%_Perms.txt" goto :RegOnlinePermsEnd

if not exist "%TempPathMonth%" mkdir "%TempPathMonth%"

if exist "%PcCareLogger_Temp_Month%" del "%PcCareLogger_Temp_Month%"

set command=subInACL /noverbose /nostatistic  /output="%PcCareLogger_Temp_Month%" /subkeyreg %key% /display=sddl
echo subInACL  start  >> con
%command%  
echo subInACL  end   >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :RegOnlinePermsEnd

ren "%PcCareLogger_Temp_Month%" "%UserName%_Perms.txt"

:RegOnlinePermsEnd

:RegOnlineAutoRuns

if '%UserHive%' == 'false' goto :RegOnlineAutoRunsEnd

if exist "%TempPathMonth%\autoruns_%UserName%.txt" goto :RegOnlineAutoRunsEnd

if not exist "%TempPathMonth%" mkdir "%TempPathMonth%"

if exist "%PcCareLogger_Temp_Month%" del "%PcCareLogger_Temp_Month%"

set command=autorunsc -accepteula -v -a -c "%UserName%" 
echo autorunsc %UserName% start  >> con
%command% > "%PcCareLogger_Temp_Month%"
echo autorunsc %UserName% end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :RegOnlineAutoRunsEnd

type "%PcCareLogger_Temp_Month%"  | find  /I "Publisher," 
if errorlevel 1 echo Autoruns failed execution >> "%ErrorLog%"
if errorlevel 1 goto :RegOnlineAutoRunsEnd

ren "%PcCareLogger_Temp_Month%" "autoruns_%UserName%.txt"

:RegOnlineAutoRunsEnd

:RegOnlineAutoRunsDiff

if '%UserHive%' == 'false' goto :RegOnlineAutoRunsDiffEnd

if exist "%TempPathToday%\autoruns_%UserName%_diffs.txt" goto :RegOnlineAutoRunsDiffEnd

rem must have monthly file to compare against
if not exist "%TempPathMonth%\autoruns_%UserName%.txt" goto :RegOnlineAutoRunsDiffEnd

if not exist "%TempPathToday%" mkdir "%TempPathToday%"

rem see if we have the monthly autoruns to compare against

set command=autorunsc -accepteula -v -a -c "%UserName%" 
echo autorunsc %UserName% start  >> con
%command% > "%PcCareLogger_Temp_Today%"
echo autorunsc %UserName% end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :RegOnlineAutoRunsDiffEnd

type "%PcCareLogger_Temp_Today%"  | find  /I "Publisher," 
if errorlevel 1 echo Autoruns failed execution >> "%ErrorLog%"
if errorlevel 1 goto :RegOnlineAutoRunsEnd

fc /l "%PcCareLogger_Temp_Today%"  "%TempPathMonth%\autoruns_%UserName%.txt" > "%TempPathToday%\autoruns_%UserName%_diffs.txt"

if not exist "%TempPathToday%\autoruns_%UserName%_diffs.txt"  goto RegOnlineAutoRunsDiffEnd

REM copy /y "%TempPathToday%\autoruns_%UserName%_diffs.txt" "C:\users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"

:RegOnlineAutoRunsDiffEnd

:RegDumpOnlineCleanup

goto :EOF

:RegOnlineDumpEnd

DumpPerms

if exist "%TempPathMonth%\%Perm_File%" goto :DumpPermsEnd

rem don't want pe registry dump, so skip if offline, see ExportOfflineHive below
if '%Offline%' == 'true' goto :DumpPermsEnd

set Perm_File=Permissions_CDrive
set command=subInACL /noverbose /nostatistic /output="%PcCareLogger_Temp_Month%" /subdirectories "c:\*.*" /display
echo DumpPerms start  >> con
%command%
echo DumpPerms end  >> con
if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
if errorlevel 1 goto :DumpPermsEnd
ren "%PcCareLogger_Temp_Month%" %Perm_File%

if '%force%' == 'false' goto :Status

:DumpPermsEnd

:SigCheck

if exist "%PcCareLoggerSigCheck%" goto :SigCheckEnd

rem check if sigcheck available
sigcheck -accepteula /? 1> "%TempFile%" 2>&1
type "%TempFile%"  | find  /I "not recognized" 
if not errorlevel 1 echo sigcheck utility not found. download from "http://technet.microsoft.com/en-us/sysinternals/bb897441.aspx" >> "%ErrorLog%"
if not errorlevel 1 goto :SigCheckEnd

set command=sigcheck -accepteula -v -q -e -s -h -c "C:\Windows\System32\catroot2" "c:\*.*"
echo sigcheck start  >> con
%command% 1>"%PcCareLogger_Temp_Month%" 2>&1
echo sigcheck end  >> con
rem if errorlevel 1 echo Command Failed: %command% >> "%ErrorLog%"
rem if errorlevel 1 goto :SigCheckEnd
ren "%PcCareLogger_Temp_Month%" SigCheck_PcCareLogger.txt

if '%force%' == 'false' goto :Status

:SigCheckEnd

:Status

echo. >> CON
echo. >> CON
if exist "%ErrorLog%" echo PcCareLogger failed with errors. >> CON
if exist "%ErrorLog%" echo. >> CON
if exist "%ErrorLog%" echo. >> CON
if exist "%ErrorLog%" type "%ErrorLog%" >> CON
if not exist "%ErrorLog%" echo PcCare Logger complete ok. >> CON
echo. >> CON
echo. >> CON

@echo. 
@echo.
@echo. 
@echo.
@if exist "%ErrorLog%" echo PcCareLogger Failed 
@if not exist "%ErrorLog%" echo PcCareLogger Success 
@echo.
@echo. 
@echo. 
@echo.

goto :EOF

:CopyFile

echo %* | find  /I "PcCareLogger"
if not errorlevel 1 goto :EOF

if exist "%PcCare_Cmd_Output%" del /q "%PcCare_Cmd_Output%"

for /f "tokens=*" %%i in ('echo %*') do set lPath=%%~pi&set lname=%%~nxi

REM Do not backup files in our backup directory

if exist  "%TempPathToday%%lPath%%lname%" goto :EOF

xcopy /h /y  "%*" "%TempPathToday%%lPath%" 1> "%PcCare_Cmd_Output%"  2>&1 
if errorlevel 1 goto :CopyError

attrib -S -H "%TempPathToday%%lPath%%lname%"
if errorlevel 1 goto :CopyError

goto :EOF

:CopyError

rem sharing violations will always occur, any users active on the workstation can not have their registry opened
rem We execute a reg save, which should back up a single active user

type %PcCare_Cmd_Output%  | find  /I "Sharing violation" 
if not errorlevel 1 goto :EOF

if errorlevel 1 echo Copy %lPath% %lname% error >> "%ErrorLog%"
if errorlevel 1 echo Copy %lPath% %lname% error >> con

goto :EOF

PcCare Viewer does not prevent system failures and can not be used as a replacement for full system backups.

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. PcCare.com will not be held responsible if changes you make cause a system failure.

Please review our Terms of Service and Privacy statement before initiating service or using this site. Microsoft® and the Office logo are trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries. PcCare Site Map. About Us

PcCare.com is owned and operated by TechnoChill Inc.