home *** CD-ROM | disk | FTP | other *** search
- ; Collects generic Windows information - no product specific content here
-
- set DrWatsonDefaultLogFilePath filepath "%COMMON_APPDATA%\Microsoft\Dr Watson"
- set DrWatsonDefaultCrashDumpFile filepath "%DrWatsonDefaultLogFilePath%\user.dmp"
- set DrWatsonLogFilePath registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DrWatson\LogFilePath"
- set DrWatsonCrashDumpFile registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DrWatson\CrashDumpFile"
-
- ; Basic information
- builtin set basic\set.log
- builtin OSVersion basic\osver.log
- builtin hardware basic\hardware.log
-
- ; Event logs
- builtin eventlog application win\eventlog\application.evt
- builtin eventlog system win\eventlog\system.evt
- builtin eventlog security win\eventlog\security.evt
-
- ; Crash dumps from system
- "%DrWatsonDefaultLogFilePath%\*.log" crash\default\
- "%DrWatsonLogFilePath%\*.log" crash\
- "%DrWatsonDefaultCrashDumpFile%" crash\default\user.dmp
- "%DrWatsonCrashDumpFile%" crash\user.dmp
- "%WINDOWS%\Minidump\*.dmp" crash\vistadumps\
-
- ; Network info
- registry "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards\" network\nic.log
- run "%SYSTEM32%\ipconfig.exe" "/all" network\ipconfig.log timeout=20
- run "%SYSTEM32%\netstat.exe" "-an" network\netstat.log timeout=10
- run "%SYSTEM32%\nslookup.exe" "www.f-secure.com" network\nslookup.log timeout=20
- run "%SYSTEM32%\route.exe" "print" network\route.log timeout=10
- run "%SYSTEM32%\ping.exe" "www.f-secure.com" network\ping.log timeout=15
- run "%SYSTEM32%\ping.exe" "download.sp.f-secure.com" network\ping_download_sp.log timeout=15
- run "%SYSTEM32%\net.exe" "use" network\netuse.log timeout=10
- run "%SYSTEM32%\net.exe" "start" network\netstart.log timeout=10
- "%SYSTEM32%\drivers\etc\hosts" win\hosts
-
- ; all services
- registry "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services" win\registry\reg_services.log
-
- ; startup programs
- registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" win\registry\reg_run.log
- registry "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices" win\registry\reg_runservices.log
- registry "HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\App Paths" win\registry\reg_apppaths.log
- registry "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" win\registry\reg_startupapproved.log
-
- ; pending rename operations
- registry "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\FileRenameOperations" win\registry\reg_rename.log
- registry "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations" win\registry\reg_pending_rename.log
- "%WINDOWS%\Logs\CBS\cbs.log" win\cbs.log
-
- ; uninstall information
- registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" win\registry\reg_uninst.log
-
- ; Special paths
- registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" win\registry\reg_shell_folders.log
- registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" win\registry\reg_user_shell_folders.log
- registry "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" win\registry\reg_environment.log
-
- ; IE version information
- registry "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer" win\iexplore\reg_ie.log
- registry "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" win\iexplore\reg_hklm_internet_settings.log
- registry "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" win\iexplore\reg_hkcu_internet_settings.log
-
- ; active and inactive drivers (running services visible in netstart.log)
- run "%SYSTEM32%\sc.exe" "query type= driver" win\drivers_active.log
- run "%SYSTEM32%\sc.exe" "query type= driver state= inactive" win\drivers_inactive.log
-
- ; MSI upgradecodes
- registry "HKEY_CLASSES_ROOT\Installer\UpgradeCodes" win\msi\upgradecodes_hkcr.log
- registry "HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes" win\msi\upgradecodes_classes.log
- registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes" win\msi\upgradecodes.log
-
- ; MSI Products
- registry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18" win\msi\products.log
-
- ; F-Secure Generic data
- registry "HKEY_LOCAL_MACHINE\SOFTWARE\F-Secure" f-secure\reg_fs.log
- registry "HKEY_LOCAL_MACHINE\SOFTWARE\Data Fellows" f-secure\reg_df.log
-
- list "%COMMON_APPDATA%\F-Secure" f-secure\filelist-programdata.txt recursive
- "%COMMON_APPDATA%\F-Secure\Logs\" f-secure\logs\ recursive
-