Month: May 2015

This is a simple script to install IE10. Good for SCCM or LANDesk. If you don’t want to create your own package, try using Microsoft’s IEAK to generate an EXE or MSI.

The 32.exe contains the extracted IE install files.

@echo on

:: Set Current Directory
Set CurDir=%CD%

:: Extract files
"%CurDir%\32.exe"

:: Install IE10 cab
dism.exe /online /add-package /packagepath:%CurDir%\IE-Win7.CAB /quiet /norestart /logpath:C:\Windows\Logs\Microsoft_IE_10.log

:: EXIT WITH CODE
exit /b 0

:: --------- OTHER STUFF ---------

:: NOTES - How to extract files
:: IE10-Windows6.1-x86-en-us.exe /x:C:\EXTRACT

:: Install IE10 EXE
"%CurDir%\IE10-Windows6.1-x86-en-us.exe" /quiet /update-no /closeprograms /norestart

:: Install IE10 CAB
Dism /Online /Add-Package /PackagePath:%CurDir%\IE-Win7.CAB /norestart
Dism /Online /Add-Package /PackagePath:%CurDir%\IE-Spelling-NEU.MSU /norestart
Dism /Online /Add-Package /PackagePath:%CurDir%\IE-Hyphenation-NEU.MSU /norestart

:: Updates that may be needed
"%CurDir%\Windows6.1-KB2729094-v2-x64.msu" /quiet /norestart
"%CurDir%\Windows6.1-KB2731771-x64.msu" /quiet /norestart
"%CurDir%\Windows6.1-KB2533623-x64.msu" /quiet /norestart
"%CurDir%\Windows6.1-KB2670838-x64.msu" /quiet /norestart
"%CurDir%\Windows6.1-KB2786081-x64.msu" /quiet /norestart

:: Disable Auto Upgrade
:: Windows Registry Editor Version 5.00

::[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
:: "EnableAutoUpgrade"=dword:00000000

I created this while in a forensics computer course:

On error resume next

'SET VARIABLES
Dim objFSO, objTextStream
Const ForWriting = 2
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextStream = objFSO.OpenTextFile("Computer_Forensics.txt", ForWriting, True)

'SET STARTING PATH
Call RecursiveFolders("C:\")
objTextStream.Close()

'SUBROUTINE FOR CHECKING EXTENSIONS - TXT CAN BE CHANGED TO WHATEVER YOU'RE LOOKING FOR
Sub RecursiveFolders(strFolderPath)
Dim objFolder, objFile, objSubFolder
Set objFolder = objFSO.GetFolder(strFolderPath)

For Each objFile In objFolder.Files
If (InStr(objFile.Name, ".") > 0) Then
If (LCase(Mid(objFile.Name, InStrRev(objFile.Name, "."))) = ".txt") Then objTextStream.WriteLine(objfile.Path)
End If
Next

For Each objSubFolder In objFolder.SubFolders
Call RecursiveFolders(objSubFolder.Path)
Next
End Sub

Check folders, delete only empty folders.

'SET PATH - ADD THE STARTING PATH HERE EX. C:\TEMP
strFolderName = "FolderPath"

'VARIABLES
Dim objFSO, objFolder
'Setting Object for FileSystem
Set objFSO = CreateObject("Scripting.FileSystemObject")

'CHECK PATH
If objFSO.FolderExists(strFolderName) Then

Set objFolder = objFSO.GetFolder(strFolderName)

'CHECK SUBFOLDERS
If objFolder.Files.Count = 0 And objFolder.SubFolders.Count = 0 Then
msgbox "Folder is Empty"
'DELETE FOLDER IF EMPTY
objFSO.DeleteFolder strFolderName
'VERIFY DELETION
If objFSO.FolderExists(strFolderName) Then
msgbox "Folder was not deleted!"
Else
msgbox "Folder was deleted!"
End If
Else
msgbox "Folder is not epty!"
End If
Else
msgbox "Folder does not exist!"
End If

'CLEAR SESSION
Set objFSO = Nothing

If you click the Windows Volume Control and it does nothing, do this:

1.Click Start, type regedit in the Start Search box, and then press ENTER. If you are prompted for an administrator password or for confirmation, type the password, or click Allow.

2.Locate and then click the following registry subkey: HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify

3.In the Details pane, click the IconStreams registry entry.

4.On the Edit menu, click Delete, and then click Yes.

5.In the Details pane, click the PastIconsStream registry entry.

6.On the Edit menu, click Delete, and then click Yes.

7.Exit Registry Editor.

8.Either restart the computer or the Explorer.exe process.

Or, run these

reg delete “HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify” /v IconStreams /f

reg delete “HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify” /v PastIconStream /f

Server
netsh interface ip add dns name=”Local Area Connection” addr=10.0.0.1

netsh interface ip add dns name=”Local Area Connection” addr=10.0.0.2 index=2

or

Workstation
netsh interface ipv4 set dns name=”Local Area Connection” static 10.0.0.1 primary
netsh interface ipv4 add dns name=”Local Area Connection” 10.0.0.2

This is how you rebuild the Icon Cache Database.

You’ll know you need to do this when icons don’t match applications, when shortcuts or green icons appear as overlays, or the icons have turned white.

What causes this?

A corrupted IconCache.db file, along with associated cached data.

Steps

1. Close all folder windows that are currently open.

2. Launch Task Manager using the CTRL+SHIFT+ESC key sequence, or by running taskmgr.exe.

3. In the Process tab, right-click on the Explorer.exe process and select End Process.

4. Click the End process button when asked for confirmation.

5. From the File menu of Task Manager, select New Task (Run…)

6. Type CMD.EXE, and click OK

7. In the Command Prompt window, type the commands one by one and press ENTER after each command:

ie4uinit.exe -show
taskkill /IM explorer.exe /F
DEL /A /Q “%localappdata%\IconCache.db”
DEL /A /F /Q “%localappdata%\Microsoft\Windows\Explorer\iconcache*”

8. In Task Manager, click File, select New Task (Run…)

9. Type EXPLORER.EXE, and click OK.

Notes

Try F5, to refresh Desktop

or

Create a new folder on the Desktop
Move affected icon into new folder
Move icon back to Desktop

This is how you would read a registry key, and then output the contents to a text file.

on error resume next

UTemp = ReadReg("HKLM\SOFTWARE\MyUserName\User Name")

Function ReadReg(RegPath)
Dim objRegistry, Key
Set objRegistry = CreateObject("Wscript.shell")
Key = objRegistry.RegRead(RegPath)
ReadReg = Key
End Function

If UTemp = "Administrator" then wscript.quit(0)

Set objShell = CreateObject("Wscript.Shell")
'msgbox UTemp
objShell.Run "%comspec% /c echo " & UTemp & ">un.dat",0,true

During the post-setup stage of imaging, I noticed that choose your network location was popping up when installing network card drivers. To close that pop-up, I created this in AutoIt.

Opt("TrayIconHide", 1) ;0=show, 1=hide tray icon

Global $i = 0
DO
Sleep(1000)
If WinExists("Set Network Location") Then
WinActivate("Set Network Location")
Send("{ESC}")
EndIf
;$i = $i + 1
UNTIL $i > 120