SpotCheckBilly

@michaelslamet – that did the trick! Thank you so very much. I've never really looked at URLs very closely. They say that you learn something new every day, well, I definitely learned something every time I come here for help. You guys rock! – SCB

Thank you so much for the input. @MHZ – I must have a very slow Internet connection (it's Wi-Fi), because even if I use the sleep function to add five seconds, I still don't get any input into the search box. @Mikell – your suggestion: 'ShellExecute("http://www.google.com/search?q=" & ClipGet()) works except for one minor flaw, I lose any formatting such as quotation marks, @TAB, etc. For example, one of the lines is formatted as such: ClipPut(Chr(34) & $CLSID & Chr(34) & @TAB & Chr(34) & $Filename & Chr(34)) when it inputs into the Google search box, the chr(34) (quotation mark) and the @TAB are missing. Is there some reason why the ClipGet() function would not carry over the formatting when coated as per your example? Thanks again for all your help. – SCB

Hi all, I'm sure I'm missing something stupid here, but I'm at an impasse. I've been playing around with trying to learn how to program for quite some time that actually have very little experience. There are many concepts and is not aware of and I'm sure that one of them is the cause of my difficulty. Part of the program and working to create involves pursing specific information from line items from a listbox, then inputting them to the search box on Google. I tested the pursing code by using the following: Run("Notepad") WinWaitActive("Untitled - Notepad") Send(ClipGet()) but when I modify (or should I say attempted to modify) the code to paste into the search box on Google by using this: ShellExecute("http://www.Google.com") WinWaitActive("Google - Mozilla Firefox") Send(ClipGet()) the Firefox window opens and Google loads but nothing else happens. The contents from the clipboard are not pasted into the search box. I appreciate any pointers. Thanks in advance. – SCB

A bit off-topic but relevant. Malwarebyte's Anti-Malware will only ask for a restart if it encounters something that cannot be deleted while the computer is running. To make removal more difficult, malware often ties itself to legitimate processes which of course, have to be stopped before the malicious code can be removed. However, for the most part, restarts are not necessary. Great program, isn't it?

@George: "...it's a sure bet you would have tried to include the quotes too. ..." I suspect that you are probably right. LOL @jchd -- I get a glimmer of an idea just how useful Regular Expressions can be as I rework my original block of code for my Google Search UDF. At approximately halfway through the task I've been able to get rid of probably around two thirds of my original code by using that one small RegEx. I would imagine that will be equally true when I start working on my database query. Thanks so much everyone. I truly appreciate your insight. You folks are the best and I'm pretty certain I will be back with more questions -- and by pretty certain I mean no doubt about it. -- SCB

Hey jchd, Fact of the matter is that I actually did look at the help file. What I didn't realize was that the parentheses were part of the flag. Thank you for pointing that out to me. I expect that it probably isn't the last time I'll make a mistake like that. ***big sigh*** Oh, well, that's the way we learn. Seems like there ought to be an easier way, doesn't there? -- SCB

Hi George, I did as you suggested and place the ?i at the beginning of the RegEx, thus: '?i\A.*\\(.*?\.(?:exe|dll)).*\z' When I did that, ALL of the lines returned an empty string. I also tried putting it here: '\A.*\\?i(.*?\.(?:exe|dll)).*\z' and here: '\A.*\\(.*?\.?i(?:exe|dll)).*\z' The results are still the same. The return is an empty string. When I leave ?i out altogether, everything returns correctly except for those file names which contain all uppercase characters. File names with both upper and lower case characters returned correctly. At this point, my thinking is that a.) Since I really am a newbie as far as Regular Expressions go, I'm just missing something or b.) There's something odd going on between my code and me AutoIt interpreter. I'm certain that sooner or later the issue will be resolved. In the meantime, I'll be continuing to work on other aspects of this Google search function. Hope you had a great weekend. -- SCB

Hey jchd, First of all, I like your avatar. Here are two examples that return empty strings. dRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL Strings in which the file name contains both upper and lower case characters parse properly. Example: O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll Here is the RegExp I used: '\A.*\\(.*?\.(?:exe|dll)).*\z' Hopefully you'll see something that the rest of us must. In my case it's very easy for me to miss things in a RegEx because I truly am a newbie as far as that goes. I'm having fun learning that sometimes it seems like it's one step forward and two steps back. I imagine that everyone goes through the same thing but it doesn't make it any less frustrating. LOL Hope you're having a great weekend. -- SCB

Hey everybody, I have been reworking my entire block of code for the Google Search UDF using the RegEx that ShawnW provided. So far I've been able to work out every kink except for dealing with the uppercase filenames. For instance, this: O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL returns an empty string while this: O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll Returns the file name G2AWinLogon.dll as it should. So even though the RegEx should be ignoring the case, it doesn't. This only occurs when the entire file name is uppercase characters. Any ideas? In the meantime I will continue reworking the code for the other line types of each of the different log files. Using that RegEx to parse out the filenames has allowed me to eliminate (probably) around two thirds of the code that it took before. I don't how much difference that will make (if any) in regards to the entire project, but it certainly looks a lot neater and compact. Hope everybody has a great weekend. -- SCB

Hey folks, OK, I did some work over the weekend. I haven't reworked the entire Google Search function yet, but I'm still running into something odd. Using ShawnW's example (.*?\.(?:exe|dll)), I came up with the following: Dim $sStr, $aArray, $RegEx, $Filename For $iI = 1 To $aItems[0] $regEx = '\A.*\\(.*?\.(?:exe|dll)).*\z' $aArray = StringRegExp($sStr, $regEx, 1) $Filename= _ArrayToString($aArray) NextThis worked out quite nicely for not only the Startup entries, but the other entries for which I need a filename returned. The code I used for the Startup entries is as follows this is within a Select... EndSelect loop): Case StringInStr($sStr, '.exe', 0) ;Startup Entries Dim $sStr, $Filename $aArray= _StringBetween($sStr, '[', ']', -1) $Name= _ArrayToString($aArray) Clipput(chr(34) & $Name & chr(34) & @TAB & chr(34) & $Filename & chr(34) & @LF)This code works great as expected for either .exe or .dll Startup entries. EXCEPT for: dRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE The filename in this case returns an empty string. If I got the RegEx correct, this line should have parsed properly. Suggestions? Or did I completely misunderstand ShawnW's example? Incidentally I'm currently reworking the rest of the code and so far, this seems to be the only anomaly. Of course, I'm less than half of the way through so things may change quickly. Thanks again everyone. -- SCB

Thank you folks so much for your insight. Authenticity, who has been helping me with this function since its inception, pointed out the fact that there are volumes written about Regular Expressions. I guess I would be in the "Precursor to RegEx 101" class LOL. The case sensitivity issue reared it's ugly head because for some reason, the lines produced by these log files sometimes contain all capital letters, sometimes all lowercase and occasionally both. For instance, in the "Startup" category, for the most part the file extensions are all .exe. However, occasionally we have one that has capital letters e.g. .EXE as follows: dRun: [ctfmon.exe] C:\Windows\System32\CTFMON.EXE The lines which contain a .dll or.DLL extension all run under rundll32.exe as follows (note the last example which has no file path): O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\System32\NvCpl.dll,NvStartup O4 - HKLM..Run: [NVHotkey] rundll32.exe C:\Windows\System32\nvHotkey.dll,Start O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') For these lies I removed the rundll32.exe from the string to rid myself of THAT headache. I will try your fine examples of modifications to my RegEx and report back on my success. Once again thanks a lot. I'm pretty certain that as I move along in my project, Regular Expressions will prove invaluable in the more I learn about them, the better. Have a great weekend. -- SCB

Hey dani, For my purposes, since I have several different cases that require the file name extraction, I split the Regular Expression to the following: If StringInStr($sStr, '.exe', 0) Then $regEx = '\A.*\\(.*\.exe).*\z' And: If StringInStr($sStr, '.dll', 0) Then $regEx = '\A.*\\(.*\.dll).*\z' I combined them thus: If StringInStr($sStr, '.exe', 0) Then $regEx = '\A.*\\(.*\.exe).*\z' ElseIf StringInStr($sStr, '.dll', 0) Then $regEx = '\A.*\\(.*\.dll).*\z' EndIfTo make the results available to all of the cases in which it was required, I did this: For $iI = 1 To $aItems[0] If StringInStr($sStr, '.exe', 0) Then $regEx = '\A.*\\(.*\.exe).*\z' ElseIf StringInStr($sStr, '.dll', 0) Then $regEx = '\A.*\\(.*\.dll).*\z' EndIf $aArray = StringRegExp($sStr, $regEx, 1) $Filename= _ArrayToString($aArray) EndIf Next As it turned out, this allows me to eliminate a huge amount of code. I did run into one small problem, however. The regEx appears to be case sensitive. There are instances where xxx.exe is XXX.EXE, the same being true with the .dll's. Reading through the AutoIt help file I see that it's possible to force case insensitivity by using the ? along with several other characters e.g. ?| etc. What wasn't made clear is where to place them in the regEx. To someone who is at home with Regular Expressions, this is probably a silly question, but to a complete newbie like myself, it's like translating from another language without knowing the syntax, or all of the characters for that matter. This Google search function is part of a bigger project I started to help me analyze these lengthy log files without having to read them line for line. I'm quite vision impaired due to complications of diabetes and actually reading through these long logs is very difficult. So not only is this my first attempt at writing a program, this Google search function is my first attempt at a UDF. I'm also attempting to teach myself the whole process so you can imagine that I run into quite frequent snags. Incidentally, my "improvised" code works quite nicely except for the case sensitivity. I really appreciate your insight. Thanks again. -- SCB

Well, color me embarrassed! I did a direct copy/paste and skipped right over that when I took it out of the multi-line loop. I should've looked up "Eval". Talk about a rookie mistake! I'm normally pretty obsessive about looking up stuff that I'm not familiar with. In my defense, though, I'm about two weeks into a nasty flu bug and ran out of daytime N6yQuil. I spent most of yesterday in a nighttime N6yQuil haze. Shoulda stuck with playing "Crazy Eights" and answering e-mail, 'eh? -- SCB

OK, I must have messed up here someplace. Because some of the startup entries run under the rumdll32.exe command line, I did a quick If... Then loop substituting .dll for .exe in the RegEx. Then, as you can see I replaced your original number variables with $sStr, and replaced your numeric array variable with $aArray. I used copy/paste to make sure there were no typos, then plugged the whole thing into a little test script that I use. However now I get the following error (code follows) : TESTScript.au3 (14) : ==> Subscript used with non-Array variable.: $sStr_1 = $aArray[0] $sStr_1 = $aArray^ ERROR #include <Array.au3> $sStr='dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe' If StringInStr($sStr, '.exe', 0) Then $regEx = '\A.*\[(.*)\].*\\(.*\.exe).*\z' If StringInStr($sStr, '.dll', 0) Then $regEx = '\A.*\[(.*)\].*\\(.*\.dll).*\z' EndIf EndIf $aArray= StringRegExp(Eval($sStr), $regEx, 1) $sStr_1 = $aArray[0] $sStr_2 = $aArray[1] $Name=$sStr_1 $Filename=$sStr_2 Clipput(chr(34) & $Name & chr(34) & @TAB & chr(34) & $Filename & chr(34) & @LF) Run('Notepad.exe') WinWaitActive('Untitled - Notepad') Send('^V')You can see that I also changed it back to parsing only one line at a time. Anyway, it looks to me as if the script should work. Where did I go wrong? If nothing else, working on this function has sure taught me a lot about string management LOL. Thank you so much for your help. -- SCB

Hi dani, The thought behind them wording directly to a string was that it would save me a lot of steps. Problem being, as I started playing around with it, it didn't return as I expected it to. I thought that if there were anything after the final set of quotation Mark's, it would show up after the file name. In other words it would be: Text>> File Text. I discovered rather quickly that if anything followed the file quote, the script would error out. The part of the log files we are talking about here refers to the startup section of Windows Registry, meaning programs that launch with Windows. Following is a list of what we might see in this section of the log files (all three have the exact same formatting): 'Text: [xxxx] Filepath\File' 'Text: [xxxx] "Filepath\File"' 'Text: [xxxx] Filepath\File -text' 'Text: [xxxx] Filepath\File /text' 'Text: [xxxx] "Filepath\File" -text' 'Text: [xxxx] "Filepath\File" /text' 'Text: [xxxx] text Filepath\File,text' 'Text: [xxxx] text File(no path),text' The quotation marks surrounding Filepath\File seem to just show up wherever they want to. There's no constant pattern and even experienced programmers at the security sites I belong to have no explanation. If it were just the two example strings I included with my first post, your solution would work wonderfully. However, depending on how many bells and whistles the client (I don't like to call them victims, even if they are) likes to have launch with Windows, this section of the registry can get quite lengthy. I've worked with people who've had 30+ programs launching would Windows does (including the necessary ones). So I'm still faced with the same dilemma. The code that I'm using to strip the quotes works quite nicely. Unfortunately, in lengths from the DSS log, they do not parse properly. "Don't you just love non-descriptive variable names " Yepper, good thing I have a fairly creative imagination. Coming up with short descriptive names for that many variables can challenge the sanity of even the most well adjusted person. LOL hope you're having a good weekend. -- SCB