
SaintedRogue
Active Members-
Posts
37 -
Joined
-
Last visited
SaintedRogue's Achievements

Seeker (1/7)
0
Reputation
-
ListView, Arrays, and Loops
SaintedRogue replied to SaintedRogue's topic in AutoIt General Help and Support
Excellent! Worked like a charm. Thank you so much. -
So, I've been spending some time trying to build a sort of white list application properly using Arrays and some loops, but I am coming across an issue. It works properly getting the whitelisted applications. However, when I am listing the non-whitelisted applications they're still shown there even though it's not matching and I'm running the process 4 times (not really what I want). This is what I have so far: #include <GUIConstants.au3> #include <ListViewConstants.au3> #include <WindowsConstants.au3> Global $list = ProcessList() ;List all processes Global $proc[5] = ["Explorer.exe", "Chrome.exe", "SVCHOST.exe", "Services.exe", "conhost.exe"] GUICreate("Processes", 510, 700) $run = GUICtrlCreateButton("GET PROCESSES", 10, 660, 100, 30) GUICtrlCreateLabel("Whitelisted Processes", 20, 10) $view = GUICtrlCreateListView("Process | PID", 10, 30, 230, 605, -1, $LVS_EX_CHECKBOXES) GUICtrlCreateLabel("Suspsicious Processes", 270, 10) $view2 = GUICtrlCreateListView("Process | PID", 260, 30, 230, 605, -1, $LVS_EX_CHECKBOXES) GUISetState(@SW_SHOW) While 1 $msg = GUIGetMsg() If $msg = $GUI_EVENT_CLOSE Then ExitLoop If $msg = $run Then For $o = 0 to 4 For $i = 2 To $list[0][0] Local $chk = StringInStr($list[$i][0], $proc[$o]) If $chk Then GUICtrlCreateListViewItem($list[$i][0] & "|" & $list[$i][1], $view) If $chk <> 1 Then GUICtrlCreateListViewItem($list[$i][0] & "|" & $list[$i][1], $view2) Next Next EndIf WEnd If anyone can point out my errors... it would be much appreciated
-
Get File Path from a Shell Context Menu
SaintedRogue replied to SaintedRogue's topic in AutoIt General Help and Support
I think I can make it work from the example. But, I honestly still don't get how the logic works. Guess it's just above me. Thanks. -
Get File Path from a Shell Context Menu
SaintedRogue replied to SaintedRogue's topic in AutoIt General Help and Support
Thanks guinness, I get how to add to the context menu. My question lies with the execution of the program from the menu. Let me explain what I want the app to do. I want to be able to right click any file and Select "Encrypt". Choosing that would then execute a command via 7zip command line, along the lines of "7za a SECRET.7z <$FilePath> -pPASSWORD -mhe". I just can't seem to figure out how to get the FilePath. You mention CmdLine|CmdLineRaw, but I'm simply just not understanding the usage there. Would anyone be able to point me to a similar example? Not looking for someone to write my code for me, I simply just don't understand how this would work. Kind Regards -
I am struggling with where to start on a new project. My goal essentially, is to be able to right click one or multiple files within a system, and select an option to encrypt them with 7-zip. I have a handle on how to do all of it except one part of the logic: How would I pass the file path to the selected file into the script when I right click it? Is there a UDF or function I should be looking at? Any advice on where to start looking would be very much appreciated. Kind Regards
-
SW Hide with ShellExecute?
SaintedRogue replied to SaintedRogue's topic in AutoIt General Help and Support
Silent install. Which with more tinkering, I thought to myself... it's an MSI! Use the no UI switch and execute via MSIEXEC rather than just the MSI. Which seems to be working, but I would like to know if I am doing the code correct for say an EXE installer where this isn't an option. -
I'm trying to get some code working with ShellExecute. I would like the Window to execute hidden, but it does not seem to be working when I set the SW_HIDE flag. Any help is much appreciated. Code below: Local $tmp = "C:\Temp" Local $msi = $tmp & '\AdobeFlash.msi' If Not FileExists($tmp) = 1 Then DirCreate($tmp) InetGet("http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_11_plugin.msi", $msi, 0, 0) $afEXE = ShellExecute("AdobeFlash.msi", "", $tmp, "open", @SW_HIDE) Do $run = ControlClick("Adobe Flash Player 11 Plugin - InstallShield Wizard", "", 1669) Until $run = 1 Do $finish = ControlClick("Adobe Flash Player 11 Plugin - InstallShield Wizard", "", 1653) Until $finish = 1 DirRemove($tmp) Thoughts?
-
And that is why I love the AutoIt forums! Solution found in 20 minutes. Thanks so much M! You save me again.
-
That's kind of the trouble... the same, seemingly, same implementation works. However, for this it does not. My code is below for my implementation. VolGUI() Func VolGUI() $imgpath = FileOpenDialog("Location of Memory Dump", @MyDocumentsDir, "Image Files (*.img)") GUICreate("Volatility", 250, 50) $processmsg = GUICtrlCreateLabel("Processing Memory Image Info", 60, 20) GUISetState() $GUIimginfo = RunWait('cmd /c ' & @ScriptDir & 'vol.exe -f ' & $imgpath & ' imageinfo > ' & @ScriptDir & 'ImageInfo.txt', "", @SW_HIDE) GUIDelete() GUICreate("Volatility Frontend", 800, 400) $filemenu = GUICtrlCreateMenu("File") $fmexit = GUICtrlCreateMenuItem("Exit", $filemenu) $helpmenu = GUICtrlCreateMenu("Help") $hmdoc = GUICtrlCreateMenuItem("Documenation", $helpmenu) $hmabout = GUICtrlCreateMenuItem("About", $helpmenu) $close = GUICtrlCreateButton("Close", 762, 350) $img = GUICtrlCreateInput($imgpath, 5, 8, 500, 22) $profile = GUICtrlCreateInput("Profile Settings", 595, 8, 200, 22) $voltab = GUICtrlCreateTab(5, 35, 792, 315) $imgidtab = GUICtrlCreateTabItem("Image ID") $iiFile = FileOpen(@ScriptDir & 'ImageInfo.txt') $H = 70 For $i = 3 to 14 Step 1 $iiString = FileReadLine($iiFile, $i) $imgString = StringStripWS($iiString, 1) $gui_imgid = GUICtrlCreateLabel($imgString, 30, $H) $H = $H + 20 Next $processtab = GUICtrlCreateTabItem("Processes and DLLs") $gui_pslist = GUICtrlCreateCheckbox("pslist", 15, 70) $guih_pslist = GUICtrlSetTip($gui_pslist, "Print active processes by following the _EPROCESS list") $gui_pstree = GUICtrlCreateCheckbox("pstree", 15, 90) $guih_pstree = GUICtrlSetTip($gui_pstree, "Print process list as a tree") $gui_psscan = GUICtrlCreateCheckbox("psscan", 15, 110) $guih_psscan = GUICtrlSetTip($gui_psscan, "Scan Physical memory for _EPROCESS pool allocations") $gui_psdispscan = GUICtrlCreateCheckbox("psdispscan", 15, 130) $guih_psdispscan = GUICtrlSetTip($gui_psdispscan, "Scan Physical memory for _EPROCESS objects based on Dispatch Headers (Windows XP x86 only)") $gui_dlllist = GUICtrlCreateCheckbox("dlllist", 15, 150) $guih_dlllist = GUICtrlSetTip($gui_dlllist, "Print list of loaded DLLs for each process") $gui_dlldump = GUICtrlCreateCheckbox("dlldump", 15, 170) $guih_dlldump = GUICtrlSetTip($gui_dlldump, "Dump DLLs from a process address space") $gui_handles = GUICtrlCreateCheckbox("handles", 15, 190) $guih_handles = GUICtrlSetTip($gui_handles, "Print list of open handles for each process") $gui_getsids = GUICtrlCreateCheckbox("getsids", 15, 210) $guih_getsids = GUICtrlSetTip($gui_getsids, "Print the SIDs owning each process") $gui_verinfo = GUICtrlCreateCheckbox("verinfo", 15, 230) $guih_verinfo = GUICtrlSetTip($gui_verinfo, "Print a PE file's version information") $gui_enumfunc = GUICtrlCreateCheckbox("enumfunc", 15, 250) $guih_enumfunc = GUICtrlSetTip($gui_enumfunc, "Enumerate a PE file's imports and exports") $gui_envars = GUICtrlCreateCheckbox("envars", 15, 270) $guih_envars = GUICtrlSetTip($gui_envars, "Display process environment variables") $gui_cmdscan = GUICtrlCreateCheckbox("cmdscan", 15, 290) $guih_cmdscan = GUICtrlSetTip($gui_cmdscan, "Extract command history by scanning for _COMMAND_HISTORY") $gui_consoles = GUICtrlCreateCheckbox("consoles", 15, 310) $guih_consoles = GUICtrlSetTip($gui_consoles, "Extract command history by scanning for _CONSOLE_INFORMATION") $procmemtab = GUICtrlCreateTabItem("Process Memory") $gui_memmap = GUICtrlCreateCheckbox("memmap", 15, 70) $guih_memmap = GUICtrlSetTip($gui_memmap, "Print the memory map") $gui_memdump = GUICtrlCreateCheckbox("memdump", 15, 90) $guih_memdump = GUICtrlSetTip($gui_memdump, "Dump the addressable memory for a process") $gui_procexedump = GUICtrlCreateCheckbox("procexedump", 15, 110) $guhprocexedump = GUICtrlSetTip($gui_procexedump, "Dump a process to an executable file") $gui_procmemdump = GUICtrlCreateCheckbox("procmemdump", 15, 130) $guih_procmemdump = GUICtrlSetTip($gui_procmemdump, "Dump a process to an executable memory sample") $gui_vadwalk = GUICtrlCreateCheckbox("vadwalk", 15, 150) $guih_vadwalk = GUICtrlSetTip($gui_vadwalk, "Walk the VAD tree") $gui_vadtree = GUICtrlCreateCheckbox("vadtree", 15, 170) $guih_vadtree = GUICtrlSetTip($gui_vadtree, "Walk the VAD tree and display in tree format") $gui_vadinfo = GUICtrlCreateCheckbox("vadinfo", 15, 190) $guih_vadinfo = GUICtrlSetTip($gui_vadinfo, "Dump the VAD info") $gui_vaddump = GUICtrlCreateCheckbox("vaddump", 15, 210) $guih_vaddump = GUICtrlSetTip($gui_vaddump, "Dumps out the vad sections to a file") $gui_evtlogs = GUICtrlCreateCheckbox("evtlogs", 15, 230) $guih_evtlogs = GUICtrlSetTip($gui_evtlogs, "Parse XP and 2003 event logs from memory") $kerntab = GUICtrlCreateTabItem("Kernel Memory and Objects") $gui_modules = GUICtrlCreateCheckbox("modules", 15, 70) $guih_modules = GUICtrlSetTip($gui_modules, "Print list of loaded modules") $gui_modscan = GUICtrlCreateCheckbox("modscan", 15, 90) $guih_modscan = GUICtrlSetTip($gui_modscan, "Scan Physical memory for _LDR_DATA_TABLE_ENTRY objects") $gui_moddump = GUICtrlCreateCheckbox("moddump", 15, 110) $guih_moddump = GUICtrlSetTip($gui_moddump, "Extract a kernel driver to disk") $gui_ssdt = GUICtrlCreateCheckbox("ssdt", 15, 130) $guih_ssdt = GUICtrlSetTip($gui_ssdt, "Print the Native and GDI System Service Descriptor Tables") $gui_driverscan = GUICtrlCreateCheckbox("driverscan", 15, 150) $guih_driverscan = GUICtrlSetTip($gui_driverscan, "Scan physical memory for _DRIVER_OBJECT objects") $gui_filescan = GUICtrlCreateCheckbox("filescan", 15, 170) $guih_filescan = GUICtrlSetTip($gui_filescan, "Scan physical memory for _FILE_OBJECT objects") $gui_mutantscan = GUICtrlCreateCheckbox("mutantscan", 15, 190) $guih_mutantscan = GUICtrlSetTip($gui_mutantscan, "Scan physical memory for _KMUTANT objects") $gui_symlinkscan = GUICtrlCreateCheckbox("symlinkscan", 15, 210) $guih_symlinkscan = GUICtrlSetTip($gui_symlinkscan, "Scans for symbolic link objects") $gui_thrdscan = GUICtrlCreateCheckbox("thrdscan", 15, 230) $guih_thrdscan = GUICtrlSetTip($gui_thrdscan, "Scan physical memory for _ETHREAD objects") $nettab = GUICtrlCreateTabItem("Networking") $gui_connections = GUICtrlCreateCheckbox("connections", 15, 70) $guih_connections = GUICtrlSetTip($gui_connections, "Print open connections (XP and 2003 only)") $gui_connscan = GUICtrlCreateCheckbox("connscan", 15, 90) $guih_connscan = GUICtrlSetTip($gui_connscan, "Scan Physical memory for _TCPT_OBJECT objects (XP and 2003 only)") $gui_sockets = GUICtrlCreateCheckbox("sockets", 15, 110) $guih_sockets = GUICtrlSetTip($gui_sockets, "Print open sockets (XP and 2003 only)") $gui_sockscan = GUICtrlCreateCheckbox("sockscan", 15, 130) $guih_sockscan = GUICtrlSetTip($gui_sockscan, "Scan Physical memory for _ADDRESS_OBJECT (XP and 2003 only)") $gui_netscan = GUICtrlCreateCheckbox("netscan", 15, 150) $guih_netscan = GUICtrlSetTip($gui_netscan, "Scan physical memory for network objects (Vista, 2008, and 7)") $regtab = GUICtrlCreateTabItem("Registry") $gui_hivescan = GUICtrlCreateCheckbox("hivescan", 15, 70) $guih_hivescan = GUICtrlSetTip($gui_hivescan, "Scan Physical memory for _CMHIVE objects") $gui_hivelist = GUICtrlCreateCheckbox("hivelist", 15, 90) $guih_hivelist = GUICtrlSetTip($gui_hivelist, "Print list of registry hives") $gui_printkey = GUICtrlCreateCheckbox("printkey", 15, 110) $guih_printkey = GUICtrlSetTip($gui_printkey, "Print a registry key, and its subkeys and values") $gui_hivedump = GUICtrlCreateCheckbox("hivedump", 15, 130) $guih_hivedump = GUICtrlSetTip($gui_hivedump, "Recursively prints all keys and timestamps in a given hive") $gui_hashdump = GUICtrlCreateCheckbox("hashdump", 15, 150) $guih_hashdump = GUICtrlSetTip($gui_hashdump, "Dumps passwords hashes (LM/NTLM) from memory (x86 only)") $gui_lsadump = GUICtrlCreateCheckbox("lsadump", 15, 170) $guih_lsadump = GUICtrlSetTip($gui_lsadump, "Dump (decrypted) LSA secrets from the registry (XP and 2003 x86 only)") $gui_userassist = GUICtrlCreateCheckbox("userassist", 15, 190) $guih_userassist = GUICtrlSetTip($gui_userassist, "Parses and output User Assist keys from the registry") $gui_shimcache = GUICtrlCreateCheckbox("shimcache", 15, 210) $guih_shimcache = GUICtrlSetTip($gui_shimcache, "Parses the Application Compatibility Shim Cache registry key") $gui_getservicesids = GUICtrlCreateCheckbox("getserviceids", 15, 230) $guih_getserviceids = GUICtrlSetTip($gui_getservicesids, "Calculate SIDs for windows services in the registry") $maltab = GUICtrlCreateTabItem("Malware") $gui_malfind = GUICtrlCreateCheckbox("malfind", 15, 70) $guih_malfind = GUICtrlSetTip($gui_malfind, "Find hidden and injected code") $gui_svcscan = GUICtrlCreateCheckbox("svcscan", 15, 90) $guih_svcscan = GUICtrlSetTip($gui_svcscan, "Scan for Windows services") $gui_ldrmodules = GUICtrlCreateCheckbox("ldrmodules", 15, 110) $guih_ldrmodules = GUICtrlSetTip($gui_ldrmodules, "Detect unlinked DLLs") $gui_impscan = GUICtrlCreateCheckbox("impscan", 15, 130) $guih_impscan = GUICtrlSetTip($gui_impscan, "Scan for calls to imported functions") $gui_apihooks = GUICtrlCreateCheckbox("apihooks", 15, 150) $guih_apihooks = GUICtrlSetTip($gui_apihooks, "Detect API hooks in process and kernel memory (x86 only)") $gui_idt = GUICtrlCreateCheckbox("idt", 15, 170) $guih_idt = GUICtrlSetTip($gui_idt, "Dumps the Interrupt Descriptor Table (x86 only)") $gui_gdt = GUICtrlCreateCheckbox("gdt", 15, 190) $guih_gdt = GUICtrlSetTip($gui_gdt, "Dumps the Global Descriptor Table (x86 only)") $gui_threads = GUICtrlCreateCheckbox("threads", 15, 210) $guih_threads = GUICtrlSetTip($gui_threads, "Investigate _ETHREAD and _KTHREADs") $gui_callbacks = GUICtrlCreateCheckbox("callbacks", 15, 230) $guih_callbacks = GUICtrlSetTip($gui_callbacks, "Print system-wide notification routines (x86 only)") $gui_driverirp = GUICtrlCreateCheckbox("driverirp", 15, 250) $guih_driverirp = GUICtrlSetTip($gui_driverirp, "Driver IRP hook detection") $gui_devicetree = GUICtrlCreateCheckbox("devicetree", 15, 270) $guih_devicetree = GUICtrlSetTip($gui_devicetree, "Show device tree") $gui_psxview = GUICtrlCreateCheckbox("psxview", 15, 290) $guih_psxview = GUICtrlSetTip($gui_psxview, "Find hidden processes with various process listings") $gui_timers = GUICtrlCreateCheckbox("timers", 15, 310) $guih_timers = GUICtrlSetTip($gui_timers, "Print kernel timers and associated module DPCs (x86 only)") $guitab = GUICtrlCreateTabItem("Win32k/GUI Memory") $gui_sessions = GUICtrlCreateCheckbox("sessions", 15, 70) $guih_sessions = GUICtrlSetTip($gui_sessions, "List details on _MM_SESSION_SPACE (user logon sessions)") $gui_wndscan = GUICtrlCreateCheckbox("wndscan", 15, 90) $guih_wndscan = GUICtrlSetTip($gui_wndscan, "Pool scanner for tagWINDOWSTATION (window stations)") $gui_deskscan = GUICtrlCreateCheckbox("deskscan", 15, 110) $guih_deskscan = GUICtrlSetTip($gui_deskscan, "Poolscaner for tagDESKTOP (desktops)") $gui_atomscan = GUICtrlCreateCheckbox("atomscan", 15, 130) $guih_atomscan = GUICtrlSetTip($gui_atomscan, "Pool scanner for _RTL_ATOM_TABLE") $gui_atoms = GUICtrlCreateCheckbox("atoms", 15, 150) $guih_atoms = GUICtrlSetTip($gui_atoms, "Print session and window station atom tables") $gui_clipboard = GUICtrlCreateCheckbox("clipboard", 15, 170) $guih_clipboard = GUICtrlSetTip($gui_clipboard, "Extract the contents of the windows clipboard") $gui_eventhooks = GUICtrlCreateCheckbox("eventhooks", 15, 190) $guih_eventhooks = GUICtrlSetTip($gui_eventhooks, "Print details on windows event hooks") $gui_gathi = GUICtrlCreateCheckbox("gathi", 15, 210) $guih_gathi = GUICtrlSetTip($gui_gathi, "Dump the USER handle type information") $gui_messagehooks = GUICtrlCreateCheckbox("messagehooks", 15, 230) $guih_messagehooks = GUICtrlSetTip($gui_messagehooks, "List desktop and thread window message hooks") $gui_screenshot = GUICtrlCreateCheckbox("screenshot", 15, 250) $guih_screenshot = GUICtrlSetTip($gui_screenshot, "Save a pseudo-screenshot based on GDI windows") $gui_userhandles = GUICtrlCreateCheckbox("userhandles", 15, 270) $guih_userhandles = GUICtrlSetTip($gui_userhandles, "Dump the USER handle tables") $gui_windows = GUICtrlCreateCheckbox("windows", 15, 290) $guih_windows = GUICtrlSetTip($gui_windows, "Print Desktop Windows (verbose details)") $gui_wintree = GUICtrlCreateCheckbox("wintree", 15, 310) $guih_wintree = GUICtrlSetTip($gui_wintree, "Print Z-Order Desktop Windows Tree") GUISetState(@SW_SHOW) While 1 $msg = GUIGetMsg() If $msg = $GUI_EVENT_CLOSE Then ExitLoop If $msg = $fmexit Then ExitLoop If $msg = $close Then ExitLoop WEnd EndFunc
-
I am having trouble with Tabs in my code. I create tabs, and each tab has a series of check boxes or labels read from a file. However, the first tab doesn't show anything until you click into the other tab and then click back into it. Any ideas on how to fix this issue? Code is a bit hard to post because I'm basically writing a GUI for a different tool and it needs specific set of files to run and then read from. Any help would be appreciated. Kind Regards
-
Excellent! Got it working now. It would have been a lot easier to make an array, but I didn't realize I could 'til it was too late.
-
Thanks! You've been great! I'm still learning, this is only the second GUI I've made and this one include a TON more than my prior one.
-
Could I add something like [$q] to my variables? Making it "$Var[$q]" Then apply Case 1 For $q = 0 GUICtrlSetState($q, $GUI_CHECKED) Next GUICtrlSetData($hCheck, "Uncheck All") Case Else For $q = 0 GUICtrlSetState([$q], $GUI_UNCHECKED) Next GUICtrlSetData($hCheck, "Check All")
-
Any chance of doing it without an array? I have a tabbed GUI. All with several check boxes. I probably did something inefficient and have each check box assigned a different variable. Like this (but a lot more): GUICtrlCreateTabItem("Memory") $DumpIt = GUICtrlCreateCheckbox("Dump Memory", 30, 45) GUICtrlCreateTabItem("Preservation") $MD5 = GUICtrlCreateCheckbox("Hash 'Evidence' with MD5", 30, 45) $SHA1 = GUICtrlCreateCheckbox("Hach 'Evidence' with SHA1", 30, 75) You think reassigning these to something like $CB could be beneficial? Or should I just make a different button that'll unmark them all? I think re-doing the variables may make updating the application easier. What are your thoughts?
-
I am trying to make an option where if I check a box, it will check all boxes in the application. Which works. Can I make it so if I uncheck the box after I've checked it, it will uncheck everything? Case $msg = $all If GUICtrlRead($tab) = 0 Then GUICtrlSetState($SysInfo, $GUI_CHECKED) GUICtrlSetState($Processes, $GUI_CHECKED) GUICtrlSetState($Services, $GUI_CHECKED) GUICtrlSetState($FileAssoc, $GUI_CHECKED) GUICtrlSetState($NTFSInfo, $GUI_CHECKED) GUICtrlSetState($DiskMnt, $GUI_CHECKED) GUICtrlSetState($Tree, $GUI_CHECKED) GUICtrlSetState($STasks, $GUI_CHECKED) GUICtrlSetState($IPs, $GUI_CHECKED) GUICtrlSetState($CONN, $GUI_CHECKED) GUICtrlSetState($Routes, $GUI_CHECKED) GUICtrlSetState($ARP, $GUI_CHECKED) GUICtrlSetState($DNS, $GUI_CHECKED) GUICtrlSetState($SYSTEM, $GUI_CHECKED) GUICtrlSetState($SECURITY, $GUI_CHECKED) GUICtrlSetState($SAM, $GUI_CHECKED) GUICtrlSetState($SOFTWARE, $GUI_CHECKED) GUICtrlSetState($HKCU, $GUI_CHECKED) GUICtrlSetState($HKU, $GUI_CHECKED) GUICtrlSetState($DumpIt, $GUI_CHECKED) GUICtrlSetState($MD5, $GUI_CHECKED) GUICtrlSetState($SHA1, $GUI_CHECKED) Else GUICtrlSetState($SysInfo, $GUI_UNCHECKED) GUICtrlSetState($Processes, $GUI_UNCHECKED) GUICtrlSetState($Services, $GUI_UNCHECKED) GUICtrlSetState($FileAssoc, $GUI_UNCHECKED) GUICtrlSetState($NTFSInfo, $GUI_UNCHECKED) GUICtrlSetState($DiskMnt, $GUI_UNCHECKED) GUICtrlSetState($Tree, $GUI_UNCHECKED) GUICtrlSetState($STasks, $GUI_UNCHECKED) GUICtrlSetState($IPs, $GUI_UNCHECKED) GUICtrlSetState($CONN, $GUI_UNCHECKED) GUICtrlSetState($Routes, $GUI_UNCHECKED) GUICtrlSetState($ARP, $GUI_UNCHECKED) GUICtrlSetState($DNS, $GUI_UNCHECKED) GUICtrlSetState($SYSTEM, $GUI_UNCHECKED) GUICtrlSetState($SECURITY, $GUI_UNCHECKED) GUICtrlSetState($SAM, $GUI_UNCHECKED) GUICtrlSetState($SOFTWARE, $GUI_UNCHECKED) GUICtrlSetState($HKCU, $GUI_UNCHECKED) GUICtrlSetState($HKU, $GUI_UNCHECKED) GUICtrlSetState($DumpIt, $GUI_UNCHECKED) GUICtrlSetState($MD5, $GUI_UNCHECKED) GUICtrlSetState($SHA1, $GUI_UNCHECKED) EndIf This is what I tried.... It did not work. Suggestions?