Guest Posted February 14, 2015 Posted February 14, 2015 (edited) If you can use WMI this might work... Global $sRemoveServices = 'AdobeARMservice|AeLookupSvc|AntiVirSchedulerService|AntiVirService|Appinfo|AudioEndpointBuilder|AudioSrv|Avira.OE.ServiceHost|BFE|BITS|Browser|CryptSvc|DcomLaunch|Dhcp|Dnscache|DPS|EventLog|EventSystem|fdPHost|FDResPub|gpsvc|HomeGroupListener|HomeGroupProvider|iphlpsvc|KeyIso|LanmanServer|LanmanWorkstation|lmhosts|MMCSS|MpsSvc|MSDTC|Netman|netprofm|NlaSvc|nsi|p2pimsvc|p2psvc|PlugPlay|PNRPsvc|Power|ProfSvc|ProtectedStorage|RpcEptMapper|RpcSs|SamSs|Schedule|SENS|ShellHWDetection|Spooler|sppsvc|sppuinotify|SSDPSRV|SysMain|Themes|TrkWks|TrustedInstaller|upnphost|UxSms|VSS|WdiServiceHost|WdiSystemHost|WinDefend|WinHttpAutoProxySvc|Winmgmt|WMPNetworkSvc|WPDBusEnum|wscsvc|WSearch|wuauserv|wudfsvc' local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\CIMV2") local $oItems = $oWMI.ExecQuery('select name from win32_service where started=true') Local $str = '' For $oItem In $oItems For $P In $oItem.Properties_() $str &= $P.Value & ',' Next Next local $str2 = stringregexpreplace($str, '^|\,' & $sRemoveServices & '\,|$','') $str2 = stringtrimright(stringregexpreplace($str2,'\,+',','),1) ConsoleWrite($str2 & @CRLF) Output is in comma delimited format. ok I did test and _RetrieveRunningServices2 take about 100-120 ms and this code take about 85-100 ms You probably have a very fast computer.. But this code not building an 2D array and does not return the full name of each service so this Less work may explain why this code faster. The difference is not significant. This is the test I made with this code: $timer = TimerInit() Global $sRemoveServices = 'AdobeARMservice|AeLookupSvc|AntiVirSchedulerService|AntiVirService|Appinfo|AudioEndpointBuilder|AudioSrv|Avira.OE.ServiceHost|BFE|BITS|Browser|CryptSvc|DcomLaunch|Dhcp|Dnscache|DPS|EventLog|EventSystem|fdPHost|FDResPub|gpsvc|HomeGroupListener|HomeGroupProvider|iphlpsvc|KeyIso|LanmanServer|LanmanWorkstation|lmhosts|MMCSS|MpsSvc|MSDTC|Netman|netprofm|NlaSvc|nsi|p2pimsvc|p2psvc|PlugPlay|PNRPsvc|Power|ProfSvc|ProtectedStorage|RpcEptMapper|RpcSs|SamSs|Schedule|SENS|ShellHWDetection|Spooler|sppsvc|sppuinotify|SSDPSRV|SysMain|Themes|TrkWks|TrustedInstaller|upnphost|UxSms|VSS|WdiServiceHost|WdiSystemHost|WinDefend|WinHttpAutoProxySvc|Winmgmt|WMPNetworkSvc|WPDBusEnum|wscsvc|WSearch|wuauserv|wudfsvc' local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\CIMV2") local $oItems = $oWMI.ExecQuery('select name from win32_service where started=true') Local $str = '' For $oItem In $oItems For $P In $oItem.Properties_() $str &= $P.Value & ',' Next Next ConsoleWrite(TimerDiff($timer) & @CRLF) With _RetrieveRunningServices2: $timer = TimerInit() $test = _RetrieveRunningServices2() ConsoleWrite(TimerDiff($timer) & @CRLF) If I change the code to create 2D array output then the test show that it take 95-150ms ms but it still faster. One of the reasons is that it does not take the full name and put it in the array.. $timer = TimerInit() Local $Output[1][2] = [[0]] Global $sRemoveServices = 'AdobeARMservice|AeLookupSvc|AntiVirSchedulerService|AntiVirService|Appinfo|AudioEndpointBuilder|AudioSrv|Avira.OE.ServiceHost|BFE|BITS|Browser|CryptSvc|DcomLaunch|Dhcp|Dnscache|DPS|EventLog|EventSystem|fdPHost|FDResPub|gpsvc|HomeGroupListener|HomeGroupProvider|iphlpsvc|KeyIso|LanmanServer|LanmanWorkstation|lmhosts|MMCSS|MpsSvc|MSDTC|Netman|netprofm|NlaSvc|nsi|p2pimsvc|p2psvc|PlugPlay|PNRPsvc|Power|ProfSvc|ProtectedStorage|RpcEptMapper|RpcSs|SamSs|Schedule|SENS|ShellHWDetection|Spooler|sppsvc|sppuinotify|SSDPSRV|SysMain|Themes|TrkWks|TrustedInstaller|upnphost|UxSms|VSS|WdiServiceHost|WdiSystemHost|WinDefend|WinHttpAutoProxySvc|Winmgmt|WMPNetworkSvc|WPDBusEnum|wscsvc|WSearch|wuauserv|wudfsvc' local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\CIMV2") local $oItems = $oWMI.ExecQuery('select name from win32_service where started=true') Local $str = '' For $oItem In $oItems For $P In $oItem.Properties_() ;~ $str &= $P.Value & ',' ;~ _ArrayAdd($Output,) $Output[0][0] += 1 ReDim $Output[$Output[0][0]+1][2] $Output[$Output[0][0]][0] = $P.Value Next Next ConsoleWrite(TimerDiff($timer) & @CRLF) EDIT: A second test show that 2D array Output does not slow It down (with 2D array it take more 3-4 ms) . your code may take 145/150 ms if or without 2D array. But I admit that most of the time it takes about 95 ms Edited February 14, 2015 by Guest
kylomas Posted February 14, 2015 Posted February 14, 2015 (edited) You probably have a very fast computer.. I wish, I've got a freakin' dinosaur... The code I posted runs .14 seconds, start to finish. Chimaera can use it or not, again, it is just another alternative. edit: Why make an array of it when SRER can do the job (the "white list" of services is already in the correct format)? Edited February 14, 2015 by kylomas Forum Rules Procedure for posting code "I like pigs. Dogs look up to us. Cats look down on us. Pigs treat us as equals." - Sir Winston Churchill
Guest Posted February 14, 2015 Posted February 14, 2015 (edited) I'm not trying to say "use my code instead" I don't care about what he will use I just did a speed test and post the information here... edit: Why make an array of it when SRER can do the job (the "white list" of services is already in the correct format)? You're right. I never thought about it.I wrote this code long time ago for my needs and not for his needs .. so I did not thought about it. Edited February 14, 2015 by Guest
Chimaera Posted February 15, 2015 Author Posted February 15, 2015 (edited) I just ran a comparison and yes kylomas's is faster. But also it flagged 2 services which gil900's does not Audiosrv which is the standard audio service within windows (part of svchost i think) stisvc which can be used for digital cameras, scanners or another graphical input devices. (part of svchost i think) Ps they are present in task manager but not in services.msc Any ideas why? Thank you both for your input Edited February 15, 2015 by Chimaera If Ive just helped you ... miracles do happen. Chimaera CopyRobo() * Hidden Admin Account Enabler * Software Location From Registry * Find Display Resolution * _ChangeServices()
kylomas Posted February 15, 2015 Posted February 15, 2015 (edited) You sure about Audiosrv it is not flagged on my system. stisvc is flagged because it is not in the "whitelist". I changed it to case insensitive (should have done that initialy, sorry) because it was also flagging eventlog. Now it should be OK... local $st = timerinit() Global $sRemoveServices = 'AdobeARMservice|AeLookupSvc|AntiVirSchedulerService|AntiVirService|Appinfo|AudioEndpointBuilder|AudioSrv|Avira.OE.ServiceHost|BFE|BITS|Browser|CryptSvc|DcomLaunch|Dhcp|Dnscache|DPS|EventLog|EventSystem|fdPHost|FDResPub|gpsvc|HomeGroupListener|HomeGroupProvider|iphlpsvc|KeyIso|LanmanServer|LanmanWorkstation|lmhosts|MMCSS|MpsSvc|MSDTC|Netman|netprofm|NlaSvc|nsi|p2pimsvc|p2psvc|PlugPlay|PNRPsvc|Power|ProfSvc|ProtectedStorage|RpcEptMapper|RpcSs|SamSs|Schedule|SENS|ShellHWDetection|Spooler|sppsvc|sppuinotify|SSDPSRV|SysMain|Themes|TrkWks|TrustedInstaller|upnphost|UxSms|VSS|WdiServiceHost|WdiSystemHost|WinDefend|WinHttpAutoProxySvc|Winmgmt|WMPNetworkSvc|WPDBusEnum|wscsvc|WSearch|wuauserv|wudfsvc' local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\CIMV2") local $oItems = $oWMI.ExecQuery('select name from win32_service where started=true', 'WQL', 48) Local $str = '' For $oItem In $oItems For $P In $oItem.Properties_() $str &= $P.Value & ',' Next Next local $str2 = stringregexpreplace($str, '(?i)^|\,' & $sRemoveServices,'') $str2 = stringregexpreplace($str2,'\,+',',') if stringright($str2,1) = ',' then $str2 = stringtrimright($str2,1) ConsoleWrite(timerdiff($st)/1000 & ' seconds ' & @CRLF & $str & @LF & $str2 & @LF) kylomas edit: yes, I do not see stisvc in the services console, however, I do see it in a "sc query" list...and obviously WMI sees it edit2: It is in the service console under "Windows Image Aquisition" Edited February 15, 2015 by kylomas Forum Rules Procedure for posting code "I like pigs. Dogs look up to us. Cats look down on us. Pigs treat us as equals." - Sir Winston Churchill
Chimaera Posted February 15, 2015 Author Posted February 15, 2015 my updated service list win 8.1 'AeLookupSvc|ALG|AppHostSvc|AppIDSvc|Appinfo|AppMgmt|AppReadiness|AppXSVC|aspnet_state|AudioEndpointBuilder|AudioSrv|AxInstSV|BDESVC|BFE|BITS|BrokerInfrastructure|Browser|bthserv|c2wts|CertPropSvc|COMSysApp|CryptSvc|CscService|DcomLaunch|defragsvc|DeviceAssociationService|DeviceInstall|Dhcp|Dnscache|dot3svc|DPS|DsmSVC|DsRoleSvc|EapHost|EFS|EventLog|EventSystem|Fax|fdPHost|FDResPub|fhsvc|FontCache|FontCache3.0.0.0|ftpsvc|gpsvc|hidserv|hkmsvc|HomeGroupListener|HomeGroupProvider|IEEtwCollectorService|IISADMIN|IKEEXT|iphlpsvc|iprip|KeyIso|KtmRm|LanmanServer|LanmanWorkstation|lfsvc|lltdsvc|lmhosts|LPDSVC|LSM|MMCSS|MpsSvc|MSDTC|MSiSCSI|msiserver|MSMQ|MSMQTriggers|napagent|NcaSVC|NcbService|NcdAutoSetup|Netlogon|Netman|NetMsmqActivator|NetPipeActivator|netprofm|NetTcpActivator|NetTcpPortSharing|NfsClnt|NlaSvc|nsi|p2pimsvc|p2psvc|PcaSvc|PeerDistSvc|pla|PlugPlay|PNRPAutoReg|PNRPsvc|PolicyAgent|Power|PrintNotify|ProfSvc|QWAVE|RasAuto|RasMan|RemoteAccess|RemoteRegistry|RpcEptMapper|RpcLocator|RpcSs|SamSs|SCardSvr|ScDeviceEnum|Schedule|SCPolicySvc|seclogon|SENS|SensrSvc|SessionEnv|SharedAccess|ShellHWDetection|simptcp|SNMP|SNMPTRAP|Spooler|sppsvc|SSDPSRV|SstpSvc|StiSvc|StorSvc|svsvc|swprv|SysMain|SystemEventsBroker|TabletInputService|TapiSrv|TermService|Themes|THREADORDER|TimeBroker|TlntSvr|TrkWks|TrustedInstaller|UI0Detect|UmRdpService|upnphost|VaultSvc|vds|vmicguestinterface|vmicheartbeat|vmickvpexchange|vmicrdv|vmicshutdown|vmictimesync|vmicvss|VSS|W32Time|W3SVC|WAS|wbengine|WbioSrvc|Wcmsvc|wcncsvc|WcsPlugInService|WdiServiceHost|WdiSystemHost|WdNisSvc|WebClient|Wecsvc|WEPHOSTSVC|wercplsupport|WerSvc|WiaRpc|WinDefend|WinHttpAutoProxySvc|Winmgmt|WinRM|WlanSvc|wlidsvc|wmiApSrv|WMPNetworkSvc|WMSVC|workfolderssvc|WPCSvc|WPDBusEnum|wscsvc|WSearch|WSService|wuauserv|wudfsvc|WwanSvc|AdobeARMservice|AntiVirService|AntiVirSchedulerService|Avira.OE.ServiceHost' And the result 0.0722070056829831 seconds AdobeARMservice,AMD External Events Utility,AntiVirSchedulerService,AntiVirService,Appinfo,asComSvc,AudioEndpointBuilder,Audiosrv,Avira.OE.ServiceHost,BFE,BITS,BrokerInfrastructure,Browser,CryptSvc,DcomLaunch,DeviceAssociationService,Dhcp,Dnscache,DPS,EventLog,EventSystem,fdPHost,FDResPub,FontCache,gpsvc,hidserv,HomeGroupProvider,iphlpsvc,LanmanServer,LanmanWorkstation,lmhosts,LSM,MMCSS,MpsSvc,NcbService,NcdAutoSetup,netprofm,NlaSvc,nsi,p2pimsvc,p2psvc,PassThru Service,PcaSvc,PlugPlay,PNRPsvc,PolicyAgent,Power,ProfSvc,RpcEptMapper,RpcSs,SamSs,Schedule,SENS,Service KMSELDI,ShellHWDetection,Spooler,SSDPSRV,stisvc,SysMain,SystemEventsBroker,Themes,TimeBroker,TrkWks,Wcmsvc,wcncsvc,WdiServiceHost,WinHttpAutoProxySvc,Winmgmt,wscsvc,WSearch,wudfsvc, ,AMD External Events Utility,asComSvc,PassThru Service,Service KMSELDI Its finding things ive already allowed for in the $sRemoveServices If Ive just helped you ... miracles do happen. Chimaera CopyRobo() * Hidden Admin Account Enabler * Software Location From Registry * Find Display Resolution * _ChangeServices()
kylomas Posted February 15, 2015 Posted February 15, 2015 Did you use the code posted above? Forum Rules Procedure for posting code "I like pigs. Dogs look up to us. Cats look down on us. Pigs treat us as equals." - Sir Winston Churchill
Chimaera Posted February 15, 2015 Author Posted February 15, 2015 that was with that code and my amended list If Ive just helped you ... miracles do happen. Chimaera CopyRobo() * Hidden Admin Account Enabler * Software Location From Registry * Find Display Resolution * _ChangeServices()
kylomas Posted February 15, 2015 Posted February 15, 2015 chimaera, When I run this... local $st = timerinit() Global $sRemoveServices = _ 'AeLookupSvc|ALG|AppHostSvc|AppIDSvc|Appinfo|AppMgmt|AppReadiness|AppXSVC|aspnet_state|AudioEndpointBuilder|AudioSrv|AxInstSV|BDESVC|BFE|BITS|BrokerInfrastructure|Browser|bthserv|c2wts|CertPropSvc|COMSysApp|CryptSvc|CscService|DcomLaunch|defragsvc|DeviceAssociationService|DeviceInstall|Dhcp|Dnscache|dot3svc|DPS|DsmSVC|DsRoleSvc|EapHost|EFS|EventLog|EventSystem|Fax|fdPHost|FDResPub|fhsvc|FontCache|FontCache3.0.0.0|ftpsvc|gpsvc|hidserv|hkmsvc|HomeGroupListener|HomeGroupProvider|IEEtwCollectorService|IISADMIN|IKEEXT|iphlpsvc|iprip|KeyIso|KtmRm|LanmanServer|LanmanWorkstation|lfsvc|lltdsvc|lmhosts|LPDSVC|LSM|MMCSS|MpsSvc|MSDTC|MSiSCSI|msiserver|MSMQ|MSMQTriggers|napagent|NcaSVC|NcbService|NcdAutoSetup|Netlogon|Netman|NetMsmqActivator|NetPipeActivator|netprofm|NetTcpActivator|NetTcpPortSharing|NfsClnt|NlaSvc|nsi|p2pimsvc|p2psvc|PcaSvc|PeerDistSvc|pla|PlugPlay|PNRPAutoReg|PNRPsvc|PolicyAgent|Power|PrintNotify|ProfSvc|QWAVE|RasAuto|RasMan|RemoteAccess|RemoteRegistry|RpcEptMapper|RpcLocator|RpcSs|SamSs|SCardSvr|ScDeviceEnum|Schedule|SCPolicySvc|seclogon|SENS|SensrSvc|SessionEnv|SharedAccess|ShellHWDetection|simptcp|SNMP|SNMPTRAP|Spooler|sppsvc|SSDPSRV|SstpSvc|StiSvc|StorSvc|svsvc|swprv|SysMain|SystemEventsBroker|TabletInputService|TapiSrv|TermService|Themes|THREADORDER|TimeBroker|TlntSvr|TrkWks|TrustedInstaller|UI0Detect|UmRdpService|upnphost|VaultSvc|vds|vmicguestinterface|vmicheartbeat|vmickvpexchange|vmicrdv|vmicshutdown|vmictimesync|vmicvss|VSS|W32Time|W3SVC|WAS|wbengine|WbioSrvc|Wcmsvc|wcncsvc|WcsPlugInService|WdiServiceHost|WdiSystemHost|WdNisSvc|WebClient|Wecsvc|WEPHOSTSVC|wercplsupport|WerSvc|WiaRpc|WinDefend|WinHttpAutoProxySvc|Winmgmt|WinRM|WlanSvc|wlidsvc|wmiApSrv|WMPNetworkSvc|WMSVC|workfolderssvc|WPCSvc|WPDBusEnum|wscsvc|WSearch|WSService|wuauserv|wudfsvc|WwanSvc|AdobeARMservice|AntiVirService|AntiVirSchedulerService|Avira.OE.ServiceHost' local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\CIMV2") local $oItems = $oWMI.ExecQuery('select name from win32_service where started=true', 'WQL', 48) Local $str = '' For $oItem In $oItems For $P In $oItem.Properties_() $str &= $P.Value & ',' Next Next local $str2 = stringregexpreplace($str, '(?i)^|\,' & $sRemoveServices,'') $str2 = stringregexpreplace($str2,'\,+',',') if stringright($str2,1) = ',' then $str2 = stringtrimright($str2,1) ConsoleWrite(timerdiff($st)/1000 & ' seconds ' & @LF & 'List of Exceptions = ' & $str2 & @LF) I get this... >"C:\Program Files (x86)\AutoIt3\SciTE\AutoIt3Wrapper\AutoIt3Wrapper.exe" /run /prod /ErrorStdOut /in "C:UsersADMIN010Documentshelp - chimeara.au3" /UserParams +>05:34:44 Starting AutoIt3Wrapper v.14.801.2025.0 SciTE v.3.4.4.0 Keyboard:00000409 OS:WIN_7/Service Pack 1 CPU:X64 OS:X64 Environment(Language:0409) +> SciTEDir => C:Program Files (x86)AutoIt3SciTE UserDir => C:UsersADMIN010AppDataLocalAutoIt v3SciTEAutoIt3Wrapper SCITE_USERHOME => C:UsersADMIN010AppDataLocalAutoIt v3SciTE >Running AU3Check (3.3.13.19) from:C:Program Files (x86)AutoIt3 input:C:UsersADMIN010Documentshelp - chimeara.au3 +>05:34:44 AU3Check ended.rc:0 >Running:(3.3.12.0):C:Program Files (x86)AutoIt3autoit3.exe "C:UsersADMIN010Documentshelp - chimeara.au3" --> Press Ctrl+Alt+Break to Restart or Ctrl+Break to Stop 0.124064981542825 seconds List of Exceptions = AgereModemAudio,avast! Antivirus,LightScribeService,Net Driver HPZ12,nvsvc,Pml Driver HPZ12,ProtectedStorage,ReflectService.exe,UxSms +>05:34:44 AutoIt3.exe ended.rc:0 +>05:34:44 AutoIt3Wrapper Finished. >Exit code: 0 Time: 0.8603 Is this not correct? Forum Rules Procedure for posting code "I like pigs. Dogs look up to us. Cats look down on us. Pigs treat us as equals." - Sir Winston Churchill
Chimaera Posted February 15, 2015 Author Posted February 15, 2015 thats more like it 0.0363228429752452 seconds List of Exceptions = ,AMD External Events Utility,asComSvc,PassThru Service,Service KMSELDI If Ive just helped you ... miracles do happen. Chimaera CopyRobo() * Hidden Admin Account Enabler * Software Location From Registry * Find Display Resolution * _ChangeServices()
kylomas Posted February 15, 2015 Posted February 15, 2015 (edited) Why are you getting the leading comma? edit: and what was wrong before? Edited February 15, 2015 by kylomas Forum Rules Procedure for posting code "I like pigs. Dogs look up to us. Cats look down on us. Pigs treat us as equals." - Sir Winston Churchill
Chimaera Posted February 15, 2015 Author Posted February 15, 2015 (edited) Ive no idea to both, i assumed you had tweaked something same test again now im back home 0.0449361051384004 seconds List of Exceptions = ,AMD External Events Utility,asComSvc,PassThru Service,Service KMSELDI Its definatly different since you posted the last one Edited February 15, 2015 by Chimaera If Ive just helped you ... miracles do happen. Chimaera CopyRobo() * Hidden Admin Account Enabler * Software Location From Registry * Find Display Resolution * _ChangeServices()
kylomas Posted February 15, 2015 Posted February 15, 2015 Chimaera, This is the final version. I fond an error where the first entry wold not list as an exception if it also matched the whitelist. I also changed the SRER so that it would not error on reserved SRE characters... local $st = timerinit() Global $sRemoveServices = _ 'AeLookupSvc|ALG|AppHostSvc|AppIDSvc|Appinfo|AppMgmt|AppReadiness|AppXSVC|aspnet_state|AudioEndpointBuilder|AudioSrv|AxInstSV|BDESVC|BFE|BITS|BrokerInfrastructure|Browser|bthserv|c2wts|CertPropSvc|COMSysApp|CryptSvc|CscService|DcomLaunch|defragsvc|DeviceAssociationService|DeviceInstall|Dhcp|Dnscache|dot3svc|DPS|DsmSVC|DsRoleSvc|EapHost|EFS|EventLog|EventSystem|Fax|fdPHost|FDResPub|fhsvc|FontCache|FontCache3.0.0.0|ftpsvc|gpsvc|hidserv|hkmsvc|HomeGroupListener|HomeGroupProvider|IEEtwCollectorService|IISADMIN|IKEEXT|iphlpsvc|iprip|KeyIso|KtmRm|LanmanServer|LanmanWorkstation|lfsvc|lltdsvc|lmhosts|LPDSVC|LSM|MMCSS|MpsSvc|MSDTC|MSiSCSI|msiserver|MSMQ|MSMQTriggers|napagent|NcaSVC|NcbService|NcdAutoSetup|Netlogon|Netman|NetMsmqActivator|NetPipeActivator|netprofm|NetTcpActivator|NetTcpPortSharing|NfsClnt|NlaSvc|nsi|p2pimsvc|p2psvc|PcaSvc|PeerDistSvc|pla|PlugPlay|PNRPAutoReg|PNRPsvc|PolicyAgent|Power|PrintNotify|ProfSvc|QWAVE|RasAuto|RasMan|RemoteAccess|RemoteRegistry|RpcEptMapper|RpcLocator|RpcSs|SamSs|SCardSvr|ScDeviceEnum|Schedule|SCPolicySvc|seclogon|SENS|SensrSvc|SessionEnv|SharedAccess|ShellHWDetection|simptcp|SNMP|SNMPTRAP|Spooler|sppsvc|SSDPSRV|SstpSvc|StiSvc|StorSvc|svsvc|swprv|SysMain|SystemEventsBroker|TabletInputService|TapiSrv|TermService|Themes|THREADORDER|TimeBroker|TlntSvr|TrkWks|TrustedInstaller|UI0Detect|UmRdpService|upnphost|VaultSvc|vds|vmicguestinterface|vmicheartbeat|vmickvpexchange|vmicrdv|vmicshutdown|vmictimesync|vmicvss|VSS|W32Time|W3SVC|WAS|wbengine|WbioSrvc|Wcmsvc|wcncsvc|WcsPlugInService|WdiServiceHost|WdiSystemHost|WdNisSvc|WebClient|Wecsvc|WEPHOSTSVC|wercplsupport|WerSvc|WiaRpc|WinDefend|WinHttpAutoProxySvc|Winmgmt|WinRM|WlanSvc|wlidsvc|wmiApSrv|WMPNetworkSvc|WMSVC|workfolderssvc|WPCSvc|WPDBusEnum|wscsvc|WSearch|WSService|wuauserv|wudfsvc|WwanSvc|AdobeARMservice|AntiVirService|AntiVirSchedulerService|Avira.OE.ServiceHost' local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\CIMV2") local $oItems = $oWMI.ExecQuery('select name from win32_service where started=true', 'WQL', 48) Local $str = '' For $oItem In $oItems For $P In $oItem.Properties_() $str &= $P.Value & ',' Next Next local $sSRE = '(?i)(^|\,)', $aTmp = stringsplit($sRemoveServices,'|',2) for $1 = 0 to UBound($aTmp) - 1 $sSRE &= '\Q' & $aTmp[$1] & '\E|' next $sSRE = stringtrimright($sSRE,1) local $str2 = stringregexpreplace($str, $sSRE, '') $str2 = stringregexpreplace($str2,'\,+',',') if stringright($str2,1) = ',' then $str2 = stringtrimright($str2,1) ConsoleWrite(@LF & '! ' & timerdiff($st)/1000 & ' seconds ' & @LF & @LF & _ '> SRER = ' & $sSRE & @LF & @LF & _ 'Services Running = ' & $str & @LF & _ 'List of Exceptions = ' & $str2 & @LF & _ @LF) Good Luck, kylomas Forum Rules Procedure for posting code "I like pigs. Dogs look up to us. Cats look down on us. Pigs treat us as equals." - Sir Winston Churchill
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now