Record the websites that are accessed

[Ric_]

Any one tried Impero? It's on the wiki but no reference to it on the forums.

 

People have looked at it in the past and there are mentions in other posts. IIRC most people found it a bit 'Mickey Mouse' and offer other suggestions to help you save a bit of cash or do the job better

[Norphy]

We use ISA Server 2000 which routes to a couple of upstream proxies at the LEA. All internet traffic goes through the ISA and its all logged. We then use Webspy Analyser to parse the logs and present them in pretty graphs and suchlike.

 

We rely on the LEA to do most of our filtering (They use Dansguardian and do a good job although it can be too restrictive sometimes) and just use standard ISA rules to do any extra filtering. It works, ISA Server was a lot cheaper back then and its completely reliable

[NetworkGeezer]

Nice setup but doesn't the local proxy+firewall and LEA/Count proxy+firewall lead to a slower internet connection?

[Norphy]

Not noticably so, no. Latency is a bit higher than what you'd get with a direct internet connection but being as no-ones gaming or running Skype I don't think it matters.

 

In any case, it's absolutely necessary. The Beds network has been infected with viruses on more than one occasion and without the firewall we're completely vulnerable to them. They got hit by Sasser a while back and a lot of schools were infected by that (Lower schools generally). We also got hit by Blaster when it came out which was before we had ISA in place and also during the school holidays when I was still contracted to work termtime only. It took me more than two weeks to clean the network and we got booted off the Beds network on three seperate occasions Lets just say, I got SUS, a working version of a virus scanner and ISA going pretty damn quickly after that little incident.

[Ric_]

Nice setup but doesn't the local proxy+firewall and LEA/Count proxy+firewall lead to a slower internet connection?

 

In theory, the pages that are accessed most will be cached so it should lead to a perception of a quicker connection if anything.

[Simcfc73]

That would depend on the LEA having the caching set up right which obviously they would.

[Norphy]

I don't know about them but I know I certainly do.

[Geoff]

Squid + Dansguardian.

 

I have tweaks for squid so updates for windows/sophos/java/etc are cached for a month. Speeds things up enormously.

[ITWombat]

Squid + Dansguardian.

 

I have tweaks for squid so updates for windows/sophos/java/etc are cached for a month. Speeds things up enormously.

 

Please tell me how! It's driving me mad. I have tried everything but I can;t workout why there should be difference between automatic updates running through on-site squid and through direct connection.

Manual updates through relevant websites work normally.

[uk101man]

I use the following vbs:

 

Code: 
' C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat - Starting offset: 0000:5000
' +----------------------------------------------------------------------------+
' | Ensure that all variable names are defined!                                |
' +----------------------------------------------------------------------------+
Option Explicit


' +----------------------------------------------------------------------------+
' | Setup constants                                                            |
' +----------------------------------------------------------------------------+
Const conBarSpeed=80
Const conForcedTimeOut=3600000 ' 1 hour


' +----------------------------------------------------------------------------+
' | Setup Objects and misc variables                                           |
' +----------------------------------------------------------------------------+
Dim spyPath     
Dim oFSO        : Set oFSO = CreateObject("Scripting.FileSystemObject")
Dim oWShell     : Set oWShell = CreateObject("WScript.Shell")
Dim objNet      : Set objNet = CreateObject("WScript.Network")
Dim Env         : Set Env = oWShell.Environment("SYSTEM")
Dim arrFiles    : arrFiles = Array()
'Dim arrUsers    : arrUsers = Array()
Dim HistoryPath : HistoryPath = Array()
Dim objIE
Dim objProgressBar
Dim objTextLine1
Dim objTextLine2
Dim objQuitFlag
Dim oTextStream
Dim index
Dim nBias
Dim strUserName

' +----------------------------------------------------------------------------+
' | Whose been a naughty surfer? Let's find out!                             |
' +----------------------------------------------------------------------------+
'Here is where we extract the UserName
strUserName = objNet.UserName
spyPath = "\\server\logs$\inet\" &strUsername&"\spy.htm"
StartSpyScan
'DeleteIndexFiles()
myDeleteIndexFiles


' +----------------------------------------------------------------------------+
' | Outta here ...                                                             |
' +----------------------------------------------------------------------------+
CleanupQuit


' +----------------------------------------------------------------------------+
' | Cleanup and Quit                                                           |
' +----------------------------------------------------------------------------+
Sub CleanupQuit()
   Set oFSO = Nothing
   Set oWShell = Nothing
   Set objNet = Nothing
   WScript.Quit
End Sub


' +----------------------------------------------------------------------------+
' | Start Spy Scan                                                             |
' +----------------------------------------------------------------------------+
Sub StartSpyScan()
   Dim index_folder, history_folder, oSubFolder, oStartDir, sFileRegExPattern, user

   LocateHistoryFolder
   index_folder=HistoryPath(0)&"\"&HistoryPath(1)
   
   If Not oFSO.FolderExists(index_folder) Then
     'MsgBox "No history folder exists. Scan Aborted."
   Else  
     
     'StartIE "IE Spy"
     'SetLine1 "Locating history files:"
     
     sFileRegExPattern = "\index.dat$"
     Set oStartDir = oFSO.GetFolder(index_folder)
     
     For Each oSubFolder In oStartDir.SubFolders
       history_folder=oSubFolder.Path&"\"&HistoryPath(3)&"\"&HistoryPath(4)&"\"&"History.IE5"
       If oFSO.FolderExists(history_folder) Then
         user = split(history_folder,"\")
    'SetLine2 user(2)
         'ReDim Preserve arrUsers(UBound(arrUsers) + 1)
         'arrUsers(UBound(arrUsers)) = user(2) 
         if user(2) = strUserName then
            Set oStartDir = oFSO.GetFolder(history_folder)
            RecurseFilesAndFolders oStartDir, sFileRegExPattern
    end if
       End If
     Next
     
     If IsEmpty(index) Then
       'CloseIE
       'MsgBox "No Index.dat files found. Scan Aborted."
     Else
       CreateSpyHtmFile
       'CloseIE
       'RunSpyHtmFile
       'DeleteIndexFiles        
     End If
     
   End If
End Sub


' +----------------------------------------------------------------------------+
' | Locate History Folder                                                      |
' +----------------------------------------------------------------------------+
Sub LocateHistoryFolder() 
   ' Example: C:\Documents and Settings\\Local Settings\History
   ' HistoryPath(0) = C:
   ' HistoryPath(1) = Documents and Settings
   ' HistoryPath(2) = 
   ' HistoryPath(3) = Local Settings
   ' HistoryPath(4) = History 
   HistoryPath=split(oWShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History"),"\")
End Sub


' +----------------------------------------------------------------------------+
' | Find ALL History Index.Dat Files                                           |
' +----------------------------------------------------------------------------+
Sub RecurseFilesAndFolders(oRoot, sFileEval)
   Dim oSubFolder, oFile, oRegExp

   Set oRegExp = New RegExp
   oRegExp.IgnoreCase = True

   If Not (sFileEval = "") Then
     oRegExp.Pattern = sFileEval
     For Each oFile in oRoot.Files
       If (oRegExp.Test(oFile.Name)) Then
         ReDim Preserve arrFiles(UBound(arrFiles) + 1)
         arrFiles(UBound(arrFiles)) = oFile.Path
         index=1 ' Found at least one index.dat file!
       End If
     Next
   End If

   For Each oSubFolder In oRoot.SubFolders
     RecurseFilesAndFolders oSubFolder, sFileEval
   Next
End Sub


' +----------------------------------------------------------------------------+
' | Create Spy.htm file                                                        |
' +----------------------------------------------------------------------------+
Sub CreateSpyHtmFile()
   Dim ub, user, spyTmp, oFS, index_dat

   Set oFS = CreateObject("Scripting.FileSystemObject") 
   If Not oFSO.FolderExists("\\server\logs$\inet\" & strUserName) Then
       oFS.CreateFolder(("\\server\logs$\inet\" & strUserName))      
  Set oTextStream = oFSO.OpenTextFile(spyPath,2,True)
       oTextStream.WriteLine "IE Log!"&objNet.UserName &" "& objNet.ComputerName &"

"     
       'oTextStream.WriteLine "[b]"+CStr(UBound(arrUsers)+1)+" users surfed on your PC:[/b]
"    
       'For Each index_dat In arrUsers
       '    oTextStream.WriteLine ""+index_dat+"
"             
       'Next 
       oTextStream.WriteLine "
"
       oTextStream.WriteLine "[b]Location:[/b][b]Date:[/b][b] Link:[/b]"
       GetTimeZoneBias
      ub = UBound(arrFiles)
      For Each index_dat In arrFiles
         user = split(index_dat,"\")
         spyTmp=oFSO.GetSpecialFolder(2)+"\spy.tmp"

         ' Copy index.dat ---> C:\Documents and Settings\\Local Settings\Temp\spy.tmp 
         ' REASON: Avoids file access violations under Windows.
         oFSO.CopyFile index_dat, spyTmp, True
         FindLinks "URL ", RSBinaryToString(ReadBinaryFile(spyTmp)), index_dat
       Next 
       oTextStream.WriteLine ""    
       'For Each index_dat In arrFiles
       '    oTextStream.WriteLine index_dat+"
"      
       'Next    
       oTextStream.WriteLine ""
       oTextStream.Close
       Set oFS = nothing 

   Else  
   Set oTextStream = oFSO.OpenTextFile(spyPath,8,True)
        'For Each index_dat In arrUsers
         '    oTextStream.WriteLine ""+index_dat+"
"             
      'Next 
      oTextStream.WriteLine  "

"
      oTextStream.WriteLine "
"
      oTextStream.WriteLine "[b]" & objNet.UserName &"[/b][b]"&  objNet.ComputerName &"[/b][b] Link:[/b]"
      GetTimeZoneBias
      ub = UBound(arrFiles)
      For Each index_dat In arrFiles
     user = split(index_dat,"\")
     spyTmp=oFSO.GetSpecialFolder(2)+"\spy.tmp"
     ' Copy index.dat ---> C:\Documents and Settings\\Local Settings\Temp\spy.tmp 
     ' REASON: Avoids file access violations under Windows.
           oFSO.CopyFile index_dat, spyTmp, True
           FindLinks "URL ", RSBinaryToString(ReadBinaryFile(spyTmp)), index_dat
       Next 
  
      ' oTextStream.WriteLine "
[b]Listing of history files:[/b]
"    
      ' For Each index_dat In arrFiles
      '     oTextStream.WriteLine index_dat+"
"      
      ' Next    
      ' oTextStream.WriteLine "
"
      ' oTextStream.Close
   end if
End Sub


' +----------------------------------------------------------------------------+
' | Get Time Zone Bias.                                                        |
' +----------------------------------------------------------------------------+
Sub GetTimeZoneBias()
   Dim nBiasKey, k

   nBiasKey = oWShell.RegRead("HKLM\System\CurrentControlSet\Control\TimeZoneInformation\ActiveTimeBias")
   If UCase(TypeName(nBiasKey)) = "LONG" Then
     nBias = nBiasKey
   ElseIf UCase(TypeName(nBiasKey)) = "VARIANT()" Then
     nBias = 0
     For k = 0 To UBound(nBiasKey)
       nBias = nBias + (nBiasKey(k) * 256^k)
     Next
   End If
End Sub


' +----------------------------------------------------------------------------+
' | Find Links within Index.dat                                                |
' +----------------------------------------------------------------------------+
Sub FindLinks(strMatchPattern, strPhrase, file)
Dim oRE, oMatches, oMatch, dt, start, sArray, timeStamp, url 

   Set oRE = New RegExp
   oRE.Pattern = strMatchPattern
   oRE.Global = True
   oRE.IgnoreCase = False
   Set oMatches = oRE.Execute(strPhrase)
   For Each oMatch In oMatches
     start = Instr(oMatch.FirstIndex + 1,strPhrase,": ")
     If start <> 0 Then
       sArray = Split(Mid(strPhrase,start+2),"@")
       url=Left(sArray(1),InStr(sArray(1),chr(0)))
       dt=AsciiToHex(Mid(strPhrase,oMatch.FirstIndex+1+16,8))
       timeStamp = cvtDate(dt(7)&dt(6)&dt(5)&dt(4),dt(3)&dt(2)&dt(1)&dt(0))
       'oTextStream.WriteLine "" & sArray(0) & " - " & timeStamp & " - " & "[url="&url&"]"&url&"[/url] - " & file & " - " & CStr(oMatch.FirstIndex + 1) & "
"                      
       'Visit User + Date + Visited URL
       if split(timestamp," ")(0) = FormatDateTime(date) then
           oTextStream.WriteLine ""&objNet.ComputerName&""+""&timeStamp&""&" [url="&url&"]"&url&"[/url]
"
       end if
     End If 
   Next
End Sub 


' +----------------------------------------------------------------------------+
' | Convert a 64-bit value to a date, adjusted for local time zone bias.       |
' +----------------------------------------------------------------------------+
Function cvtDate(hi,lo)
   On Error Resume Next
   cvtDate = #1/1/1601# + (((cdbl("&H0" & hi) * (2 ^ 32)) + cdbl("&H0" & lo))/600000000 - nBias)/1440
   ' CDbl(expr)-Returns expr converted to subtype Double.
   ' If expr cannot be converted to subtype Double, a type mismatch or overflow runtime error will occur.   
   cvtDate = CDate(cvtDate)
   If Err.Number <> 0 Then
     'WScript.Echo "Oops! An Error has occured - Error number " & Err.Number & " of the type '" & Err.description & "'."   
     On Error GoTo 0
     cvtDate = #1/1/1601#
     Err.Clear
   End If
   On Error GoTo 0  
End Function


' +----------------------------------------------------------------------------+
' | Turns ASCII string sData into array of hex numerics.                       |
' +----------------------------------------------------------------------------+
Function AsciiToHex(sData)
   Dim i, aTmp()
    
   ReDim aTmp(Len(sData) - 1)
   
   For i = 1 To Len(sData)
     aTmp(i - 1) = Hex(Asc(Mid(sData, i)))
     If len(aTmp(i - 1))=1 Then aTmp(i - 1)="0"+ aTmp(i - 1)      
   Next
   
   ASCIItoHex = aTmp
End Function


' +----------------------------------------------------------------------------+
' | Converts binary data to a string (BSTR) using ADO recordset.               |
' +----------------------------------------------------------------------------+
Function RSBinaryToString(xBinary)
   Dim Binary
   'MultiByte data must be converted To VT_UI1 | VT_ARRAY first.
   If vartype(xBinary)=8 Then Binary = MultiByteToBinary(xBinary) Else Binary = xBinary
   Dim RS, LBinary
   Const adLongVarChar = 201
   Set RS = CreateObject("ADODB.Recordset")
   LBinary = LenB(Binary)

   If LBinary>0 Then
     RS.Fields.Append "mBinary", adLongVarChar, LBinary
     RS.Open
     RS.AddNew
     RS("mBinary").AppendChunk Binary 
     RS.Update
     RSBinaryToString = RS("mBinary")
   Else
     RSBinaryToString = ""
   End If
End Function


' +----------------------------------------------------------------------------+
' | Read Binary Index.dat file.                                                |
' +----------------------------------------------------------------------------+
Function ReadBinaryFile(FileName)
   Const adTypeBinary = 1
   Dim BinaryStream : Set BinaryStream = CreateObject("ADODB.Stream")
   BinaryStream.Type = adTypeBinary
   BinaryStream.Open
   BinaryStream.LoadFromFile FileName
   ReadBinaryFile = BinaryStream.Read
   BinaryStream.Close
End Function


' +----------------------------------------------------------------------------+
' | Run Spy.htm file                                                           |
' +----------------------------------------------------------------------------+
Sub RunSpyHtmFile()
   If not oFSO.FileExists(spyPath) Then
     MsgBox "For some odd reason, "+spyPath+" does not exist:"+vbCRLF+vbCRLF+spyPath+vbCRLF+vbCRLF+"Unfortunately, no surfing history can be tracked. ([email protected])", VBOKonly, "Exiting (code=2)"
     CleanupQuit
   Else
     oWShell.Run chr(34)+spyPath+chr(34)
   End If
End Sub


' +----------------------------------------------------------------------------+
' | Delete Index.dat files                                                     |
' +----------------------------------------------------------------------------+
Sub DeleteIndexFiles()
   Dim sTempExe, elem
     
  ' If MsgBox ("Would you like to delete specific Index.dat files?", 65, "Notice")=1 Then

     ' Example: C:\Documents and Settings\\Local Settings\Temp\deindex.exe
     sTempExe = oFSO.GetSpecialFolder(2)+"\deindex.exe"

     BuildDeIndexFile(sTempExe)
     
     For Each elem In arrFiles
'        If MsgBox ("Delete file upon PC restart?"&vbcrlf&elem, 65, "Delete?")=1 Then
         oWShell.Run sTempExe+" "+chr(34)+elem+chr(34)
'        End If
     Next
     
'      MsgBox "Any pending file deletions are stored under this registry key:"&vbcrlf&vbcrlf&"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations"&vbcrlf&vbcrlf&"If you want to undo the pending deletions, goto the above value and simply delete it! (use: regedit.exe)",0,"Notice"
     
'      If MsgBox ("Would you like to RESTART your PC now?", 33, "Notice")=1 Then      
'        oWShell.Run "cmd.exe /c shutdown.exe "+chr(34)+"-r"+chr(34),0,True
'      End If
     
'    End If
End Sub

Sub myDeleteIndexFiles
  Dim elem, oTextStream
  For Each elem In arrFiles
On Error Resume Next
     Set oTextStream = oFSO.OpenTextFile(elem,2)
  Next
End Sub

' +----------------------------------------------------------------------------+
' | Build DeIndex.exe (see source code below)                                  |
' +----------------------------------------------------------------------------+
Sub BuildDeIndexFile(sTempExe)
   Dim t, i, deindex
   
   If not oFSO.FileExists(sTempExe) Then
     t=split("4D,5A,90,00,03,00,00,00,04,00,00,00,FF,FF,00,00,B8,00,00,00,00,00,00,00,40,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,B0,00,00,00,0E,1F,BA,0E,00,B4,09,CD,21,B8,01,4C,CD,21,54,68,69,73,20,70,72,6F,67,72,61,6D,20,63,61,6E,6E,6F,74,20,62,65,20,72,75,6E,20,69,6E,20,44,4F,53,20,6D,6F,64,65,2E,0D,0D,0A,24,00,00,00,00,00,00,00,D5,FA,31,DE,91,9B,5F,8D,91,9B,5F,8D,91,9B,5F,8D,1F,84,4C,8D,97,9B,5F,8D,6D,BB,4D,8D,93,9B,5F,8D,52,69,63,68,91,9B,5F,8D,00,00,00,00,00,00,00,00,50,45,00,00,4C,01,03,00,70,78,71,40,00,00,00,00,00,00,00,00,E0,00,0F,01,0B,01,05,0C,00,02,00,00,00,04,00,00,00,00,00,00,00,10,00,00,00,10,00,00,00,20,00,00,00,00,40,00,00,10,00,00,00,02,00,00,04,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,00,40,00,00,00,04,00,00,00,00,00,00,02,00,00,00,00,00,10,00,00,10,00,00,00,00,10,00,00,10,00,00,00,00,00,00,10,00,00,00,00,00,00,00,00,00,00,00,10,20,00,00,28,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,20,00,00,10,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2E,74,65,78,74,00,00,00,48,01,00,00,00,10,00,00,00,02,00,00,00,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,20,00,00,60,2E,72,64,61,74,61,00,00,84,00,00,00,00,20,00,00,00,02,00,00,00,06,00,00,00,00,00,00,00,00,00,00,00,00,00,00,40,00,00,40,2E,64,61,74,61,00,00,00,04,01,00,00,00,30,00,00,00,02,00,00,00,08,00,00,00,00,00,00,00,00,00,00,00,00,00,00,40,00,00,C0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,68,00,30,40,00,6A,01,E8,24,00,00,00,6A,04,6A,00,68,00,30,40,00,E8,0E,00,00,00,6A,00,E8,01,00,00,00,CC,FF,25,08,20,40,00,FF,25,00,20,40,00,CC,CC,55,8B,EC,81,C4,7C,FE,FF,FF,56,57,E8,02,01,00,00,89,45,FC,33,C9,8B,75,FC,AC,3C,00,74,07,3C,22,75,F7,41,EB,F4,51,D1,E9,D1,E1,58,3B,C1,74,0B,5F,5E,B8,03,00,00,00,C9,C2,08,00,8B,75,FC,8D,BD,3C,FF,FF,FF,AC,3C,00,74,09,3C,09,75,02,B0,20,AA,EB,F2,AA,8D,85,3C,FF,FF,FF,8B,F0,8B,F8,AC,3C,00,75,02,EB,1B,3C,22,75,03,AA,EB,03,AA,EB,EF,AC,3C,20,75,02,B0,FE,3C,22,75,03,AA,EB,E1,AA,EB,EF,AA,8D,85,3C,FF,FF,FF,8B,F0,8D,BD,7C,FE,FF,FF,B9,00,00,00,00,AC,3C,20,74,FB,3B,4D,08,74,15,AC,3C,00,74,1D,3C,20,75,0A,AC,3C,20,74,FB,41,3C,00,74,0F,EB,E6,AA,AC,3C,20,74,07,3C,00,74,03,AA,EB,F4,B0,00,AA,3B,4D,08,73,11,8B,7D,0C,B0,00,AA,B8,02,00,00,00,5F,5E,C9,C2,08,00,8D,85,7C,FE,FF,FF,8B,F0,8B,7D,0C,AC,3C,00,74,0D,3C,22,74,F7,3C,FE,75,02,B0,20,AA,EB,EE,AA,8B,75,0C,AC,3C,00,75,0B,5F,5E,B8,04,00,00,00,C9,C2,08,00,B8,01,00,00,00,5F,5E,C9,C2,08,00,FF,25,04,20,40,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,56,20,00,00,72,20,00,00,48,20,00,00,00,00,00,00,38,20,00,00,00,00,00,00,00,00,00,00,64,20,00,00,00,20,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,56,20,00,00,72,20,00,00,48,20,00,00,00,00,00,00,80,00,45,78,69,74,50,72,6F,63,65,73,73,00,C1,01,4D,6F,76,65,46,69,6C,65,45,78,41,00,6B,65,72,6E,65,6C,33,32,2E,64,6C,6C,00,00,C8,00,47,65,74,43,6F,6D,6D,61,6E,64,4C,69,6E,65,41,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00",",")

     Set deindex=oFSO.CreateTextFile(sTempExe,2)

     ' Check that deindex.exe was created.   
     If not oFSO.FileExists(sTempExe) Then
       MsgBox "For some odd reason, DEINDEX.EXE does not exist:"+vbCRLF+vbCRLF+sTempExe+vbCRLF+vbCRLF+"Unfortunately, no surfing history can be deleted. ([email protected])", VBOKonly, "Exiting (code=3)"
       CleanupQuit
     End If    

     For i=0 To UBound(t)
       deindex.Write chr(Int("&H"&t(i)))
     Next

     deindex.Close
   End If
    
End Sub


' +----------------------------------------------------------------------------+
' | Source code for DeIndex.exe                                                |
' +----------------------------------------------------------------------------+
' ;Title:    Delete Index.dat files!
' ;Author:   Vengy! (-_-)
' ;Date:     2004 and beyond ...
' ;Tested:   Win2K/XP ...
' ;Compiled: MASM32
' ;Comments: cyber_flash @ hotmail.com
'
' ;This program takes the index.dat file path as a commandline argument,
' ;then invokes the MoveFileEx API which deletes the specified file upon RESTART.
'
' ;The Pending file renames are stored under this registry key:
' ;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
'
' ;Please visit the link below for more details. Thanks!
' ;[url]http://msdn.microsoft.com/library/en-us/fileio/base/movefileex.asp[/url]
'
'
' .486p
' .MODEL flat, stdcall
' option casemap:none
'
' include             \masm32\include\windows.inc
' include             \masm32\include\kernel32.inc
' include             \masm32\include\masm32.inc
' includelib          \masm32\lib\kernel32.lib
' includelib          \masm32\lib\masm32.lib
'
' .DATA
'       szSrcFile db MAX_PATH dup(0)
'
' .CODE
' Main:
'       invoke    GetCL, 1, addr szSrcFile
'       invoke    MoveFileEx, addr szSrcFile, NULL, MOVEFILE_DELAY_UNTIL_REBOOT
'       invoke    ExitProcess, 0
' End   Main
' +----------------------------------------------------------------------------+
' | End of DeIndex.exe source code                                             |
' +----------------------------------------------------------------------------+

Just assign the above script in the logoff user section in gp and it should record all site visited and on what computer.

[SpuffMonkey]

Could we try that again??

[MrDylan]

I use Webspy.

[Geoff]

Please tell me how! It's driving me mad. I have tried everything but I can;t workout why there should be difference between automatic updates running through on-site squid and through direct connection.

 

Updates for what?

[Marcus]

The other option is to get someone to collect the information for you, then sit back and read the results.

[NetworkGeezer]

Please tell me how! It's driving me mad. I have tried everything but I can;t workout why there should be difference between automatic updates running through on-site squid and through direct connection.

 

Updates for what?

 

I presume he/she meant the os/app updates that are barred by a default squid configuration.

[SpuffMonkey]

Hey - uk101man - that is a peach of a script and seems to do exactly what I was after - definitely worth a beer if we ever meet up at one of these Edugeek gigs - thanks so much for sharing your knowledge & hard work

 

Cheers

 

Spuffy

[alan-d]

The other option is to get someone to collect the information for you, then sit back and read the results.

 

lol - how sneaky was that post?

[uk101man]

hi,

 

i got the code of the web somewhere bt done a lot of hacks to it.

 

 

hope the ppl using it finds it helpful

 

Tom

[eejit]

@ uk101man: That script you supplied is probably the most useful I have ever come across - excellent post.

 

One tweak would help us though, we'd prefer all the htm files to be in one folder, so instead of:

\\servername\logs$\inet\%username%\spy.htm

 

Would it be possible to store the files as:

\\servername\logs$\inet\%username%.htm

 

I've had a play with the script, but to be honest I can't really understand how it works. Do you think you could customize it as I've described?

 

Thanks again though

[ChrisH]

Assuming this doesnt mess anything up futher on in the script change:

 

spyPath = "\\server\logs$\inet\" &strUsername&"\spy.htm"

 

to

 

spyPath = "\\server\logs$\inet\" &strUsername&".htm"

[eejit]

Cheers for that Chris.

 

I did actually try that, but it still then creates the subfolder (clearly not the end of the world) BUT it no longer appends the websites, creating new entries only

[uk101man]

Hi Girls and Guys

 

indiegirl...love reading your blog, I know how you feel.

 

First of all sorry for the delay in response, but I’ve changed jobs and no longer work in education and at the moment I’m being kept very busy in London!. If anyone knows of a network/system administrator or manager job going PM me.

 

Last post was nearly right!! I've post the script with changes:

 

 

' C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat - Starting offset: 0000:5000
' +----------------------------------------------------------------------------+
' | Ensure that all variable names are defined!                                |
' +----------------------------------------------------------------------------+
Option Explicit


' +----------------------------------------------------------------------------+
' | Setup constants                                                            |
' +----------------------------------------------------------------------------+
Const conBarSpeed=80
Const conForcedTimeOut=3600000 ' 1 hour


' +----------------------------------------------------------------------------+
' | Setup Objects and misc variables                                           |
' +----------------------------------------------------------------------------+
Dim spyPath     
Dim oFSO        : Set oFSO = CreateObject("Scripting.FileSystemObject")
Dim oWShell     : Set oWShell = CreateObject("WScript.Shell")
Dim objNet      : Set objNet = CreateObject("WScript.Network")
Dim Env         : Set Env = oWShell.Environment("SYSTEM")
Dim arrFiles    : arrFiles = Array()
'Dim arrUsers    : arrUsers = Array()
Dim HistoryPath : HistoryPath = Array()
Dim objIE
Dim objProgressBar
Dim objTextLine1
Dim objTextLine2
Dim objQuitFlag
Dim oTextStream
Dim index
Dim nBias
Dim strUserName

' +----------------------------------------------------------------------------+
' | Whose been a naughty surfer? Let's find out!                             |
' +----------------------------------------------------------------------------+
'Here is where we extract the UserName
strUserName = objNet.UserName
spyPath = "\\server\logs$\inet\" &strUsername&".htm"
StartSpyScan
'DeleteIndexFiles()
myDeleteIndexFiles


' +----------------------------------------------------------------------------+
' | Outta here ...                                                             |
' +----------------------------------------------------------------------------+
CleanupQuit


' +----------------------------------------------------------------------------+
' | Cleanup and Quit                                                           |
' +----------------------------------------------------------------------------+
Sub CleanupQuit()
   Set oFSO = Nothing
   Set oWShell = Nothing
   Set objNet = Nothing
   WScript.Quit
End Sub


' +----------------------------------------------------------------------------+
' | Start Spy Scan                                                             |
' +----------------------------------------------------------------------------+
Sub StartSpyScan()
   Dim index_folder, history_folder, oSubFolder, oStartDir, sFileRegExPattern, user

   LocateHistoryFolder
   index_folder=HistoryPath(0)&"\"&HistoryPath(1)
   
   If Not oFSO.FolderExists(index_folder) Then
     'MsgBox "No history folder exists. Scan Aborted."
   Else  
     
     'StartIE "IE Spy"
     'SetLine1 "Locating history files:"
     
     sFileRegExPattern = "\index.dat$"
     Set oStartDir = oFSO.GetFolder(index_folder)
     
     For Each oSubFolder In oStartDir.SubFolders
       history_folder=oSubFolder.Path&"\"&HistoryPath(3)&"\"&HistoryPath(4)&"\"&"History.IE5"
       If oFSO.FolderExists(history_folder) Then
         user = split(history_folder,"\")
    'SetLine2 user(2)
         'ReDim Preserve arrUsers(UBound(arrUsers) + 1)
         'arrUsers(UBound(arrUsers)) = user(2) 
         if user(2) = strUserName then
            Set oStartDir = oFSO.GetFolder(history_folder)
            RecurseFilesAndFolders oStartDir, sFileRegExPattern
    end if
       End If
     Next
     
     If IsEmpty(index) Then
       'CloseIE
       'MsgBox "No Index.dat files found. Scan Aborted."
     Else
       CreateSpyHtmFile
       'CloseIE
       'RunSpyHtmFile
       'DeleteIndexFiles        
     End If
     
   End If
End Sub


' +----------------------------------------------------------------------------+
' | Locate History Folder                                                      |
' +----------------------------------------------------------------------------+
Sub LocateHistoryFolder() 
   ' Example: C:\Documents and Settings\\Local Settings\History
   ' HistoryPath(0) = C:
   ' HistoryPath(1) = Documents and Settings
   ' HistoryPath(2) = 
   ' HistoryPath(3) = Local Settings
   ' HistoryPath(4) = History 
   HistoryPath=split(oWShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History"),"\")
End Sub


' +----------------------------------------------------------------------------+
' | Find ALL History Index.Dat Files                                           |
' +----------------------------------------------------------------------------+
Sub RecurseFilesAndFolders(oRoot, sFileEval)
   Dim oSubFolder, oFile, oRegExp

   Set oRegExp = New RegExp
   oRegExp.IgnoreCase = True

   If Not (sFileEval = "") Then
     oRegExp.Pattern = sFileEval
     For Each oFile in oRoot.Files
       If (oRegExp.Test(oFile.Name)) Then
         ReDim Preserve arrFiles(UBound(arrFiles) + 1)
         arrFiles(UBound(arrFiles)) = oFile.Path
         index=1 ' Found at least one index.dat file!
       End If
     Next
   End If

   For Each oSubFolder In oRoot.SubFolders
     RecurseFilesAndFolders oSubFolder, sFileEval
   Next
End Sub


' +----------------------------------------------------------------------------+
' | Create Spy.htm file                                                        |
' +----------------------------------------------------------------------------+
Sub CreateSpyHtmFile()
   Dim ub, user, spyTmp, oFS, index_dat

   Set oFS = CreateObject("Scripting.FileSystemObject") 
   If Not oFSO.FolderExists("\\server\logs$\inet") Then
       oFS.CreateFolder(("\\server\logs$\inet"))      
  Set oTextStream = oFSO.OpenTextFile(spyPath,2,True)
       oTextStream.WriteLine "IE Log!"&objNet.UserName &" "& objNet.ComputerName &"

"     
       'oTextStream.WriteLine "[b]"+CStr(UBound(arrUsers)+1)+" users surfed on your PC:[/b]
"    
       'For Each index_dat In arrUsers
       '    oTextStream.WriteLine ""+index_dat+"
"             
       'Next 
       oTextStream.WriteLine "
"
       oTextStream.WriteLine "[b]Location:[/b][b]Date:[/b][b] Link:[/b]"
       GetTimeZoneBias
      ub = UBound(arrFiles)
      For Each index_dat In arrFiles
         user = split(index_dat,"\")
         spyTmp=oFSO.GetSpecialFolder(2)+"\spy.tmp"

         ' Copy index.dat ---> C:\Documents and Settings\\Local Settings\Temp\spy.tmp 
         ' REASON: Avoids file access violations under Windows.
         oFSO.CopyFile index_dat, spyTmp, True
         FindLinks "URL ", RSBinaryToString(ReadBinaryFile(spyTmp)), index_dat
       Next 
       oTextStream.WriteLine ""    
       'For Each index_dat In arrFiles
       '    oTextStream.WriteLine index_dat+"
"      
       'Next    
       oTextStream.WriteLine ""
       oTextStream.Close
       Set oFS = nothing 

   Else  
   Set oTextStream = oFSO.OpenTextFile(spyPath,8,True)
        'For Each index_dat In arrUsers
         '    oTextStream.WriteLine ""+index_dat+"
"             
      'Next 
      oTextStream.WriteLine  "

"
      oTextStream.WriteLine "
"
      oTextStream.WriteLine "[b]" & objNet.UserName &"[/b][b]"&  objNet.ComputerName &"[/b][b] Link:[/b]"
      GetTimeZoneBias
      ub = UBound(arrFiles)
      For Each index_dat In arrFiles
     user = split(index_dat,"\")
     spyTmp=oFSO.GetSpecialFolder(2)+"\spy.tmp"
     ' Copy index.dat ---> C:\Documents and Settings\\Local Settings\Temp\spy.tmp 
     ' REASON: Avoids file access violations under Windows.
           oFSO.CopyFile index_dat, spyTmp, True
           FindLinks "URL ", RSBinaryToString(ReadBinaryFile(spyTmp)), index_dat
       Next 
  
      ' oTextStream.WriteLine "
[b]Listing of history files:[/b]
"    
      ' For Each index_dat In arrFiles
      '     oTextStream.WriteLine index_dat+"
"      
      ' Next    
      ' oTextStream.WriteLine "
"
      ' oTextStream.Close
   end if
End Sub


' +----------------------------------------------------------------------------+
' | Get Time Zone Bias.                                                        |
' +----------------------------------------------------------------------------+
Sub GetTimeZoneBias()
   Dim nBiasKey, k

   nBiasKey = oWShell.RegRead("HKLM\System\CurrentControlSet\Control\TimeZoneInformation\ActiveTimeBias")
   If UCase(TypeName(nBiasKey)) = "LONG" Then
     nBias = nBiasKey
   ElseIf UCase(TypeName(nBiasKey)) = "VARIANT()" Then
     nBias = 0
     For k = 0 To UBound(nBiasKey)
       nBias = nBias + (nBiasKey(k) * 256^k)
     Next
   End If
End Sub


' +----------------------------------------------------------------------------+
' | Find Links within Index.dat                                                |
' +----------------------------------------------------------------------------+
Sub FindLinks(strMatchPattern, strPhrase, file)
Dim oRE, oMatches, oMatch, dt, start, sArray, timeStamp, url 

   Set oRE = New RegExp
   oRE.Pattern = strMatchPattern
   oRE.Global = True
   oRE.IgnoreCase = False
   Set oMatches = oRE.Execute(strPhrase)
   For Each oMatch In oMatches
     start = Instr(oMatch.FirstIndex + 1,strPhrase,": ")
     If start <> 0 Then
       sArray = Split(Mid(strPhrase,start+2),"@")
       url=Left(sArray(1),InStr(sArray(1),chr(0)))
       dt=AsciiToHex(Mid(strPhrase,oMatch.FirstIndex+1+16,8))
       timeStamp = cvtDate(dt(7)&dt(6)&dt(5)&dt(4),dt(3)&dt(2)&dt(1)&dt(0))
       'oTextStream.WriteLine "" & sArray(0) & " - " & timeStamp & " - " & "[url="&url&"]"&url&"[/url] - " & file & " - " & CStr(oMatch.FirstIndex + 1) & "
"                      
       'Visit User + Date + Visited URL
       if split(timestamp," ")(0) = FormatDateTime(date) then
           oTextStream.WriteLine ""&objNet.ComputerName&""+""&timeStamp&""&" [url="&url&"]"&url&"[/url]
"
       end if
     End If 
   Next
End Sub 


' +----------------------------------------------------------------------------+
' | Convert a 64-bit value to a date, adjusted for local time zone bias.       |
' +----------------------------------------------------------------------------+
Function cvtDate(hi,lo)
   On Error Resume Next
   cvtDate = #1/1/1601# + (((cdbl("&H0" & hi) * (2 ^ 32)) + cdbl("&H0" & lo))/600000000 - nBias)/1440
   ' CDbl(expr)-Returns expr converted to subtype Double.
   ' If expr cannot be converted to subtype Double, a type mismatch or overflow runtime error will occur.   
   cvtDate = CDate(cvtDate)
   If Err.Number <> 0 Then
     'WScript.Echo "Oops! An Error has occured - Error number " & Err.Number & " of the type '" & Err.description & "'."   
     On Error GoTo 0
     cvtDate = #1/1/1601#
     Err.Clear
   End If
   On Error GoTo 0  
End Function


' +----------------------------------------------------------------------------+
' | Turns ASCII string sData into array of hex numerics.                       |
' +----------------------------------------------------------------------------+
Function AsciiToHex(sData)
   Dim i, aTmp()
    
   ReDim aTmp(Len(sData) - 1)
   
   For i = 1 To Len(sData)
     aTmp(i - 1) = Hex(Asc(Mid(sData, i)))
     If len(aTmp(i - 1))=1 Then aTmp(i - 1)="0"+ aTmp(i - 1)      
   Next
   
   ASCIItoHex = aTmp
End Function


' +----------------------------------------------------------------------------+
' | Converts binary data to a string (BSTR) using ADO recordset.               |
' +----------------------------------------------------------------------------+
Function RSBinaryToString(xBinary)
   Dim Binary
   'MultiByte data must be converted To VT_UI1 | VT_ARRAY first.
   If vartype(xBinary)=8 Then Binary = MultiByteToBinary(xBinary) Else Binary = xBinary
   Dim RS, LBinary
   Const adLongVarChar = 201
   Set RS = CreateObject("ADODB.Recordset")
   LBinary = LenB(Binary)

   If LBinary>0 Then
     RS.Fields.Append "mBinary", adLongVarChar, LBinary
     RS.Open
     RS.AddNew
     RS("mBinary").AppendChunk Binary 
     RS.Update
     RSBinaryToString = RS("mBinary")
   Else
     RSBinaryToString = ""
   End If
End Function


' +----------------------------------------------------------------------------+
' | Read Binary Index.dat file.                                                |
' +----------------------------------------------------------------------------+
Function ReadBinaryFile(FileName)
   Const adTypeBinary = 1
   Dim BinaryStream : Set BinaryStream = CreateObject("ADODB.Stream")
   BinaryStream.Type = adTypeBinary
   BinaryStream.Open
   BinaryStream.LoadFromFile FileName
   ReadBinaryFile = BinaryStream.Read
   BinaryStream.Close
End Function


' +----------------------------------------------------------------------------+
' | Run Spy.htm file                                                           |
' +----------------------------------------------------------------------------+
Sub RunSpyHtmFile()
   If not oFSO.FileExists(spyPath) Then
     MsgBox "For some odd reason, "+spyPath+" does not exist:"+vbCRLF+vbCRLF+spyPath+vbCRLF+vbCRLF+"Unfortunately, no surfing history can be tracked. ([email protected])", VBOKonly, "Exiting (code=2)"
     CleanupQuit
   Else
     oWShell.Run chr(34)+spyPath+chr(34)
   End If
End Sub


' +----------------------------------------------------------------------------+
' | Delete Index.dat files                                                     |
' +----------------------------------------------------------------------------+
Sub DeleteIndexFiles()
   Dim sTempExe, elem
     
  ' If MsgBox ("Would you like to delete specific Index.dat files?", 65, "Notice")=1 Then

     ' Example: C:\Documents and Settings\\Local Settings\Temp\deindex.exe
     sTempExe = oFSO.GetSpecialFolder(2)+"\deindex.exe"

     BuildDeIndexFile(sTempExe)
     
     For Each elem In arrFiles
'        If MsgBox ("Delete file upon PC restart?"&vbcrlf&elem, 65, "Delete?")=1 Then
         oWShell.Run sTempExe+" "+chr(34)+elem+chr(34)
'        End If
     Next
     
'      MsgBox "Any pending file deletions are stored under this registry key:"&vbcrlf&vbcrlf&"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations"&vbcrlf&vbcrlf&"If you want to undo the pending deletions, goto the above value and simply delete it! (use: regedit.exe)",0,"Notice"
     
'      If MsgBox ("Would you like to RESTART your PC now?", 33, "Notice")=1 Then      
'        oWShell.Run "cmd.exe /c shutdown.exe "+chr(34)+"-r"+chr(34),0,True
'      End If
     
'    End If
End Sub

Sub myDeleteIndexFiles
  Dim elem, oTextStream
  For Each elem In arrFiles
On Error Resume Next
     Set oTextStream = oFSO.OpenTextFile(elem,2)
  Next
End Sub

' +----------------------------------------------------------------------------+
' | Build DeIndex.exe (see source code below)                                  |
' +----------------------------------------------------------------------------+
Sub BuildDeIndexFile(sTempExe)
   Dim t, i, deindex
   
   If not oFSO.FileExists(sTempExe) Then
     t=split("4D,5A,90,00,03,00,00,00,04,00,00,00,FF,FF,00,00,B8,00,00,00,00,00,00,00,40,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,B0,00,00,00,0E,1F,BA,0E,00,B4,09,CD,21,B8,01,4C,CD,21,54,68,69,73,20,70,72,6F,67,72,61,6D,20,63,61,6E,6E,6F,74,20,62,65,20,72,75,6E,20,69,6E,20,44,4F,53,20,6D,6F,64,65,2E,0D,0D,0A,24,00,00,00,00,00,00,00,D5,FA,31,DE,91,9B,5F,8D,91,9B,5F,8D,91,9B,5F,8D,1F,84,4C,8D,97,9B,5F,8D,6D,BB,4D,8D,93,9B,5F,8D,52,69,63,68,91,9B,5F,8D,00,00,00,00,00,00,00,00,50,45,00,00,4C,01,03,00,70,78,71,40,00,00,00,00,00,00,00,00,E0,00,0F,01,0B,01,05,0C,00,02,00,00,00,04,00,00,00,00,00,00,00,10,00,00,00,10,00,00,00,20,00,00,00,00,40,00,00,10,00,00,00,02,00,00,04,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,00,40,00,00,00,04,00,00,00,00,00,00,02,00,00,00,00,00,10,00,00,10,00,00,00,00,10,00,00,10,00,00,00,00,00,00,10,00,00,00,00,00,00,00,00,00,00,00,10,20,00,00,28,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,20,00,00,10,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2E,74,65,78,74,00,00,00,48,01,00,00,00,10,00,00,00,02,00,00,00,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,20,00,00,60,2E,72,64,61,74,61,00,00,84,00,00,00,00,20,00,00,00,02,00,00,00,06,00,00,00,00,00,00,00,00,00,00,00,00,00,00,40,00,00,40,2E,64,61,74,61,00,00,00,04,01,00,00,00,30,00,00,00,02,00,00,00,08,00,00,00,00,00,00,00,00,00,00,00,00,00,00,40,00,00,C0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,68,00,30,40,00,6A,01,E8,24,00,00,00,6A,04,6A,00,68,00,30,40,00,E8,0E,00,00,00,6A,00,E8,01,00,00,00,CC,FF,25,08,20,40,00,FF,25,00,20,40,00,CC,CC,55,8B,EC,81,C4,7C,FE,FF,FF,56,57,E8,02,01,00,00,89,45,FC,33,C9,8B,75,FC,AC,3C,00,74,07,3C,22,75,F7,41,EB,F4,51,D1,E9,D1,E1,58,3B,C1,74,0B,5F,5E,B8,03,00,00,00,C9,C2,08,00,8B,75,FC,8D,BD,3C,FF,FF,FF,AC,3C,00,74,09,3C,09,75,02,B0,20,AA,EB,F2,AA,8D,85,3C,FF,FF,FF,8B,F0,8B,F8,AC,3C,00,75,02,EB,1B,3C,22,75,03,AA,EB,03,AA,EB,EF,AC,3C,20,75,02,B0,FE,3C,22,75,03,AA,EB,E1,AA,EB,EF,AA,8D,85,3C,FF,FF,FF,8B,F0,8D,BD,7C,FE,FF,FF,B9,00,00,00,00,AC,3C,20,74,FB,3B,4D,08,74,15,AC,3C,00,74,1D,3C,20,75,0A,AC,3C,20,74,FB,41,3C,00,74,0F,EB,E6,AA,AC,3C,20,74,07,3C,00,74,03,AA,EB,F4,B0,00,AA,3B,4D,08,73,11,8B,7D,0C,B0,00,AA,B8,02,00,00,00,5F,5E,C9,C2,08,00,8D,85,7C,FE,FF,FF,8B,F0,8B,7D,0C,AC,3C,00,74,0D,3C,22,74,F7,3C,FE,75,02,B0,20,AA,EB,EE,AA,8B,75,0C,AC,3C,00,75,0B,5F,5E,B8,04,00,00,00,C9,C2,08,00,B8,01,00,00,00,5F,5E,C9,C2,08,00,FF,25,04,20,40,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,56,20,00,00,72,20,00,00,48,20,00,00,00,00,00,00,38,20,00,00,00,00,00,00,00,00,00,00,64,20,00,00,00,20,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,56,20,00,00,72,20,00,00,48,20,00,00,00,00,00,00,80,00,45,78,69,74,50,72,6F,63,65,73,73,00,C1,01,4D,6F,76,65,46,69,6C,65,45,78,41,00,6B,65,72,6E,65,6C,33,32,2E,64,6C,6C,00,00,C8,00,47,65,74,43,6F,6D,6D,61,6E,64,4C,69,6E,65,41,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00",",")

     Set deindex=oFSO.CreateTextFile(sTempExe,2)

     ' Check that deindex.exe was created.   
     If not oFSO.FileExists(sTempExe) Then
       MsgBox "For some odd reason, DEINDEX.EXE does not exist:"+vbCRLF+vbCRLF+sTempExe+vbCRLF+vbCRLF+"Unfortunately, no surfing history can be deleted. ([email protected])", VBOKonly, "Exiting (code=3)"
       CleanupQuit
     End If    

     For i=0 To UBound(t)
       deindex.Write chr(Int("&H"&t(i)))
     Next

     deindex.Close
   End If
    
End Sub


' +----------------------------------------------------------------------------+
' | Source code for DeIndex.exe                                                |
' +----------------------------------------------------------------------------+
' ;Title:    Delete Index.dat files!
' ;Author:   Vengy! (-_-)
' ;Date:     2004 and beyond ...
' ;Tested:   Win2K/XP ...
' ;Compiled: MASM32
' ;Comments: cyber_flash @ hotmail.com
'
' ;This program takes the index.dat file path as a commandline argument,
' ;then invokes the MoveFileEx API which deletes the specified file upon RESTART.
'
' ;The Pending file renames are stored under this registry key:
' ;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
'
' ;Please visit the link below for more details. Thanks!
' ;[url]http://msdn.microsoft.com/library/en-us/fileio/base/movefileex.asp[/url]
'
'
' .486p
' .MODEL flat, stdcall
' option casemap:none
'
' include             \masm32\include\windows.inc
' include             \masm32\include\kernel32.inc
' include             \masm32\include\masm32.inc
' includelib          \masm32\lib\kernel32.lib
' includelib          \masm32\lib\masm32.lib
'
' .DATA
'       szSrcFile db MAX_PATH dup(0)
'
' .CODE
' Main:
'       invoke    GetCL, 1, addr szSrcFile
'       invoke    MoveFileEx, addr szSrcFile, NULL, MOVEFILE_DELAY_UNTIL_REBOOT
'       invoke    ExitProcess, 0
' End   Main
' +----------------------------------------------------------------------------+
' | End of DeIndex.exe source code                                             |
' +----------------------------------------------------------------------------+

[MkII]

The spy.tmp file isn't deleted - it should shouldn't it?

 

[the script wont run twice with it there]

[MkII]

Having lots of fun with this!

 

Just wondering if it would it be possible to add some sort of reporting facility...

[ChrisH]

You mean log to a database and build some queries? Shouldnt be too hard.