This is useful for me from time to time. Here’s a screenshot. Code is below.
@echo off color 1f cls : Possible processes that shouldn't be running... echo. echo -----[ Unusual Running Applications ]----- echo. : Temp files echo ===== Temp echo. for /F tokens=1,2* delims== %%A IN ('wmic path win32_process where executablepath like '%%temp%%' get executablepath /format:list 2^>NUL ^|FIND =') do echo FOUND: %%B echo. echo ===== AppData echo. for /F tokens=1,2* delims== %%A IN ('wmic path win32_process where executablepath like '%%AppData%%' get executablepath /format:list 2^>NUL ^|FIND =') do echo FOUND: %%B echo. echo ===== Application Data echo. for /F tokens=1,2* delims== %%A IN ('wmic path win32_process where executablepath like '%%Application Data%%' get executablepath /format:list 2^>NUL ^|FIND =') do echo FOUND: %%B echo. echo ===== Local Settings for /F tokens=1,2* delims== %%A IN ('wmic path win32_process where executablepath like '%%Local Settings%%' get executablepath /format:list 2^>NUL ^|FIND =') do echo FOUND: %%B echo. echo. echo -----[ Startup ]----- wmic startup list full 2>NUL echo. echo. echo -----[ Running Processes ]---- : wmic process list 2>NUL echo [DONE]
Thanks! it is helpful.