asked on

is there an export feature for easy reading in task scheduler

how can I use task scheduler to see if there is spyware, keylogger, trojan, virus,

I tried looking at tasks in last 24 hours, 7 days

some tasks have names that are in {}

for example
{CD45465-544545-34343-645}

do i need to find each .exe file by clicking many times and then writing (no copy paste) to notepad

is there an export feature for easy reading

Shaun Vermaak

From http://stackoverflow.com/questions/15439542/how-to-use-powershell-to-inventory-scheduled-tasks by Frode F.

Save this as Tasks.ps1

function getTasks($path) {
    $out = @()

    # Get root tasks
    $schedule.GetFolder($path).GetTasks(0) | % {
        $xml = [xml]$_.xml
        $out += New-Object psobject -Property @{
            "Name" = $_.Name
            "Path" = $_.Path
            "LastRunTime" = $_.LastRunTime
            "NextRunTime" = $_.NextRunTime
            "Actions" = ($xml.Task.Actions.Exec | % { "$($_.Command) $($_.Arguments)" }) -join "`n"
        }
    }

    # Get tasks from subfolders
    $schedule.GetFolder($path).GetFolders(0) | % {
        $out += getTasks($_.Path)
    }

    #Output
    $out
}

$tasks = @()

$schedule = New-Object -ComObject "Schedule.Service"
$schedule.Connect() 

# Start inventory
$tasks += getTasks("\")

# Close com
[System.Runtime.Interopservices.Marshal]::ReleaseComObject($schedule) | Out-Null
Remove-Variable schedule

# Output all tasks
$tasks

Open in new window

then run

.\Tasks.ps1|Export-CSV -path test.csv

Open in new window

rgb192

ASKER

how and where do i run

rgb192

ASKER

do you have any follow up questions

Bill Prew

rgb192,

Did you follow the steps Shawn suggested, or do you need more info to be able to do that?

~bp

rgb192

ASKER

I saved Tasks.ps1

could you tell me an easy way to run file
maybe save on desktop and click file

this is what confuses me:
I think copy paste this in cmd.exe
.\Tasks.ps1|Export-CSV -path test.csv

Shaun Vermaak

could you tell me an easy way to run file
maybe save on desktop and click file

Save to desktop, open PowerShell, browse to file and run

this is what confuses me:
I think copy paste this in cmd.exe
.\Tasks.ps1|Export-CSV -path test.csv

Paste into PowerShell.exe

rgb192

ASKER

could you tell me an easy way to run file maybe save on desktop and click file
Save to desktop, open PowerShell, browse to file and run

I can create file Tasks.ps1
on desktop and click on file icon

-----------------------------------------
confusing part:

this is what confuses me: I think copy paste this in cmd.exe
.\Tasks.ps1|Export-CSV -path test.csv
Paste into PowerShell.exe

do I save file.
what is file name
do I run file

is path a variable or "path"

ASKER CERTIFIED SOLUTION

Bill Prew

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

rgb192

ASKER

Thanks.