VBScript by comparing the registry to find hidden services _vbs

Effect Chart:

Code (Checksvr.vbs):

Copy Code code as follows:

' On Error Resume Next

Const HKEY_LOCAL_MACHINE = &H80000002

Set oreg=getobject ("Winmgmts:{impersonationlevel=impersonate}!\\.\root\default:stdregprov")

strKeyPath = "System\currentcontrolset\services"
Oreg.enumkey HKEY_LOCAL_MACHINE, strKeyPath, Arrsubkeys

WScript.Echo "Checking, please wait ..."
WScript.Echo ""

For each subkey in Arrsubkeys
Oreg.getstringvalue HKEY_LOCAL_MACHINE, strKeyPath & "\" & subkey, "ObjectName", strvalue

If Not (strvalue = "") Then
' Judging services, using arrays to compare do not know if it will be faster?
If Not (CHECKSVR (subkey)) Then
WScript.Echo Subkey & Formatouttab (Subkey) & strvalue & Formatouttab (strvalue) & "[Hidden]"
Else
WScript.Echo Subkey & Formatouttab (Subkey) & strvalue & Formatouttab (strvalue) & "[OK]"
End If

End If
Next
WScript.Echo ""
WScript.Echo "All done."
Wscript.Quit (0)

Function Checksvr (StrName)
Set owmi = GetObject ("winmgmts:" & "{impersonationlevel=impersonate}!\\.\root\cimv2")
Set Cservice = Owmi.execquery ("select * FROM Win32_Service WHERE name= '" & StrName & "")
If (cservice.count <> 0) Then
Checksvr = True
Else
Checksvr = False
End If
End Function

Function Formatouttab (StrName)
StrLen = Len (strName)
Select Case True
Case StrLen < 8
Formatouttab = VbTab & VbTab & VbTab & VbTab & VbTab

Case StrLen < 16
Formatouttab = VbTab & VbTab & VbTab & VbTab

Case StrLen < 24
Formatouttab = VbTab & VbTab & VbTab

Case StrLen < 32
Formatouttab = VbTab & VbTab

Case StrLen < 40
Formatouttab = VbTab

Case Else
Formatouttab = VbTab
End Select
End Function

Using a dictionary, the speed is much faster:

Copy Code code as follows:

Dim Odic, Oreg, OWMI, arrservices
Const HKEY_LOCAL_MACHINE = &H80000002

WScript.Echo "[*] Checking, please wait ..."
WScript.Echo ""

Set Odic = CreateObject ("Scripting.Dictionary")

Set owmi = GetObject ("winmgmts:" & "{impersonationlevel=impersonate}!\\.\root\cimv2")
Set arrservices = Owmi.execquery ("SELECT * FROM Win32_Service")
For each strservice in arrservices
Odic.add Strservice.name, Strservice.name
Next

Set oreg = GetObject ("Winmgmts:{impersonationlevel=impersonate}!\\.\root\default:stdregprov")
strKeyPath = "System\currentcontrolset\services"
Oreg.enumkey HKEY_LOCAL_MACHINE, strKeyPath, Arrsubkeys

For each subkey in Arrsubkeys
Oreg.getstringvalue HKEY_LOCAL_MACHINE, strKeyPath & "\" & subkey, "ObjectName", strvalue
If Not (strvalue = "") Then
If odic.exists (subkey) Then
WScript.Echo Subkey & Formatouttab (Subkey) & strvalue & Formatouttab (strvalue) & "[OK]"
Else
WScript.Echo Subkey & Formatouttab (Subkey) & strvalue & Formatouttab (strvalue) & "[Hidden]"
End If
End If
Next

Odic.removeall

WScript.Echo ""
WScript.Echo "[*] all done."
Wscript.Quit (0)

Function Formatouttab (StrName)
StrLen = Len (strName)
Select Case True
Case StrLen < 8
Formatouttab = VbTab & VbTab & VbTab & VbTab

Case StrLen < 16
Formatouttab = VbTab & VbTab & VbTab

Case StrLen < 24
Formatouttab = VbTab & VbTab

Case StrLen < 32
Formatouttab = VbTab

Case Else
Formatouttab = VbTab
End Select
End Function

From: Enun.net