10

My PC has entered an infinite BSOD loop - but I do have access to a safe-mode command prompt.

I'm trying to get an idea of "what changed" that might have triggered this. e.g. I might have gotten a virus, or an app update went belly up.

I'd like to thus see which files were created/modified in the last few days/week or at least the *.exe, *.dll, *.com, *.bat etc.

I thought I was ok with my Batch-fu but I'm stumped on how to write a quick batch file/command that would list the files for me.

REM This will find the files, but the results are all muddled
REM all EXE files, reverse sort by date, recursively through sub-directories

dir *.exe /O-D /S

What I'd really like is to find all (executable filetypes) that were created/modified in the last 3-7 days.

Can anyone point me in the right direction?

Oliver Salzburg
  • 86,445
  • 63
  • 260
  • 306
Todd McArthur
  • 111
  • 1
  • 1
  • 4
  • Totally separate from the command to run, it sounds like there is a corrupted setting someone, not an additional executable (which is what your script would find). – soandos Aug 21 '11 at 16:25
  • @soandos - quite possible, I'm going to guess that something I installed or updated... is what triggered the setting change. Either way I think a quick batch file for the above scenario would still be a really handy tool. – Todd McArthur Aug 21 '11 at 16:27
  • @Todd, have you tried booting from Last Known Good Configuration? http://windows.microsoft.com/en-US/windows7/Using-Last-Known-Good-Configuration (same concept applies to WinXP/2003) – Robert Kerr Aug 21 '11 at 16:46
  • Why don't you analyze the memory dump from the BSOD? – ZippyV Aug 21 '11 at 16:46
  • @ZippyV - I suppose I could but I have no idea how to do that. – Todd McArthur Aug 21 '11 at 17:14
  • I tried to do `edit c:\Windows\MEMORY.DMP` but it said it was (and I quote) "Out to far Memory" – Todd McArthur Aug 21 '11 at 17:18
  • @Todd McArthur http://www.theexperienceblog.com/technical-articles/troubleshooting-and-analyzing-blue-screens-of-death/ – ZippyV Aug 21 '11 at 18:12
  • -1 "an infinite BSOD loop" <-- as if that's a technical term. "but I do have access to a safe-mode command prompt." not within a BSOD though. So you mean your computer keeps going into a BSOD each time it's started/restarted. i.e. it's not an intermittent problem. You have a stupid way of putting it. – barlop Jun 12 '12 at 11:56

1 Answers1

13

this is a simple, albeit roundabout way, using xcopy. you can look at xcopy /? to see the switches etc.

xcopy \windows\*.exe /L /S /D:12-01-2000 .

This command will output a list of .EXE files and paths in the \windows folder recursively, that were modified on or after 12/1/2000, without actually copying them. NOTE there is a period at then end of the command. Its hard to see with a small font.

Edit 1: I took out the /F from the original command, as it was extraneous.

Edit 2: You can pipe the output to "| more" if you want

fduff
  • 197
  • 2
  • 7
Keltari
  • 71,875
  • 26
  • 179
  • 229
  • 2
    just before I jump on this... which part is the part that says "don't actually copy"? ... is it the `.` e.g. copy to the files original position? – Todd McArthur Aug 21 '11 at 17:05
  • 3
    /L just lists, not copies – Keltari Aug 21 '11 at 17:12
  • @Todd McArthur do xcopy /? man – barlop Aug 21 '11 at 18:01
  • @barlop - yeah I didn't realize the lowercase l was an l vs. a # 1. Also since xcopy is normally for copying - the last thing I wanted to do would be to blast copies of my files across my drive ;-) – Todd McArthur Aug 21 '11 at 18:45
  • 1
    xcopy is a great, yet underutilized tool, in Windows. xxcopy, a 3rd party program is even better. http://www.xxcopy.com/xcpymain.htm – Keltari Aug 21 '11 at 18:48
  • +1! Great use of it, I thought I'd have to parse a `DIR` command, but this is perfect! – Canadian Luke Jun 12 '12 at 16:46
  • 1
    Elegant. Thanks. I piped the results to a file with `> results.txt`. Note, if you run the command in the folder you are `xcopy`ing from then you will need to replace the last `.` with a dummy target or you will get a warning about cyclic copying. – CAD bloke Sep 01 '15 at 23:59