Hello, I was just wondering how to create a report that will check for a specific startup process that's running and send en email out.

4 Comments   [ + ] Show Comments

Comments

  • I think we were able to get the proper report with this
    SELECT
    S.*,
    MSJ.MACHINE_ID,
    M.NAME as MACHINE_NAME,
    M.USER_FULLNAME as LAST_USER
    FROM
    STARTUPPROGRAM S
    LEFT JOIN
    MACHINE_STARTUPPROGRAM_JT MSJ ON S.ID = MSJ.STARTUPPROGRAM_ID
    left join
    MACHINE M ON MSJ.MACHINE_ID = M.ID
    WHERE
    S.NAME LIKE '%cry%' OR
    S.NAME LIKE '%xirdabfigquf%' OR
    S.NAME LIKE '%7mq46vq7sw%' OR
    S.NAME LIKE '%AdFNyehJMxJUC%' OR
    S.NAME LIKE '%fiksaqviqfux%' OR
    S.NAME LIKE '%hiclynkirsah%' OR
    S.NAME LIKE '%pesyvazqonyr%' OR
    S.NAME LIKE '%qybkyqracinr%' OR
    S.NAME LIKE '%xirdabfigquf%' OR
    S.NAME LIKE '%retvcqjm%' OR
    S.NAME LIKE '%rrvuyuap%'
  • Does this look like it would work properly?
  • You're looking for viruses aren't you?
  • ya, we got a couple PC's infected with the cryptolocker virus. Symantec doesn't have a signature for it yet
Please log in to comment

Answers

0

It doesn't look like the report wizard includes the ability to filter on startup processes, which is unfortunate. This would have to be created using a SQL report. Do you have experience writing SQL? If not, then post the process that you are looking for and I can create a report that will identify machines with that process.

Answered 09/27/2013 by: chucksteel
Red Belt

Please log in to comment
This content is currently hidden from public view.
Reason: Removed by member request
For more information, visit our FAQ's.

Answer this question or Comment on this question for clarity