Option Explicit
'Define & set variables
Dim oFSO : Set oFSO = CreateObject("Scripting.FileSystemObject")
Dim oWShell : Set oWShell = CreateObject("WScript.Shell")
Dim objNet : Set objNet = CreateObject("WScript.Network")
Dim Env : Set Env = oWShell.Environment("SYSTEM")
Dim arrFiles : arrFiles = Array()
Dim arrUsers : arrUsers = Array()
Dim objTextLine1
Dim objTextLine2
Dim oTextStream
Dim index
Dim HistoryPath
Dim StartIE
StartSpyScan
CleanupQuit
'Sub to search recursively for all index.dat files
Sub RecurseFilesAndFolders(oRoot, sFileEval)
Dim oSubFolder, oFile, oRegExp
Set oRegExp = New RegExp
oRegExp.IgnoreCase = True
If Not (sFileEval = "") Then
oRegExp.Pattern = sFileEval
For Each oFile in oRoot.Files
If (oRegExp.Test(oFile.Name)) Then
ReDim Preserve arrFiles(UBound(arrFiles) + 1)
arrFiles(UBound(arrFiles)) = oFile.Path
index=1 ' Found at least one index.dat file!
End If
Next
End If
For Each oSubFolder In oRoot.SubFolders
RecurseFilesAndFolders oSubFolder, sFileEval
Next
End Sub
'Sub to cleanup memory & quit script
Sub CleanupQuit()
Set oFSO = Nothing
Set oWShell = Nothing
Set objNet = Nothing
WScript.Quit
End Sub
'Sub to start SpyScan
Sub StartSpyScan()
Dim index_folder, history_folder, oSubFolder, oStartDir, sFileRegExPattern, user
LocateHistoryFolder
index_folder=HistoryPath(0)&"\"&HistoryPath(1)
If Not oFSO.FolderExists(index_folder) Then
MsgBox "No history folder exists. Scan Aborted."
Else
sFileRegExPattern = "\index.dat$"
Set oStartDir = oFSO.GetFolder(index_folder)
For Each oSubFolder In oStartDir.SubFolders
history_folder=oSubFolder.Path&"\"&HistoryPath(3)&"\"&HistoryPath(4)&"\"&"History.IE5"
If oFSO.FolderExists(history_folder) Then
user = split(history_folder,"\")
ReDim Preserve arrUsers(UBound(arrUsers) + 1)
arrUsers(UBound(arrUsers)) = user(2)
Set oStartDir = oFSO.GetFolder(history_folder)
RecurseFilesAndFolders oStartDir, sFileRegExPattern
End If
Next
If IsEmpty(index) Then
CloseIE
MsgBox "No Index.dat files found. Scan Aborted."
Else
CreateSpyHtmFile
End If
End If
End Sub
'Sub to locate all history folders
Sub LocateHistoryFolder()
' Example: C:\Documents and Settings\<username>\Local Settings\History
' HistoryPath(0) = C:
' HistoryPath(1) = Documents and Settings
' HistoryPath(2) = <username>
' HistoryPath(3) = Local Settings
' HistoryPath(4) = History
HistoryPath=split(oWShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History"),"\")
End Sub
'Sub to create HTML file
Sub CreateSpyHtmFile()
Dim ub, count, index_dat, user, spyTmp, sUser
sUser = objNet.UserName
Set oTextStream = oFSO.OpenTextFile("\\server\share\" & sUser & ".html",2,True)
oTextStream.WriteLine "<html><title>"&objNet.UserName&"</title><body>"
oTextStream.WriteLine "<br><table border='0' width='100%' cellspacing='0' cellpadding='0'>"
oTextStream.WriteLine "<tr><td nowrap><b>User:</b></td><td nowrap><b> Date:</b></td><td nowrap><b> Link:</b></td></tr>"
count = 0
ub = UBound(arrFiles)
For Each index_dat In arrFiles
count = count+1
user = split(index_dat,"\")
spyTmp=oFSO.GetSpecialFolder(2)+"\spy.tmp"
oFSO.CopyFile index_dat, spyTmp, True
FindLinks "URL ", RSBinaryToString(ReadBinaryFile(spyTmp)), index_dat
Next
oTextStream.Close
If oFSO.FileExists(spyTmp) Then
oFSO.DeleteFile spyTmp
End If
End Sub
'Sub find links in index.dat
Sub FindLinks(strMatchPattern, strPhrase, file)
Dim oRE, oMatches, oMatch, dt, start, sArray, timeStamp, url
Set oRE = New RegExp
oRE.Pattern = strMatchPattern
oRE.Global = True
oRE.IgnoreCase = False
Set oMatches = oRE.Execute(strPhrase)
For Each oMatch In oMatches
start = Instr(oMatch.FirstIndex + 1,strPhrase,": ")
If start <> 0 Then
sArray = Split(Mid(strPhrase,start+2),"@")
url=Left(sArray(1),InStr(sArray(1),chr(0)))
dt=AsciiToHex(Mid(strPhrase,oMatch.FirstIndex+1+16,8))
timeStamp = cvtDate(dt(7)&dt(6)&dt(5)&dt(4),dt(3)&dt(2)&dt(1)&dt(0))
oTextStream.WriteLine "<tr><td nowrap><font color=green size=2>"&sArray(0)&"</font></td>"+"<td nowrap><font color=red size=2> "&timeStamp&"</font></td>"&"<td nowrap><font size=2> <a href="&url&">"&url&"</a></font></td></tr>"
End If
Next
End Sub
'Function for date conversion
Function cvtDate(hi,lo)
On Error Resume Next
cvtDate = #1/1/1601# + (((cdbl("&H0" & hi) * (2 ^ 32)) + cdbl("&H0" & lo))/600000000 - nBias)/1440
cvtDate = CDate(cvtDate)
If Err.Number <> 0 Then
On Error GoTo 0
cvtDate = #1/1/1601#
Err.Clear
End If
On Error GoTo 0
End Function
'Function to convert ASCII string sData into array of hex numerics
Function AsciiToHex(sData)
Dim i, aTmp()
ReDim aTmp(Len(sData) - 1)
For i = 1 To Len(sData)
aTmp(i - 1) = Hex(Asc(Mid(sData, i)))
If len(aTmp(i - 1))=1 Then aTmp(i - 1)="0"+ aTmp(i - 1)
Next
ASCIItoHex = aTmp
End Function
'Function to convert binary data to a string
Function RSBinaryToString(xBinary)
Dim Binary
'MultiByte data must be converted To VT_UI1 | VT_ARRAY first.
If vartype(xBinary)=8 Then Binary = MultiByteToBinary(xBinary) Else Binary = xBinary
Dim RS, LBinary
Const adLongVarChar = 201
Set RS = CreateObject("ADODB.Recordset")
LBinary = LenB(Binary)
If LBinary>0 Then
RS.Fields.Append "mBinary", adLongVarChar, LBinary
RS.Open
RS.AddNew
RS("mBinary").AppendChunk Binary
RS.Update
RSBinaryToString = RS("mBinary")
Else
RSBinaryToString = ""
End If
End Function
'Function to read binary Index.dat file |
Function ReadBinaryFile(FileName)
Const adTypeBinary = 1
Dim BinaryStream : Set BinaryStream = CreateObject("ADODB.Stream")
BinaryStream.Type = adTypeBinary
BinaryStream.Open
BinaryStream.LoadFromFile FileName
ReadBinaryFile = BinaryStream.Read
BinaryStream.Close
End Function
'Sub to build DeIndex.exe
Sub BuildDeIndexFile(sTempExe)
Dim t, i, deindex
If not oFSO.FileExists(sTempExe) Then
t=split("4D,5A,90,00,03,00,00,00,04,00,00,00,FF,FF,00,00,B8,00,00,
00,00,00,00,00,40,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,B0,00,00,00,0E,1F,BA,0E,00,B4,09,CD,21,B8,01,4C,CD,21,
54,68,69,73,20,70,72,6F,67,72,61,6D,20,63,61,6E,6E,6F,74,20
,62,65,20,72,75,6E,20,69,6E,20,44,4F,53,20,6D,6F,64,65,2E,0
D,0D,0A,24,00,00,00,00,00,00,00,D5,FA,31,DE,91,9B,5F,8D,91,
9B,5F,8D,91,9B,5F,8D,1F,84,4C,8D,97,9B,5F,8D,6D,BB,4D,8D,93
,9B,5F,8D,52,69,63,68,91,9B,5F,8D,00,00,00,00,00,00,00,00,5
0,45,00,00,4C,01,03,00,70,78,71,40,00,00,00,00,00,00,00,00,
E0,00,0F,01,0B,01,05,0C,00,02,00,00,00,04,00,00,00,00,00,00
,00,10,00,00,00,10,00,00,00,20,00,00,00,00,40,00,00,10,00,0
0,00,02,00,00,04,00,00,00,00,00,00,00,04,00,00,00,00,00,00,
00,00,40,00,00,00,04,00,00,00,00,00,00,02,00,00,00,00,00,10
,00,00,10,00,00,00,00,10,00,00,10,00,00,00,00,00,00,10,00,0
0,00,00,00,00,00,00,00,00,00,10,20,00,00,28,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,20,00,00,10,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,2E,74,65,78,74,00,00,00,
48,01,00,00,00,10,00,00,00,02,00,00,00,04,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,20,00,00,60,2E,72,64,61,74,61,00,0
0,84,00,00,00,00,20,00,00,00,02,00,00,00,06,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,40,00,00,40,2E,64,61,74,61,00,00
,00,04,01,00,00,00,30,00,00,00,02,00,00,00,08,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,40,00,00,C0,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,68,00,30,40,00,6A,01,E8,24,00,00,00,6A,04,6A,00,68,00
,30,40,00,E8,0E,00,00,00,6A,00,E8,01,00,00,00,CC,FF,25,08,2
0,40,00,FF,25,00,20,40,00,CC,CC,55,8B,EC,81,C4,7C,FE,FF,FF,
56,57,E8,02,01,00,00,89,45,FC,33,C9,8B,75,FC,AC,3C,00,74,07
,3C,22,75,F7,41,EB,F4,51,D1,E9,D1,E1,58,3B,C1,74,0B,5F,5E,B
8,03,00,00,00,C9,C2,08,00,8B,75,FC,8D,BD,3C,FF,FF,FF,AC,3C,
00,74,09,3C,09,75,02,B0,20,AA,EB,F2,AA,8D,85,3C,FF,FF,FF,8B
,F0,8B,F8,AC,3C,00,75,02,EB,1B,3C,22,75,03,AA,EB,03,AA,EB,E
F,AC,3C,20,75,02,B0,FE,3C,22,75,03,AA,EB,E1,AA,EB,EF,AA,8D,
85,3C,FF,FF,FF,8B,F0,8D,BD,7C,FE,FF,FF,B9,00,00,00,00,AC,3C
,20,74,FB,3B,4D,08,74,15,AC,3C,00,74,1D,3C,20,75,0A,AC,3C,2
0,74,FB,41,3C,00,74,0F,EB,E6,AA,AC,3C,20,74,07,3C,00,74,03,
AA,EB,F4,B0,00,AA,3B,4D,08,73,11,8B,7D,0C,B0,00,AA,B8,02,00
,00,00,5F,5E,C9,C2,08,00,8D,85,7C,FE,FF,FF,8B,F0,8B,7D,0C,A
C,3C,00,74,0D,3C,22,74,F7,3C,FE,75,02,B0,20,AA,EB,EE,AA,8B,
75,0C,AC,3C,00,75,0B,5F,5E,B8,04,00,00,00,C9,C2,08,00,B8,01
,00,00,00,5F,5E,C9,C2,08,00,FF,25,04,20,40,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,56,20,00,00,72,20,00,00,48,20,00,00,00,00,00,00,38,
20,00,00,00,00,00,00,00,00,00,00,64,20,00,00,00,20,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,5
6,20,00,00,72,20,00,00,48,20,00,00,00,00,00,00,80,00,45,78,
69,74,50,72,6F,63,65,73,73,00,C1,01,4D,6F,76,65,46,69,6C,65
,45,78,41,00,6B,65,72,6E,65,6C,33,32,2E,64,6C,6C,00,00,C8,0
0,47,65,74,43,6F,6D,6D,61,6E,64,4C,69,6E,65,41,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0
0,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00",",")
Set deindex=oFSO.CreateTextFile(sTempExe,2)
' Check that deindex.exe was created.
If not oFSO.FileExists(sTempExe) Then
CleanupQuit
End If
For i=0 To UBound(t)
deindex.Write chr(Int("&H"&t(i)))
Next
deindex.Close
End If
End Sub