# Anything related to windows
security stuff, scripts, how tos and other things
# security scripts
# uber basic check for kelogers.py
import psutil
import os
import sys
def find_suspicious_processes():
suspicious_processes = []
for process in psutil.process_iter(['pid', 'name', 'exe', 'cmdline']):
try:
if process.info['exe'] and process.info['cmdline']:
exe_name = os.path.basename(process.info['exe']).lower()
cmdline = ' '.join(process.info['cmdline']).lower()
if 'keylogger' in exe_name or 'keylogger' in cmdline:
suspicious_processes.append(process)
except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
pass
return suspicious_processes
def main():
suspicious_processes = find_suspicious_processes()
if not suspicious_processes:
print("No suspicious processes found.")
else:
print("Suspicious processes found:")
for process in suspicious_processes:
print(f"PID: {process.info['pid']} - Name: {process.info['name']} - Exe: {process.info['exe']} - Cmdline: {' '.join(process.info['cmdline'])}")
if __name__ == '__main__':
main()
import psutil
import datetime
def check\_high\_memory\_usage(threshold=50):
high\_memory\_usage\_processes = \[\]
total\_memory = psutil.virtual\_memory().total
for proc in psutil.process\_iter(\['pid', 'name', 'memory\_info'\]):
try:
memory\_percent = (proc.info\['memory\_info'\].rss / total\_memory) \* 100
if memory\_percent > threshold:
high\_memory\_usage\_processes.append((proc, memory\_percent))
except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
pass
return high\_memory\_usage\_processes
def write\_processes\_to\_file():
now = datetime.datetime.now()
file\_name = f"processes\_{now:%Y-%m-%d\_%H-%M-%S}.txt"
with open(file\_name, 'w') as f:
try:
f.write(f"List of highest CPU usage processes on {now}:\\n\\n")
for proc in sorted(psutil.process\_iter(\['pid', 'name', 'memory\_percent', 'cpu\_percent'\]), key=lambda p: p.info\['cpu\_percent'\], reverse=True):
try:
cpu\_percent = proc.info\['cpu\_percent'\]
if cpu\_percent > 0.0:
f.write(f"PID: {proc.info\['pid'\]} - Name: {proc.info\['name'\]} - CPU%: {cpu\_percent:.2f} - Memory%: {proc.info\['memory\_percent'\]:.2f}\\n")
f.write(f"\\tDisk usage: {psutil.disk\_usage('/').percent:.2f}%\\n")
f.write(f"\\tNetwork usage: {psutil.net\_io\_counters().bytes\_sent/1024:.2f}KB sent/{psutil.net\_io\_counters().bytes\_recv/1024:.2f}KB received\\n")
except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
pass
except:
f.write("An error occurred while writing the file.\\n")
f.write("\\n\\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\\n\\n")
f.write(f"List of highest memory usage processes on {now}:\\n\\n")
for proc, mem\_percent in sorted(check\_high\_memory\_usage(), key=lambda p: p\[1\], reverse=True):
f.write(f"PID: {proc.info\['pid'\]} - Name: {proc.info\['name'\]} - Memory%: {mem\_percent:.2f}\\n")
f.write(f"\\tDisk usage: {psutil.disk\_usage('/').percent:.2f}%\\n")
f.write(f"\\tNetwork usage: {psutil.net\_io\_counters().bytes\_sent/1024:.2f}KB sent/{psutil.net\_io\_counters().bytes\_recv/1024:.2f}KB received\\n")
f.write("\\n\\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\\n\\n")
f.write(f"List of all running processes on {now}:\\n\\n")
for proc in psutil.process\_iter(\['pid', 'name', 'memory\_percent', 'cpu\_percent'\]):
try:
cpu\_percent = proc.info\['cpu\_percent'\]
mem\_percent = proc.info\['memory\_percent'\]
if cpu\_percent > 0.0:
f.write(f"PID: {proc.info\['pid'\]} - Name: {proc.info\['name'\]} - CPU%: {cpu\_percent:.2f} - Memory%: {mem\_percent:.2f}\\n")
f.write(f"\\tDisk usage: {psutil.disk\_usage('/').percent:.2f}%\\n")
f.write(f"\\tNetwork usage: {psutil.net\_io\_counters().bytes\_sent/1024:.2f}KB sent/{psutil.net\_io\_counters().bytes\_recv/1024:.2f}KB received\\n")
except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
pass
def main():
write\_processes\_to\_file()
if \_\_name\_\_ == '\_\_main\_\_':
print("checking")
main()
print("done")
import os
import psutil
import datetime
def check\_high\_memory\_usage(threshold=50):
high\_memory\_usage\_processes = \[\]
total\_memory = psutil.virtual\_memory().total
for proc in psutil.process\_iter(\['pid', 'name', 'memory\_info'\]):
try:
memory\_percent = (proc.info\['memory\_info'\].rss / total\_memory) \* 100
if memory\_percent > threshold:
high\_memory\_usage\_processes.append((proc, memory\_percent))
except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
pass
return high\_memory\_usage\_processes
def write\_processes\_to\_file():
current\_pid = os.getpid()
now = datetime.datetime.now()
file\_name = f"processes\_{now:%Y-%m-%d\_%H-%M-%S}.txt"
with open(file\_name, 'w') as f:
f.write(f"List of all running processes on {now}:\\n\\n")
for proc in psutil.process\_iter(\['pid', 'name', 'memory\_percent', 'cpu\_percent'\]):
try:
if proc.info\['pid'\] != current\_pid: \# Exclude the current script
cpu\_percent = proc.info\['cpu\_percent'\]
mem\_percent = proc.info\['memory\_percent'\]
f.write(f"PID: {proc.info\['pid'\]} - Name: {proc.info\['name'\]} - CPU%: {cpu\_percent:.2f} - Memory%: {mem\_percent:.2f}\\n")
f.write(f"\\tDisk usage: {psutil.disk\_usage('/').percent:.2f}%\\n")
f.write(f"\\tNetwork usage: {psutil.net\_io\_counters().bytes\_sent/1024:.2f}KB sent/{psutil.net\_io\_counters().bytes\_recv/1024:.2f}KB received\\n")
except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
pass
f.write("\\n\\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\\n\\n")
f.write(f"List of highest CPU usage processes on {now}:\\n\\n")
for proc in sorted(psutil.process\_iter(\['pid', 'name', 'memory\_percent', 'cpu\_percent'\]), key=lambda p: p.info\['cpu\_percent'\], reverse=True):
try:
if proc.info\['pid'\] != current\_pid: \# Exclude the current script
cpu\_percent = proc.info\['cpu\_percent'\]
if cpu\_percent > 0.0:
f.write(f"PID: {proc.info\['pid'\]} - Name: {proc.info\['name'\]} - CPU%: {cpu\_percent:.2f} - Memory%: {proc.info\['memory\_percent'\]:.2f}\\n")
f.write(f"\\tDisk usage: {psutil.disk\_usage('/').percent:.2f}%\\n")
f.write(f"\\tNetwork usage: {psutil.net\_io\_counters().bytes\_sent/1024:.2f}KB sent/{psutil.net\_io\_counters().bytes\_recv/1024:.2f}KB received\\n")
except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
pass
f.write("\\n\\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\\n\\n")
f.write(f"List of highest memory usage processes on {now}:\\n\\n")
for proc, mem\_percent in sorted(check\_high\_memory\_usage(), key=lambda p: p\[1\], reverse=True):
f.write(f"PID: {proc.info\['pid'\]} - Name: {proc.info\['name'\]} - Memory%: {mem\_percent:.2f}\\n")
f.write(f"\\tDisk usage: {psutil.disk\_usage('/').percent:.2f}%\\n")
f.write(f"\\tNetwork usage: {psutil.net\_io\_counters().bytes\_sent/1024:.2f}KB sent/{psutil.net\_io\_counters().bytes\_recv/1024:.2f}KB received\\n")
def main():
write\_processes\_to\_file()
if \_\_name\_\_ == '\_\_main\_\_':
main()
import psutil
while True:
pids = input("Type the PID(s) you want to kill, separated by commas, or specify a range with a dash (-): ")
if pids.lower() == "exit" or pids.lower() == "stop":
confirm = input("Are you sure you want to stop the script? (Y/N): ")
if confirm.lower() in \["y", "yes"\]:
break
else:
continue
if '-' in pids:
start, end = pids.split('-')
pids\_list = \[str(pid) for pid in range(int(start), int(end) + 1)\]
yes\_all = input("Do you want to kill all processes in the range without confirmation? (Y/N): ")
if yes\_all.lower() in \['y', 'yes'\]:
response = 'y'
elif yes\_all.lower() in \['n', 'no'\]:
response = ''
else:
response = ''
else:
pids\_list = pids.split(",")
response = ''
for pid in pids\_list:
try:
process = psutil.Process(int(pid))
name = process.name()
mem\_usage = process.memory\_info().rss / 1024 / 1024
cpu\_usage = process.cpu\_percent()
net\_io\_counters = psutil.net\_io\_counters(pernic=False)
network\_usage = net\_io\_counters.bytes\_sent / 1024 / 1024 + net\_io\_counters.bytes\_recv / 1024 / 1024
disk\_usage = process.io\_counters().write\_bytes / 1024 / 1024 + process.io\_counters().read\_bytes / 1024 / 1024
if response.lower() in \['y', 'yes'\]:
process.kill()
print(f"Process with PID {pid} ({name}) terminated.")
elif response.lower() in \['n', 'no'\]:
response = input(f"Y/N are you sure that you want to kill PID {pid} ({name}) current: mem {mem\_usage:.2f}MB, CPU {cpu\_usage:.2f}%, net {network\_usage:.2f}MB, disk {disk\_usage:.2f}MB? ")
if response.lower() in \['y', 'yes', 'yeah', 'yep', 'sure', 'ok', 'okay', 'fine', 'affirmative', 'positive'\]:
process.kill()
print(f"Process with PID {pid} ({name}) terminated.")
else:
print(f"Skipped terminating process with PID {pid} ({name}).")
else:
response = input(f"Y/N are you sure that you want to kill PID {pid} ({name}) current: mem {mem\_usage:.2f}MB, CPU {cpu\_usage:.2f}%, net {network\_usage:.2f}MB, disk {disk\_usage:.2f}MB? ")
if response.lower() in \['y', 'yes', 'yeah', 'yep', 'sure', 'ok', 'okay', 'fine', 'affirmative', 'positive'\]:
process.kill()
print(f"Process with PID {pid} ({name}) terminated.")
else:
print(f"Skipped terminating process with PID {pid} ({name}).")
except (psutil.NoSuchProcess, psutil.AccessDenied, ValueError) as e:
print(f"Error: Cannot kill process with PID {pid}. Reason: {e}")