PC Startup Logger to catch unwanted Snoopers

So you think someone has been using your computer or snooping around while youve been out but you cant prove it.

This simple script, will update a .txt file every time your computer is switched on with the User Account name, day, time and date so if you suspect anything just open the log file to see if you were right.

This script saves the file as C:\Startup-Log.txt but you could easily edit the script to somewhere different with a different name if you prefer.

To make this work Just copy the Script  file to your startup folder in the All Users\Start Menu and the windows script host will do the rest

( C:\Documents and Settings\All Users\Start Menu\Programs\Startup ) this one for all users which includes 'Guest'

'
'Anti Snooper
'Startup Logger
'By Dean Potts
'
Option Explicit

' Various Variables
Dim FSO, objFolder, objtxtfile, objFile
Dim logpath, logfile, logtext
Dim Action : Set Action = CreateObject("Wscript.Shell")
Dim User : User = Action.ExpandEnvironmentStrings("%UserName%")
Dim Days(7), MonthDays(31), Months(12), Hours, Minutes, MyTime, D, DD, MM, YY

' Day Names
Days(1) = " Sunday "
Days(2) = " Monday "
Days(3) = " Tuesday "
Days(4) = " Wednesday "
Days(5) = " Thursday "
Days(6) = " Friday "
Days(7) = " Saturday "

' Month Names
Months(1) = " January "
Months(2) = " February "
Months(3) = " March "
Months(4) = " April "
Months(5) = " May "
Months(6) = " June "
Months(7) = " July "
Months(8) = " August "
Months(9) = " September "
Months(10) = " October "
Months(11) = " November "
Months(12) = " December "

' Fancy Numbering
MonthDays(1) = " 1st "
MonthDays(2) = " 2nd "
MonthDays(3) = " 3rd "
MonthDays(4) = " 4th "
MonthDays(5) = " 5th "
MonthDays(6) = " 6th "
MonthDays(7) = " 7th "
MonthDays(8) = " 8th "
MonthDays(9) = " 9th "
MonthDays(10) = " 10th "
MonthDays(11) = " 11h "
MonthDays(12) = " 12th "
MonthDays(13) = " 13th "
MonthDays(14) = " 14th "
MonthDays(15) = " 15th "
MonthDays(16) = " 16th "
MonthDays(17) = " 17th "
MonthDays(18) = " 18th "
MonthDays(19) = " 19th "
MonthDays(20) = " 20th "
MonthDays(21) = " 21st "
MonthDays(22) = " 22nd "
MonthDays(23) = " 23rd "
MonthDays(24) = " 24th "
MonthDays(25) = " 25th "
MonthDays(26) = " 26th "
MonthDays(27) = " 27th "
MonthDays(28) = " 28th "
MonthDays(29) = " 29th "
MonthDays(30) = " 30th "
MonthDays(31) = " 31st "

' Sort out the Time in 24 hour format

' hours
if hour(now)<10 then
Hours = "0"&hour(now)
else
Hours = hour(now)
end if

' minutes
if minute(now)<10 then
Minutes ="0"&minute(now)
else
Minutes = minute(now)
end if

' Set up the Variables
MyTime = Hours&":"&Minutes
D = MonthDays(day(now))
DD = Days(weekday(now))
MM = Months(Month(now))
YY = year(now)
logpath = "c:\"
logfile = "Startup-log.txt"
logtext = " [Account:" &User& "] " &MyTime & DD & D & MM & YY

' If the folder doesnt exist then create it
Set FSO = CreateObject("Scripting.FileSystemObject")
If FSO.FolderExists(logpath) Then
Set objFolder = FSO.GetFolder(logpath)
Else
Set objFolder = FSO.CreateFolder(logpath)
End If

' if the file doesnt exist then create it
If FSO.FileExists(logpath & logfile) Then
Set objFolder = FSO.GetFolder(logpath)
Else
Set objFile = FSO.CreateTextFile(logpath & logfile)
End If

' free the objects
set objFile = nothing
set objFolder = nothing

Const constappend = 8
Set objtxtfile = FSO.OpenTextFile _
(logpath & logfile, constappend, True)

' Write a New Line in the log
objtxtfile.WriteLine(logtext)
objtxtfile.Close
' Finished
WScript.Quit

Comments

[diy_bloke]

Nice script:
Too bad that it shows Windows in all its shortcomings:

Initially I could not save it in the
C:\ProgramData\Microsoft\Windows\Start Menu\Programs folder coz i (the adminstrator) had no privilege to do so and I had to ask the administrator (me) about that.
Apparently that was caused by the fact that my harddisk was formatted in XP while I now rund W7 (who would come up with something so ridiculous).

Then The script generates an error in line 110 (Set objFolder = FSO.GetFolder(logpath))
'A required privilige is not held'

I really dont want to be a Windows basher but microsoft makes that really hard

[DeanGPotts]

i know exactly what you mean.

everything they do, they somehow feel the need to over complicate it.
when i first learned to make windows programs i looked through the windows SDK for ways to make them look and act better, but something as simple as drawing gradient background needs over 20 lines of code, that isnt guaranteed to work,
i made a translated script file to turn it into a simple one line code that works every time but it took me 2 days to do it because everything i tried didnt work.

i think they over do it on security too with file privilages, its one of the many many upgrades (or downgrades) that should never of been added.

[jensenr30]

WOW! this is great! I copied the program code you posted and I saved it as a .vbs file. I stashed it in my
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
folder. That is the folder (or at least one of them) that runs the programs it contains upon startup for my Windows7 computer (It's an HP)

Thanks for the great program!

One Question For You:
Where can I learn to understand this programming language? is it a language? where can i find more information about this type of programming? I'm doing pretty good with C++ but this language has me baffled.

Thanks!
Rtty

[DeanGPotts]

Hi, thanks for the great feedback, other than c++ are you new to programming?

Try this microsoft scripting reference site as a starter:
http://msdn.microsoft.com/en-us/library/t0aew7h6%28v=VS.85%29.aspx

but you may be better off searching google for vbscript code examples.

i have 5 programming languages that i learned before vbscript so i found it fairly straight forward to pick up, but i think learning by example is the best way for beginners.

heres a few simple examples to get you started.

***** ' Random_numbers1.vbs
Randomize()
x = MsgBox("This Random Number is "& Int((100-1+1)*Rnd+1)&" ")
*****

***** ' Random_numbers2.vbs
option explicit
randomize()
msgbox(cint(100 * Rnd()+1))
' rnd() produces a random decimal number between 0 and 1
' cint() rounds the number
*****

***** ' File_Runner.vbs
'Opens notepad in WinXP
set WSshell = createobject("wscript.shell")
WSshell.run "C:\windows\system32\notepad.exe",1
*****

[jensenr30]

Thanks!

I am not entirely new to programming.
I also know quite a bit of BASIC for the TI-84 plus calculator. That calculator's basic compiler was what first got me into programming! I even made a few games for it!

I have also programmed in C++ for the Arduino microcontroller. (its an electronics hobbyist tool)

I have only written programs for my calculator and the microcontroller. Creating programs for Windows7 (or any computer for that matter) is entirely new to me. I am starting programming computer programs and text based games in C++.

[DeanGPotts]

i use a tool called delphi to make windows programs, i think you would like using it like i do because its very similar to basic,
there are lots of free downloads for it i think if youre interested, very easy to use, just drop things like buttons and other components onto the window and click them to program their behaviour and uses,
quick to get into and alot of people make plenty money too.

[jensenr30]

ok, cool! thanks

[noamparn]

I do the same thing, but with a one-line CMD script:

Echo %COMPUTERNAME%/%USERNAME% Login At %DATE% %TIME% >> "C:\startup-log.txt"

This produces something like:

MyLaptop/Fred Login At Thu 03/31/2011 8:18:26.24

The output is not quite as pretty as yours, but it works just fine for me.

[DeanGPotts]

Very Good, it never even entered my mind to use a bat file.
i like mine as it is invisible and nobody ever see's it running unlike a bat file does but i like your version too for the simplicity.

i recently thought of the code below as a simple reader so maybe you could do an instructable like this one too but a batch file version with a reader, if its something you would be interested in that is.
if you do, let me know and i'll give it a good rating.

@echo off
echo.
echo *************************
echo *** StartUp Log ***
echo *************************
echo.
more < c:\startup-log.txt
echo.
pause

[noamparn]

It runs so quickly, that the user doesn't notice it. If you set the shortcut to tun it minimized, there is even less chance of the user seeing it.
Put an "@" before the command, and the command is not displayed in the window.

[lemonie]

How might these people get past "your" passwords?

L

[DeanGPotts]

There are many ways around passwords but even if someone logs in as guest to get to some of your files then you will atleast know for sure, if and when it happened.

[lemonie]

Guest shouldn't be able to access your files though.
It's interesting, but it only tells you that your security is poor. It doesn't tell you what they've snooped on - can you write a script that does that?

L

[DeanGPotts]

True, Guests cant easily access private files but atleast you can see that someone used the computer without your knowlege or consent.

The origional concept was to indicate that the computer had been used since you were at work or out shopping and so on.

i'll look into possible future extra features for this script.

[lemonie]

The "what" would be interesting, but I don't know the script myself...

L

[DeanGPotts]

i'll look into it, any and all ideas are welcome.

[Lunera]

DeanGPotts; this is eaaly nice and a good example of script, but did you know that windows already does this for you? It's available in your system event logs.

[DeanGPotts]

Did think of that but the origional idea for this script was to display easy to read information, in a user friendly format that can quickly be accessed.

Personally i dont like event viewer because theres too much information to root through before you get what youre looking for.

I think microsoft likes to over engineer software to make things look complicated when they dont need to be.
Thats my thought on that anyway.

[DeanGPotts]

To all who have viewed this instructable already, Ive just updated this instructable to include the path:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

This also covers people who sign in as guest.

If there are any other problems that need mentioning, that you know of, please let me know and i will make another update.

[DeanGPotts]

Update 2, The user account name who logs in is now added to the file