need to have script translated into bigfix webreport analyses

need to have the following scripts translated for webreports analyses

Directory
Export

Directory Export

CSVDE is a Microsoft-developed Management tool for Windows that can export data from Active Directory to a comma-separated value (CSV) format

Use the syntax at right to generate an export file & send to Micro Focus

Command Syntax
c:>
CSVDE -f adexport.csv -r objectClass=computer -u -l cn,objectClass,lastLogonTimestamp,pwdLastSet,userAccountControl,operatingSystem,DN
https://technet.microsoft.com/en-us/library/cc732101(v=ws.11).aspx

SAM Tool Check-In (Inventoried Machines) - SQL
Vendor/Version SQL Query Syntax

SELECT DISTINCT C.DISPLAYNAME, OS.OSTYPE, C.HWLASTSCANDATE, C.SWLASTSCANDATE
FROM Computer C (nolock) LEFT OUTER JOIN Operating_System OS (nolock) ON C.Computer_Idn = OS.Computer_Idn
WHERE (C.DISPLAYNAME IS NOT NULL)
ORDER BY C.DISPLAYNAME

SELECT C.Name, C.[OS Name], MAX(I.[Collection Time]) AS LastInventory, null AS Placeholder
FROM Inv_Inventory_Results I RIGHT JOIN vComputer C ON I.[_ResourceGuid] = C.Guid
WHERE (((C.IsManaged)=1))
GROUP BY C.Name, C.[OS Name]
ORDER BY C.Name, LastInventory

2007

SELECT DISTINCT S.Netbios_Name0, S.Operating_System_Name_and0, HW.LastHWScan, SW.LastScanDate
FROM v_R_System S LEFT JOIN v_GS_LastSoftwareScan SW on S.ResourceID = SW.ResourceID
LEFT JOIN v_GS_WORKSTATION_STATUS HW on S.ResourceID = HW.ResourceID
ORDER BY S.Netbios_Name0

2012R1

SELECT DISTINCT S.NetbiosName, S.OperatingSystemNameandVersion, HW.LastHardwareScan, SW.LastScanDate
FROM SMS_R_System S LEFT JOIN SMS_G_System_WORKSTATION_STATUS SW on SW.ResourceID = S.ResourceId
LEFT JOIN SMS_G_System_LastSoftwareScan HW on HW.ResourceID = S.ResourceId
ORDER BY S.NetbiosName

2012R2

SELECT DISTINCT S.Netbios_Name0, S.Operating_System_Name_and0, HW.LastHWScan, SW.LastScanDate, SW.ResourceID
FROM vSMS_R_System S LEFT JOIN v_GS_WORKSTATION_STATUS HW ON HW.ResourceID = S.ItemKey
LEFT JOIN v_GS_LastSoftwareScan SW ON SW.ResourceID = HW.ResourceID
ORDER BY S.Netbios_Name0
SAM Tool Check-In

Add/Remove Program Entries (ARP Scan) - SQL
Vendor/Version
SQL Query Syntax
SELECT A0.DISPLAYNAME, A1.SUITENAME, A1.VERSION, A1.INSTALLDATE
FROM Computer A0 (nolock) LEFT OUTER JOIN AppSoftwareSuites A1 (nolock) ON A0.Computer_Idn = A1.Computer_Idn LEFT OUTER JOIN Operating_System A2 (nolock) ON A0.Computer_Idn = A2.Computer_Idn
WHERE (A0.DEVICENAME IS NOT NULL AND (A1.SUITENAME LIKE ‘%Attachmate%’ OR A1.SUITENAME LIKE ‘%DATABridge%’ OR A1.SUITENAME LIKE ‘%Extra%’ A1.SUITENAME LIKE ‘%Infoconnect%’ OR A1.SUITENAME LIKE ‘%Kea%’ OR A1.SUITENAME LIKE ‘%Micro%focus%’ OR A1.SUITENAME LIKE ‘%Netmanage%’ OR A1.SUITENAME LIKE ‘%Onweb%’ OR A1.SUITENAME LIKE ‘%Reflection%’ OR A1.SUITENAME LIKE ‘%Rumba%’ OR A1.SUITENAME LIKE ‘%Verastream%’ OR A1.SUITENAME LIKE ‘%ViewNow%’ OR A1.SUITENAME LIKE ‘%WallData%’ OR A1.SUITENAME LIKE ‘%Web%to%Host%’ OR A1.SUITENAME LIKE ‘%WRQ%’ ))
SELECT C.Name, P.DisplayName, P.DisplayVersion, I.InstallDate
FROM vComputer C LEFT JOIN Inv_AddRemoveProgram P ON C.GUID = P._ResourceGUID LEFT JOIN Inv_InstalledSoftware I ON P._ResourceGuid = I._ResourceGuid AND P._SoftwareComponentGuid = I._SoftwareComponentGuid
WHERE (P.DisplayName LIKE ‘%Attachmate%’) OR (P.DisplayName LIKE ‘%DATABridge%’) OR (P.DisplayName LIKE ‘%Extra%’) OR (P.DisplayName LIKE ‘%Infoconnect%’) OR (P.DisplayName LIKE ‘%Kea%’) OR (P.DisplayName LIKE ‘%Micro%focus%’) OR (P.DisplayName LIKE ‘%Netmanage’) OR (P.DisplayName LIKE ‘%Onweb%’) OR (P.DisplayName LIKE ‘%Reflection%’) OR (P.DisplayName LIKE ‘%Rumba%’) OR (P.DisplayName LIKE ‘%Verastream%’) OR (P.DisplayName LIKE ‘%ViewNow%’) OR (P.DisplayName LIKE ‘%WallData%’) OR (P.DisplayName LIKE ‘%Web%to%Host%’) OR (P.DisplayName LIKE ‘%WRQ%’)
2007
SELECT S.Netbios_Name0, P.DisplayName0, P.Version0, P.InstallDate0
FROM v_R_System S LEFT JOIN v_GS_ADD_REMOVE_PROGRAMS P ON P.ResourceID = S.ResourceID
WHERE (P.DisplayName0 LIKE ‘%Attachmate%’) OR (P.DisplayName0 LIKE ‘%DATABridge%’) OR (P.DisplayName0 LIKE ‘%Extra%’) OR (P.DisplayName0 LIKE ‘%Infoconnect%’) OR (P.DisplayName0 LIKE ‘%Kea%’) OR (P.DisplayName0 LIKE ‘%Micro%focus%’) OR (P.DisplayName0 LIKE ‘%Netmanage’) OR (P.DisplayName0 LIKE ‘%Onweb%’) OR (P.DisplayName0 LIKE ‘%Reflection%’) OR (P.DisplayName0 LIKE ‘%Rumba%’) OR (P.DisplayName0 LIKE ‘%Verastream%’) OR (P.DisplayName0 LIKE ‘%ViewNow%’) OR (P.DisplayName0 LIKE ‘%WallData%’) OR (P.DisplayName0 LIKE ‘%Web%to%Host%’) OR (P.DisplayName0 LIKE ‘%WRQ%’)
2012R1
SELECT S.NetbiosName, P.DisplayName, P.Version, P.InstallDate
FROM SMS_R_System S LEFT JOIN SMS_G_System_ADD_REMOVE_PROGRAMS P on P.ResourceID = S.ResourceId
WHERE (P.DisplayName LIKE ‘%Attachmate%’) OR (P.DisplayName LIKE ‘%DATABridge%’) OR (P.DisplayName LIKE ‘%Extra%’) OR (P.DisplayName LIKE ‘%Infoconnect%’) OR (P.DisplayName LIKE ‘%Kea%’) OR (P.DisplayName LIKE ‘%Micro%focus%’) OR (P.DisplayName LIKE ‘%Netmanage’) OR (P.DisplayName LIKE ‘%Onweb%’) OR (P.DisplayName LIKE ‘%Reflection%’) OR (P.DisplayName LIKE ‘%Rumba%’) OR (P.DisplayName LIKE ‘%Verastream%’) OR (P.DisplayName LIKE ‘%ViewNow%’) OR (P.DisplayName LIKE ‘%WallData%’) OR (P.DisplayName LIKE ‘%Web%to%Host%’) OR (P.DisplayName LIKE ‘%WRQ%’)
2012R2
SELECT S.Netbios_Name0, P.DisplayName0, P.Version0, P.InstallDate0
FROM vSMS_R_System S LEFT JOIN v_ADD_REMOVE_PROGRAMS P on P.ResourceID = S.ItemKey
WHERE (P.DisplayName0 LIKE ‘%Attachmate%’) OR (P.DisplayName0 LIKE ‘%DATABridge%’) OR (P.DisplayName0 LIKE ‘%Extra%’) OR (P.DisplayName0 LIKE ‘%Infoconnect’) OR (P.DisplayName0 LIKE ‘%Kea%’) OR (P.DisplayName0 LIKE ‘%Micro%focus%’) OR (P.DisplayName0 LIKE ‘%Netmanage’) OR (P.DisplayName0 LIKE ‘%Onweb%’) OR (P.DisplayName0 LIKE ‘%Reflection%’) OR (P.DisplayName0 LIKE ‘%Rumba%’) OR (P.DisplayName0 LIKE ‘%Verastream%’) OR (P.DisplayName0 LIKE ‘%ViewNow%’) OR (P.DisplayName0 LIKE ‘%WallData%’) OR (P.DisplayName0 LIKE ‘%Web%to%Host%’) OR (P.DisplayName0 LIKE ‘%WRQ%’)
Add/Remove
Program

Known EXE Scan – SQL (Altiris & LANDesk)
Vendor/Version
SQL Query Syntax
SELECT C.DISPLAYNAME, F.FILENAME, null, F.VERSION, F.FILESIZE, C.SWLASTSCANDATE, F.PATH,
FROM Computer C (nolock) LEFT JOIN AppSoftware A1 (nolock) ON C.Computer_Idn = F.Computer_Idn
WHERE C.DEVICENAME IS NOT NULL AND ( F.FileName LIKE ‘%.chf’ OR F.FileName LIKE ‘%.ser’ OR F.FileName LIKE ‘%CoreServices.exe%’ OR F.FileName LIKE ‘%MCSServiceAgent.exe%’ OR F.FileName LIKE ‘%PresentationDesigner.exe%’ OR F.FileName LIKE ‘%SNDS.exe%’ OR F.FileName LIKE ‘%VigilEntAgent.exe%’ OR F.FileName LIKE ‘%vsoc.exe%’ OR F.FileName LIKE ‘%WINSTALA.exe%’ OR F.FileName LIKE ‘%WINSTLU32.exe%’ OR F.FileName LIKE ‘%WINSTU32.exe%’ OR F.FileName LIKE ‘ACCMGR32.EXE’ OR F.FileName LIKE ‘ACPMGR.EXE’ OR F.FileName LIKE ‘ACT6530X.OCX’ OR F.FileName LIKE ‘AS400FTX.EXE’ OR F.FileName LIKE ‘ATERM.OCX’ OR F.FileName LIKE ‘ATM_RM_R.exe’ OR F.FileName LIKE ‘ATMFRAME.EXE’ OR F.FileName LIKE ‘bdes.dll’ OR F.FileName LIKE ‘C4CONF32.EXE’ OR F.FileName LIKE ‘CGI2NOVA.EXE’ OR F.FileName LIKE ‘DBEnterprise.exe’ OR F.FileName LIKE ‘DBUtility.exe’ OR F.FileName LIKE ‘DemoHost.Exe’ OR F.FileName LIKE ‘Discover.exe’ OR F.FileName LIKE ‘EASYVIEW.EXE’ OR F.FileName LIKE ‘EHNCFG32.EXE’ OR F.FileName LIKE ‘EHNTES32.EXE’ OR F.FileName LIKE ‘EMU.EXE’ OR F.FileName LIKE ‘EXTRA!.EXE’ OR F.FileName LIKE ‘EXTRA.EXE’ OR F.FileName LIKE ‘fsshclient.exe’ OR F.FileName LIKE ‘fsshd2.exe’ OR F.FileName LIKE ‘GRAPHX32.EXE’ OR F.FileName LIKE ‘Idrive.sys’ OR F.FileName LIKE ‘IMPORT.exe’ OR F.FileName LIKE ‘KEAHP.EXE’ OR F.FileName LIKE ‘KEAVT.EXE’ OR F.FileName LIKE ‘mnfserv.exe’ OR F.FileName LIKE ‘mwm.exe’ OR F.FileName LIKE ‘nfsgwapp.exe’ OR F.FileName LIKE ‘nmAppc.dll’ OR F.FileName LIKE ‘nmssh.exe’ OR F.FileName LIKE ‘nmsshfwd.exe’ OR F.FileName LIKE ‘NOF.exe’ OR F.FileName LIKE ‘NOVA.EXE’ OR F.FileName LIKE ‘NOVATRC.EXE’ OR F.FileName LIKE ‘NWLatSrv.exe’ OR F.FileName LIKE ‘PTR32.EXE’ OR F.FileName LIKE ‘QAPDEV32.EXE’ OR F.FileName LIKE ‘R.exe’ OR F.FileName LIKE ‘r1.exe’ OR F.FileName LIKE ‘r1win.exe’ OR F.FileName LIKE ‘r2.exe’ OR F.FileName LIKE ‘r2macsngl41.sea’ OR F.FileName LIKE ‘r2win.exe’ OR F.FileName LIKE ‘r3win.exe’ OR F.FileName LIKE ‘r4.exe’ OR F.FileName LIKE ‘r4macsngl42.sea’ OR F.FileName LIKE ‘r4win.exe’ OR F.FileName LIKE ‘r7.exe’ OR F.FileName LIKE ‘r8.exe’ OR F.FileName LIKE ‘r8win.exe’ OR F.FileName LIKE ‘rdeploy.exe’ OR F.FileName LIKE ‘rftp.exe’ OR F.FileName LIKE ‘rftpc.exe’ OR F.FileName LIKE ‘rlat.dll’ OR F.FileName LIKE ‘rnnfsadm.exe’ OR F.FileName LIKE ‘rnnfserv.exe’ OR F.FileName LIKE ‘rsshd.exe’ OR F.FileName LIKE ‘RumbaPage.exe’ OR F.FileName LIKE ‘RumbaTrc.exe’ OR F.FileName LIKE ‘Rumbavt.Exe’ OR F.FileName LIKE ‘rumbawsf’ OR F.FileName LIKE ‘Rumbawsf.Exe’ OR F.FileName LIKE ‘rvd.EXE’ OR F.FileName LIKE ‘Rx.exe’ OR F.FileName LIKE ‘Rx2008.jar’ OR F.FileName LIKE ‘rxmgr.exe’ OR F.FileName LIKE ‘SMTBF.DLL’ OR F.FileName LIKE ‘SMTBF32.DLL’ OR F.FileName LIKE ‘SNPI.EXE’ OR F.FileName LIKE ‘SNWINPA.EXE’ OR F.FileName LIKE ‘TCP2PDIS.EXE’ OR F.FileName LIKE ‘UpdRgfs.EXE’ OR F.FileName LIKE ‘wddsppag.exe’ OR F.FileName LIKE ‘wdehn.exe’ OR F.FileName LIKE ‘Wdmicomm.exe’ OR F.FileName LIKE ‘WDRPCMGR.EXE’ OR F.FileName LIKE ‘WICONSOLE.EXE’ OR F.FileName LIKE ‘WIMASvc.exe’ OR F.FileName LIKE ‘WINFTP32.DLL’ OR F.FileName LIKE ‘WINSTALL.exe’ OR F.FileName LIKE ‘WRQNFS.EXE’ OR F.FileName LIKE ‘WRQTCP.EXE’ OR F.FileName LIKE ‘X.EXE’ OR F.FileName LIKE ‘xcp.exe’ OR F.FileName LIKE ‘xfwXMI.dll’ OR F.FileName LIKE ‘xstartup.exe’ OR F.FileName LIKE 'XTALK30.EXE’
v7+
SELECT C.Name, F.* FROM vComputer C LEFT JOIN Inv_Installed_File_Details F on C.guid = F._resourceguid
WHERE F.Name LIKE ‘%.chf’ OR F.Name LIKE ‘%.ser’ OR F.Name LIKE ‘%CoreServices.exe%’ OR F.Name LIKE ‘%MCSServiceAgent.exe%’ OR F.Name LIKE ‘%PresentationDesigner.exe%’ OR F.Name LIKE ‘%SNDS.exe%’ OR F.Name LIKE ‘%VigilEntAgent.exe%’ OR F.Name LIKE ‘%vsoc.exe%’ OR F.Name LIKE ‘%WINSTALA.exe%’ OR F.Name LIKE ‘%WINSTLU32.exe%’ OR F.Name LIKE ‘%WINSTU32.exe%’ OR F.Name LIKE ‘ACCMGR32.EXE’ OR F.Name LIKE ‘ACPMGR.EXE’ OR F.Name LIKE ‘ACT6530X.OCX’ OR F.Name LIKE ‘AS400FTX.EXE’ OR F.Name LIKE ‘ATERM.OCX’ OR F.Name LIKE ‘ATM_RM_R.exe’ OR F.Name LIKE ‘ATMFRAME.EXE’ OR F.Name LIKE ‘bdes.dll’ OR F.Name LIKE ‘C4CONF32.EXE’ OR F.Name LIKE ‘CGI2NOVA.EXE’ OR F.Name LIKE ‘DBEnterprise.exe’ OR F.Name LIKE ‘DBUtility.exe’ OR F.Name LIKE ‘DemoHost.Exe’ OR F.Name LIKE ‘Discover.exe’ OR F.Name LIKE ‘EASYVIEW.EXE’ OR F.Name LIKE ‘EHNCFG32.EXE’ OR F.Name LIKE ‘EHNTES32.EXE’ OR F.Name LIKE ‘EMU.EXE’ OR F.Name LIKE ‘EXTRA!.EXE’ OR F.Name LIKE ‘EXTRA.EXE’ OR F.Name LIKE ‘fsshclient.exe’ OR F.Name LIKE ‘fsshd2.exe’ OR F.Name LIKE ‘GRAPHX32.EXE’ OR F.Name LIKE ‘Idrive.sys’ OR F.Name LIKE ‘IMPORT.exe’ OR F.Name LIKE ‘KEAHP.EXE’ OR F.Name LIKE ‘KEAVT.EXE’ OR F.Name LIKE ‘mnfserv.exe’ OR F.Name LIKE ‘mwm.exe’ OR F.Name LIKE ‘nfsgwapp.exe’ OR F.Name LIKE ‘nmAppc.dll’ OR F.Name LIKE ‘nmssh.exe’ OR F.Name LIKE ‘nmsshfwd.exe’ OR F.Name LIKE ‘NOF.exe’ OR F.Name LIKE ‘NOVA.EXE’ OR F.Name LIKE ‘NOVATRC.EXE’ OR F.Name LIKE ‘NWLatSrv.exe’ OR F.Name LIKE ‘PTR32.EXE’ OR F.Name LIKE ‘QAPDEV32.EXE’ OR F.Name LIKE ‘R.exe’ OR F.Name LIKE ‘r1.exe’ OR F.Name LIKE ‘r1win.exe’ OR F.Name LIKE ‘r2.exe’ OR F.Name LIKE ‘r2macsngl41.sea’ OR F.Name LIKE ‘r2win.exe’ OR F.Name LIKE ‘r3win.exe’ OR F.Name LIKE ‘r4.exe’ OR F.Name LIKE ‘r4macsngl42.sea’ OR F.Name LIKE ‘r4win.exe’ OR F.Name LIKE ‘r7.exe’ OR F.Name LIKE ‘r8.exe’ OR F.Name LIKE ‘r8win.exe’ OR F.Name LIKE ‘rdeploy.exe’ OR F.Name LIKE ‘rftp.exe’ OR F.Name LIKE ‘rftpc.exe’ OR F.Name LIKE ‘rlat.dll’ OR F.Name LIKE ‘rnnfsadm.exe’ OR F.Name LIKE ‘rnnfserv.exe’ OR F.Name LIKE ‘rsshd.exe’ OR F.Name LIKE ‘RumbaPage.exe’ OR F.Name LIKE ‘RumbaTrc.exe’ OR F.Name LIKE ‘Rumbavt.Exe’ OR F.Name LIKE ‘rumbawsf’ OR F.Name LIKE ‘Rumbawsf.Exe’ OR F.Name LIKE ‘rvd.EXE’ OR F.Name LIKE ‘Rx.exe’ OR F.Name LIKE ‘Rx2008.jar’ OR F.Name LIKE ‘rxmgr.exe’ OR F.Name LIKE ‘SMTBF.DLL’ OR F.Name LIKE ‘SMTBF32.DLL’ OR F.Name LIKE ‘SNPI.EXE’ OR F.Name LIKE ‘SNWINPA.EXE’ OR F.Name LIKE ‘TCP2PDIS.EXE’ OR F.Name LIKE ‘UpdRgfs.EXE’ OR F.Name LIKE ‘wddsppag.exe’ OR F.Name LIKE ‘wdehn.exe’ OR F.Name LIKE ‘Wdmicomm.exe’ OR F.Name LIKE ‘WDRPCMGR.EXE’ OR F.Name LIKE ‘WICONSOLE.EXE’ OR F.Name LIKE ‘WIMASvc.exe’ OR F.Name LIKE ‘WINFTP32.DLL’ OR F.Name LIKE ‘WINSTALL.exe’ OR F.Name LIKE ‘WRQNFS.EXE’ OR F.Name LIKE ‘WRQTCP.EXE’ OR F.Name LIKE ‘X.EXE’ OR F.Name LIKE ‘xcp.exe’ OR F.Name LIKE ‘xfwXMI.dll’ OR F.Name LIKE ‘xstartup.exe’ OR F.Name LIKE ‘XTALK30.EXE’
<v7
SELECT C.Name, F.* FROM vComputer C LEFT JOIN Inv_AeX_SW_Audit_software F on C.guid = F._resourceguid
WHERE F.[File Name] LIKE ‘%.chf’ OR F.[File Name] LIKE ‘%.ser’ OR F.[File Name] LIKE ‘%CoreServices.exe%’ OR F.[File Name] LIKE ‘%MCSServiceAgent.exe%’ OR F.[File Name] LIKE ‘%PresentationDesigner.exe%’ OR F.[File Name] LIKE ‘%SNDS.exe%’ OR F.[File Name] LIKE ‘%VigilEntAgent.exe%’ OR F.[File Name] LIKE ‘%vsoc.exe%’ OR F.[File Name] LIKE ‘%WINSTALA.exe%’ OR F.[File Name] LIKE ‘%WINSTLU32.exe%’ OR F.[File Name] LIKE ‘%WINSTU32.exe%’ OR F.[File Name] LIKE ‘ACCMGR32.EXE’ OR F.[File Name] LIKE ‘ACPMGR.EXE’ OR F.[File Name] LIKE ‘ACT6530X.OCX’ OR F.[File Name] LIKE ‘AS400FTX.EXE’ OR F.[File Name] LIKE ‘ATERM.OCX’ OR F.[File Name] LIKE ‘ATM_RM_R.exe’ OR F.[File Name] LIKE ‘ATMFRAME.EXE’ OR F.[File Name] LIKE ‘bdes.dll’ OR F.[File Name] LIKE ‘C4CONF32.EXE’ OR F.[File Name] LIKE ‘CGI2NOVA.EXE’ OR F.[File Name] LIKE ‘DBEnterprise.exe’ OR F.[File Name] LIKE ‘DBUtility.exe’ OR F.[File Name] LIKE ‘DemoHost.Exe’ OR F.[File Name] LIKE ‘Discover.exe’ OR F.[File Name] LIKE ‘EASYVIEW.EXE’ OR F.[File Name] LIKE ‘EHNCFG32.EXE’ OR F.[File Name] LIKE ‘EHNTES32.EXE’ OR F.[File Name] LIKE ‘EMU.EXE’ OR F.[File Name] LIKE ‘EXTRA!.EXE’ OR F.[File Name] LIKE ‘EXTRA.EXE’ OR F.[File Name] LIKE ‘fsshclient.exe’ OR F.[File Name] LIKE ‘fsshd2.exe’ OR F.[File Name] LIKE ‘GRAPHX32.EXE’ OR F.[File Name] LIKE ‘Idrive.sys’ OR F.[File Name] LIKE ‘IMPORT.exe’ OR F.[File Name] LIKE ‘KEAHP.EXE’ OR F.[File Name] LIKE ‘KEAVT.EXE’ OR F.[File Name] LIKE ‘mnfserv.exe’ OR F.[File Name] LIKE ‘mwm.exe’ OR F.[File Name] LIKE ‘nfsgwapp.exe’ OR F.[File Name] LIKE ‘nmAppc.dll’ OR F.[File Name] LIKE ‘nmssh.exe’ OR F.[File Name] LIKE ‘nmsshfwd.exe’ OR F.[File Name] LIKE ‘NOF.exe’ OR F.[File Name] LIKE ‘NOVA.EXE’ OR F.[File Name] LIKE ‘NOVATRC.EXE’ OR F.[File Name] LIKE ‘NWLatSrv.exe’ OR F.[File Name] LIKE ‘PTR32.EXE’ OR F.[File Name] LIKE ‘QAPDEV32.EXE’ OR F.[File Name] LIKE ‘R.exe’ OR F.[File Name] LIKE ‘r1.exe’ OR F.[File Name] LIKE ‘r1win.exe’ OR F.[File Name] LIKE ‘r2.exe’ OR F.[File Name] LIKE ‘r2macsngl41.sea’ OR F.[File Name] LIKE ‘r2win.exe’ OR F.[File Name] LIKE ‘r3win.exe’ OR F.[File Name] LIKE ‘r4.exe’ OR F.[File Name] LIKE ‘r4macsngl42.sea’ OR F.[File Name] LIKE ‘r4win.exe’ OR F.[File Name] LIKE ‘r7.exe’ OR F.[File Name] LIKE ‘r8.exe’ OR F.[File Name] LIKE ‘r8win.exe’ OR F.[File Name] LIKE ‘rdeploy.exe’ OR F.[File Name] LIKE ‘rftp.exe’ OR F.[File Name] LIKE ‘rftpc.exe’ OR F.[File Name] LIKE ‘rlat.dll’ OR F.[File Name] LIKE ‘rnnfsadm.exe’ OR F.[File Name] LIKE ‘rnnfserv.exe’ OR F.[File Name] LIKE ‘rsshd.exe’ OR F.[File Name] LIKE ‘RumbaPage.exe’ OR F.[File Name] LIKE ‘RumbaTrc.exe’ OR F.[File Name] LIKE ‘Rumbavt.Exe’ OR F.[File Name] LIKE ‘rumbawsf’ OR F.[File Name] LIKE ‘Rumbawsf.Exe’ OR F.[File Name] LIKE ‘rvd.EXE’ OR F.[File Name] LIKE ‘Rx.exe’ OR F.[File Name] LIKE ‘Rx2008.jar’ OR F.[File Name] LIKE ‘rxmgr.exe’ OR F.[File Name] LIKE ‘SMTBF.DLL’ OR F.[File Name] LIKE ‘SMTBF32.DLL’ OR F.[File Name] LIKE ‘SNPI.EXE’ OR F.[File Name] LIKE ‘SNWINPA.EXE’ OR F.[File Name] LIKE ‘TCP2PDIS.EXE’ OR F.[File Name] LIKE ‘UpdRgfs.EXE’ OR F.[File Name] LIKE ‘wddsppag.exe’ OR F.[File Name] LIKE ‘wdehn.exe’ OR F.[File Name] LIKE ‘Wdmicomm.exe’ OR F.[File Name] LIKE ‘WDRPCMGR.EXE’ OR F.[File Name] LIKE ‘WICONSOLE.EXE’ OR F.[File Name] LIKE ‘WIMASvc.exe’ OR F.[File Name] LIKE ‘WINFTP32.DLL’ OR F.[File Name] LIKE ‘WINSTALL.exe’ OR F.[File Name] LIKE ‘WRQNFS.EXE’ OR F.[File Name] LIKE ‘WRQTCP.EXE’ OR F.[File Name] LIKE ‘X.EXE’ OR F.[File Name] LIKE ‘xcp.exe’ OR F.[File Name] LIKE ‘xfwXMI.dll’ OR F.[File Name] LIKE ‘xstartup.exe’ OR F.[File Name] LIKE 'XTALK30.EXE’
EXE Scan

Known EXE Scan – SQL (SCCM)
Vendor/Version
SQL Query Syntax
2007
SELECT S.Netbios_Name0, F.FileName, F.FileDescription, F.FileVersion, F.FileSize, F.FileModifiedDate, F.FilePath FROM v_R_System S LEFT JOIN v_GS_SoftwareFile F ON S.ResourceID = F.ResourceID
WHERE F.FileName LIKE ‘%.chf’ OR F.FileName LIKE ‘%.ser’ OR F.FileName LIKE ‘%CoreServices.exe%’ OR F.FileName LIKE ‘%MCSServiceAgent.exe%’ OR F.FileName LIKE ‘%PresentationDesigner.exe%’ OR F.FileName LIKE ‘%SNDS.exe%’ OR F.FileName LIKE ‘%VigilEntAgent.exe%’ OR F.FileName LIKE ‘%vsoc.exe%’ OR F.FileName LIKE ‘%WINSTALA.exe%’ OR F.FileName LIKE ‘%WINSTLU32.exe%’ OR F.FileName LIKE ‘%WINSTU32.exe%’ OR F.FileName LIKE ‘ACCMGR32.EXE’ OR F.FileName LIKE ‘ACPMGR.EXE’ OR F.FileName LIKE ‘ACT6530X.OCX’ OR F.FileName LIKE ‘AS400FTX.EXE’ OR F.FileName LIKE ‘ATERM.OCX’ OR F.FileName LIKE ‘ATM_RM_R.exe’ OR F.FileName LIKE ‘ATMFRAME.EXE’ OR F.FileName LIKE ‘bdes.dll’ OR F.FileName LIKE ‘C4CONF32.EXE’ OR F.FileName LIKE ‘CGI2NOVA.EXE’ OR F.FileName LIKE ‘DBEnterprise.exe’ OR F.FileName LIKE ‘DBUtility.exe’ OR F.FileName LIKE ‘DemoHost.Exe’ OR F.FileName LIKE ‘Discover.exe’ OR F.FileName LIKE ‘EASYVIEW.EXE’ OR F.FileName LIKE ‘EHNCFG32.EXE’ OR F.FileName LIKE ‘EHNTES32.EXE’ OR F.FileName LIKE ‘EMU.EXE’ OR F.FileName LIKE ‘EXTRA!.EXE’ OR F.FileName LIKE ‘EXTRA.EXE’ OR F.FileName LIKE ‘fsshclient.exe’ OR F.FileName LIKE ‘fsshd2.exe’ OR F.FileName LIKE ‘GRAPHX32.EXE’ OR F.FileName LIKE ‘Idrive.sys’ OR F.FileName LIKE ‘IMPORT.exe’ OR F.FileName LIKE ‘KEAHP.EXE’ OR F.FileName LIKE ‘KEAVT.EXE’ OR F.FileName LIKE ‘mnfserv.exe’ OR F.FileName LIKE ‘mwm.exe’ OR F.FileName LIKE ‘nfsgwapp.exe’ OR F.FileName LIKE ‘nmAppc.dll’ OR F.FileName LIKE ‘nmssh.exe’ OR F.FileName LIKE ‘nmsshfwd.exe’ OR F.FileName LIKE ‘NOF.exe’ OR F.FileName LIKE ‘NOVA.EXE’ OR F.FileName LIKE ‘NOVATRC.EXE’ OR F.FileName LIKE ‘NWLatSrv.exe’ OR F.FileName LIKE ‘PTR32.EXE’ OR F.FileName LIKE ‘QAPDEV32.EXE’ OR F.FileName LIKE ‘R.exe’ OR F.FileName LIKE ‘r1.exe’ OR F.FileName LIKE ‘r1win.exe’ OR F.FileName LIKE ‘r2.exe’ OR F.FileName LIKE ‘r2macsngl41.sea’ OR F.FileName LIKE ‘r2win.exe’ OR F.FileName LIKE ‘r3win.exe’ OR F.FileName LIKE ‘r4.exe’ OR F.FileName LIKE ‘r4macsngl42.sea’ OR F.FileName LIKE ‘r4win.exe’ OR F.FileName LIKE ‘r7.exe’ OR F.FileName LIKE ‘r8.exe’ OR F.FileName LIKE ‘r8win.exe’ OR F.FileName LIKE ‘rdeploy.exe’ OR F.FileName LIKE ‘rftp.exe’ OR F.FileName LIKE ‘rftpc.exe’ OR F.FileName LIKE ‘rlat.dll’ OR F.FileName LIKE ‘rnnfsadm.exe’ OR F.FileName LIKE ‘rnnfserv.exe’ OR F.FileName LIKE ‘rsshd.exe’ OR F.FileName LIKE ‘RumbaPage.exe’ OR F.FileName LIKE ‘RumbaTrc.exe’ OR F.FileName LIKE ‘Rumbavt.Exe’ OR F.FileName LIKE ‘rumbawsf’ OR F.FileName LIKE ‘Rumbawsf.Exe’ OR F.FileName LIKE ‘rvd.EXE’ OR F.FileName LIKE ‘Rx.exe’ OR F.FileName LIKE ‘Rx2008.jar’ OR F.FileName LIKE ‘rxmgr.exe’ OR F.FileName LIKE ‘SMTBF.DLL’ OR F.FileName LIKE ‘SMTBF32.DLL’ OR F.FileName LIKE ‘SNPI.EXE’ OR F.FileName LIKE ‘SNWINPA.EXE’ OR F.FileName LIKE ‘TCP2PDIS.EXE’ OR F.FileName LIKE ‘UpdRgfs.EXE’ OR F.FileName LIKE ‘wddsppag.exe’ OR F.FileName LIKE ‘wdehn.exe’ OR F.FileName LIKE ‘Wdmicomm.exe’ OR F.FileName LIKE ‘WDRPCMGR.EXE’ OR F.FileName LIKE ‘WICONSOLE.EXE’ OR F.FileName LIKE ‘WIMASvc.exe’ OR F.FileName LIKE ‘WINFTP32.DLL’ OR F.FileName LIKE ‘WINSTALL.exe’ OR F.FileName LIKE ‘WRQNFS.EXE’ OR F.FileName LIKE ‘WRQTCP.EXE’ OR F.FileName LIKE ‘X.EXE’ OR F.FileName LIKE ‘xcp.exe’ OR F.FileName LIKE ‘xfwXMI.dll’ OR F.FileName LIKE ‘xstartup.exe’ OR F.FileName LIKE 'XTALK30.EXE’
2012R1
SELECT S.NetbiosName, F.FileName, F.FileDescription, F.FileVersion, F.FileSize, F.FileModifiedDate, F.FilePath FROM SMS_R_System S LEFT JOIN SMS_G_System_SoftwareFile F on F.ResourceID = S.ResourceId
WHERE F.FileName LIKE ‘%.chf’ OR F.FileName LIKE ‘%.ser’ OR F.FileName LIKE ‘%CoreServices.exe%’ OR F.FileName LIKE ‘%MCSServiceAgent.exe%’ OR F.FileName LIKE ‘%PresentationDesigner.exe%’ OR F.FileName LIKE ‘%SNDS.exe%’ OR F.FileName LIKE ‘%VigilEntAgent.exe%’ OR F.FileName LIKE ‘%vsoc.exe%’ OR F.FileName LIKE ‘%WINSTALA.exe%’ OR F.FileName LIKE ‘%WINSTLU32.exe%’ OR F.FileName LIKE ‘%WINSTU32.exe%’ OR F.FileName LIKE ‘ACCMGR32.EXE’ OR F.FileName LIKE ‘ACPMGR.EXE’ OR F.FileName LIKE ‘ACT6530X.OCX’ OR F.FileName LIKE ‘AS400FTX.EXE’ OR F.FileName LIKE ‘ATERM.OCX’ OR F.FileName LIKE ‘ATM_RM_R.exe’ OR F.FileName LIKE ‘ATMFRAME.EXE’ OR F.FileName LIKE ‘bdes.dll’ OR F.FileName LIKE ‘C4CONF32.EXE’ OR F.FileName LIKE ‘CGI2NOVA.EXE’ OR F.FileName LIKE ‘DBEnterprise.exe’ OR F.FileName LIKE ‘DBUtility.exe’ OR F.FileName LIKE ‘DemoHost.Exe’ OR F.FileName LIKE ‘Discover.exe’ OR F.FileName LIKE ‘EASYVIEW.EXE’ OR F.FileName LIKE ‘EHNCFG32.EXE’ OR F.FileName LIKE ‘EHNTES32.EXE’ OR F.FileName LIKE ‘EMU.EXE’ OR F.FileName LIKE ‘EXTRA!.EXE’ OR F.FileName LIKE ‘EXTRA.EXE’ OR F.FileName LIKE ‘fsshclient.exe’ OR F.FileName LIKE ‘fsshd2.exe’ OR F.FileName LIKE ‘GRAPHX32.EXE’ OR F.FileName LIKE ‘Idrive.sys’ OR F.FileName LIKE ‘IMPORT.exe’ OR F.FileName LIKE ‘KEAHP.EXE’ OR F.FileName LIKE ‘KEAVT.EXE’ OR F.FileName LIKE ‘mnfserv.exe’ OR F.FileName LIKE ‘mwm.exe’ OR F.FileName LIKE ‘nfsgwapp.exe’ OR F.FileName LIKE ‘nmAppc.dll’ OR F.FileName LIKE ‘nmssh.exe’ OR F.FileName LIKE ‘nmsshfwd.exe’ OR F.FileName LIKE ‘NOF.exe’ OR F.FileName LIKE ‘NOVA.EXE’ OR F.FileName LIKE ‘NOVATRC.EXE’ OR F.FileName LIKE ‘NWLatSrv.exe’ OR F.FileName LIKE ‘PTR32.EXE’ OR F.FileName LIKE ‘QAPDEV32.EXE’ OR F.FileName LIKE ‘R.exe’ OR F.FileName LIKE ‘r1.exe’ OR F.FileName LIKE ‘r1win.exe’ OR F.FileName LIKE ‘r2.exe’ OR F.FileName LIKE ‘r2macsngl41.sea’ OR F.FileName LIKE ‘r2win.exe’ OR F.FileName LIKE ‘r3win.exe’ OR F.FileName LIKE ‘r4.exe’ OR F.FileName LIKE ‘r4macsngl42.sea’ OR F.FileName LIKE ‘r4win.exe’ OR F.FileName LIKE ‘r7.exe’ OR F.FileName LIKE ‘r8.exe’ OR F.FileName LIKE ‘r8win.exe’ OR F.FileName LIKE ‘rdeploy.exe’ OR F.FileName LIKE ‘rftp.exe’ OR F.FileName LIKE ‘rftpc.exe’ OR F.FileName LIKE ‘rlat.dll’ OR F.FileName LIKE ‘rnnfsadm.exe’ OR F.FileName LIKE ‘rnnfserv.exe’ OR F.FileName LIKE ‘rsshd.exe’ OR F.FileName LIKE ‘RumbaPage.exe’ OR F.FileName LIKE ‘RumbaTrc.exe’ OR F.FileName LIKE ‘Rumbavt.Exe’ OR F.FileName LIKE ‘rumbawsf’ OR F.FileName LIKE ‘Rumbawsf.Exe’ OR F.FileName LIKE ‘rvd.EXE’ OR F.FileName LIKE ‘Rx.exe’ OR F.FileName LIKE ‘Rx2008.jar’ OR F.FileName LIKE ‘rxmgr.exe’ OR F.FileName LIKE ‘SMTBF.DLL’ OR F.FileName LIKE ‘SMTBF32.DLL’ OR F.FileName LIKE ‘SNPI.EXE’ OR F.FileName LIKE ‘SNWINPA.EXE’ OR F.FileName LIKE ‘TCP2PDIS.EXE’ OR F.FileName LIKE ‘UpdRgfs.EXE’ OR F.FileName LIKE ‘wddsppag.exe’ OR F.FileName LIKE ‘wdehn.exe’ OR F.FileName LIKE ‘Wdmicomm.exe’ OR F.FileName LIKE ‘WDRPCMGR.EXE’ OR F.FileName LIKE ‘WICONSOLE.EXE’ OR F.FileName LIKE ‘WIMASvc.exe’ OR F.FileName LIKE ‘WINFTP32.DLL’ OR F.FileName LIKE ‘WINSTALL.exe’ OR F.FileName LIKE ‘WRQNFS.EXE’ OR F.FileName LIKE ‘WRQTCP.EXE’ OR F.FileName LIKE ‘X.EXE’ OR F.FileName LIKE ‘xcp.exe’ OR F.FileName LIKE ‘xfwXMI.dll’ OR F.FileName LIKE ‘xstartup.exe’ OR F.FileName LIKE 'XTALK30.EXE
2012R2
SELECT S.Netbios_Name0, F.FileName, F.FileDescription, F.FileVersion, F.FileSize, F.FileModifiedDate, F.FilePath FROM vSMS_R_System S LEFT JOIN v_GS_SoftwareFile F On F.ResourceID = S.ItemKey
WHERE F.FileName LIKE ‘%.chf’ OR F.FileName LIKE ‘%.ser’ OR F.FileName LIKE ‘%CoreServices.exe%’ OR F.FileName LIKE ‘%MCSServiceAgent.exe%’ OR F.FileName LIKE ‘%PresentationDesigner.exe%’ OR F.FileName LIKE ‘%SNDS.exe%’ OR F.FileName LIKE ‘%VigilEntAgent.exe%’ OR F.FileName LIKE ‘%vsoc.exe%’ OR F.FileName LIKE ‘%WINSTALA.exe%’ OR F.FileName LIKE ‘%WINSTLU32.exe%’ OR F.FileName LIKE ‘%WINSTU32.exe%’ OR F.FileName LIKE ‘ACCMGR32.EXE’ OR F.FileName LIKE ‘ACPMGR.EXE’ OR F.FileName LIKE ‘ACT6530X.OCX’ OR F.FileName LIKE ‘AS400FTX.EXE’ OR F.FileName LIKE ‘ATERM.OCX’ OR F.FileName LIKE ‘ATM_RM_R.exe’ OR F.FileName LIKE ‘ATMFRAME.EXE’ OR F.FileName LIKE ‘bdes.dll’ OR F.FileName LIKE ‘C4CONF32.EXE’ OR F.FileName LIKE ‘CGI2NOVA.EXE’ OR F.FileName LIKE ‘DBEnterprise.exe’ OR F.FileName LIKE ‘DBUtility.exe’ OR F.FileName LIKE ‘DemoHost.Exe’ OR F.FileName LIKE ‘Discover.exe’ OR F.FileName LIKE ‘EASYVIEW.EXE’ OR F.FileName LIKE ‘EHNCFG32.EXE’ OR F.FileName LIKE ‘EHNTES32.EXE’ OR F.FileName LIKE ‘EMU.EXE’ OR F.FileName LIKE ‘EXTRA!.EXE’ OR F.FileName LIKE ‘EXTRA.EXE’ OR F.FileName LIKE ‘fsshclient.exe’ OR F.FileName LIKE ‘fsshd2.exe’ OR F.FileName LIKE ‘GRAPHX32.EXE’ OR F.FileName LIKE ‘Idrive.sys’ OR F.FileName LIKE ‘IMPORT.exe’ OR F.FileName LIKE ‘KEAHP.EXE’ OR F.FileName LIKE ‘KEAVT.EXE’ OR F.FileName LIKE ‘mnfserv.exe’ OR F.FileName LIKE ‘mwm.exe’ OR F.FileName LIKE ‘nfsgwapp.exe’ OR F.FileName LIKE ‘nmAppc.dll’ OR F.FileName LIKE ‘nmssh.exe’ OR F.FileName LIKE ‘nmsshfwd.exe’ OR F.FileName LIKE ‘NOF.exe’ OR F.FileName LIKE ‘NOVA.EXE’ OR F.FileName LIKE ‘NOVATRC.EXE’ OR F.FileName LIKE ‘NWLatSrv.exe’ OR F.FileName LIKE ‘PTR32.EXE’ OR F.FileName LIKE ‘QAPDEV32.EXE’ OR F.FileName LIKE ‘R.exe’ OR F.FileName LIKE ‘r1.exe’ OR F.FileName LIKE ‘r1win.exe’ OR F.FileName LIKE ‘r2.exe’ OR F.FileName LIKE ‘r2macsngl41.sea’ OR F.FileName LIKE ‘r2win.exe’ OR F.FileName LIKE ‘r3win.exe’ OR F.FileName LIKE ‘r4.exe’ OR F.FileName LIKE ‘r4macsngl42.sea’ OR F.FileName LIKE ‘r4win.exe’ OR F.FileName LIKE ‘r7.exe’ OR F.FileName LIKE ‘r8.exe’ OR F.FileName LIKE ‘r8win.exe’ OR F.FileName LIKE ‘rdeploy.exe’ OR F.FileName LIKE ‘rftp.exe’ OR F.FileName LIKE ‘rftpc.exe’ OR F.FileName LIKE ‘rlat.dll’ OR F.FileName LIKE ‘rnnfsadm.exe’ OR F.FileName LIKE ‘rnnfserv.exe’ OR F.FileName LIKE ‘rsshd.exe’ OR F.FileName LIKE ‘RumbaPage.exe’ OR F.FileName LIKE ‘RumbaTrc.exe’ OR F.FileName LIKE ‘Rumbavt.Exe’ OR F.FileName LIKE ‘rumbawsf’ OR F.FileName LIKE ‘Rumbawsf.Exe’ OR F.FileName LIKE ‘rvd.EXE’ OR F.FileName LIKE ‘Rx.exe’ OR F.FileName LIKE ‘Rx2008.jar’ OR F.FileName LIKE ‘rxmgr.exe’ OR F.FileName LIKE ‘SMTBF.DLL’ OR F.FileName LIKE ‘SMTBF32.DLL’ OR F.FileName LIKE ‘SNPI.EXE’ OR F.FileName LIKE ‘SNWINPA.EXE’ OR F.FileName LIKE ‘TCP2PDIS.EXE’ OR F.FileName LIKE ‘UpdRgfs.EXE’ OR F.FileName LIKE ‘wddsppag.exe’ OR F.FileName LIKE ‘wdehn.exe’ OR F.FileName LIKE ‘Wdmicomm.exe’ OR F.FileName LIKE ‘WDRPCMGR.EXE’ OR F.FileName LIKE ‘WICONSOLE.EXE’ OR F.FileName LIKE ‘WIMASvc.exe’ OR F.FileName LIKE ‘WINFTP32.DLL’ OR F.FileName LIKE ‘WINSTALL.exe’ OR F.FileName LIKE ‘WRQNFS.EXE’ OR F.FileName LIKE ‘WRQTCP.EXE’ OR F.FileName LIKE ‘X.EXE’ OR F.FileName LIKE ‘xcp.exe’ OR F.FileName LIKE ‘xfwXMI.dll’ OR F.FileName LIKE ‘xstartup.exe’ OR F.FileName LIKE 'XTALK30.EXE’
EXE Scan

thank you for any help