Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My PC has entered an infinite BSOD loop - but I do have access to a safe-mode command prompt.

I'm trying to get an idea of "what changed" that might have triggered this. e.g. I might have gotten a virus, or an app update went belly up.

I'd like to thus see which files were created/modified in the last few days/week or at least the *.exe, *.dll, *.com, *.bat etc.

I thought I was ok with my Batch-fu but I'm stumped on how to write a quick batch file/command that would list the files for me.

REM This will find the files, but the results are all muddled
REM all EXE files, reverse sort by date, recursively through sub-directories

dir *.exe /O-D /S

What I'd really like is to find all (executable filetypes) that were created/modified in the last 3-7 days.

Can anyone point me in the right direction?

share|improve this question
    
Totally separate from the command to run, it sounds like there is a corrupted setting someone, not an additional executable (which is what your script would find). –  soandos Aug 21 '11 at 16:25
    
@soandos - quite possible, I'm going to guess that something I installed or updated... is what triggered the setting change. Either way I think a quick batch file for the above scenario would still be a really handy tool. –  Todd McArthur Aug 21 '11 at 16:27
    
@Todd, have you tried booting from Last Known Good Configuration? windows.microsoft.com/en-US/windows7/… (same concept applies to WinXP/2003) –  Robert Kerr Aug 21 '11 at 16:46
    
Why don't you analyze the memory dump from the BSOD? –  ZippyV Aug 21 '11 at 16:46
    
@ZippyV - I suppose I could but I have no idea how to do that. –  Todd McArthur Aug 21 '11 at 17:14

1 Answer 1

up vote 7 down vote accepted

this is a simple, albeit roundabout way, using xcopy. you can look at xcopy /? to see the switches etc.

c:\xcopy \windows\*.exe /l /s /d:12-01-2000 .

This command will output a list of .EXE files and paths in the \windows folder recursively, that were modified on or after 12/1/2000, without actually copying them. NOTE there is a period at then end of the command. Its hard to see with a small font.

Edit 1: I took out the /f from the original command, as it was extraneous.

Edit 2: You can pipe the output to "| more" if you want

share|improve this answer
1  
just before I jump on this... which part is the part that says "don't actually copy"? ... is it the . e.g. copy to the files original position? –  Todd McArthur Aug 21 '11 at 17:05
1  
/L just lists, not copies –  Keltari Aug 21 '11 at 17:12
    
@Todd McArthur do xcopy /? man –  barlop Aug 21 '11 at 18:01
    
@barlop - yeah I didn't realize the lowercase l was an l vs. a # 1. Also since xcopy is normally for copying - the last thing I wanted to do would be to blast copies of my files across my drive ;-) –  Todd McArthur Aug 21 '11 at 18:45
1  
xcopy is a great, yet underutilized tool, in Windows. xxcopy, a 3rd party program is even better. xxcopy.com/xcpymain.htm –  Keltari Aug 21 '11 at 18:48

protected by Community Apr 21 '13 at 6:31

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.