My PC has entered an infinite BSOD loop - but I do have access to a safe-mode command prompt.

I'm trying to get an idea of "what changed" that might have triggered this. e.g. I might have gotten a virus, or an app update went belly up.

I'd like to thus see which files were created/modified in the last few days/week or at least the *.exe, *.dll, *.com, *.bat etc.

I thought I was ok with my Batch-fu but I'm stumped on how to write a quick batch file/command that would list the files for me.

REM This will find the files, but the results are all muddled
REM all EXE files, reverse sort by date, recursively through sub-directories

dir *.exe /O-D /S

What I'd really like is to find all (executable filetypes) that were created/modified in the last 3-7 days.

Can anyone point me in the right direction?

  • Totally separate from the command to run, it sounds like there is a corrupted setting someone, not an additional executable (which is what your script would find). – soandos Aug 21 '11 at 16:25
  • @soandos - quite possible, I'm going to guess that something I installed or updated... is what triggered the setting change. Either way I think a quick batch file for the above scenario would still be a really handy tool. – Todd McArthur Aug 21 '11 at 16:27
  • @Todd, have you tried booting from Last Known Good Configuration? windows.microsoft.com/en-US/windows7/… (same concept applies to WinXP/2003) – Robert Kerr Aug 21 '11 at 16:46
  • Why don't you analyze the memory dump from the BSOD? – ZippyV Aug 21 '11 at 16:46
  • @ZippyV - I suppose I could but I have no idea how to do that. – Todd McArthur Aug 21 '11 at 17:14

this is a simple, albeit roundabout way, using xcopy. you can look at xcopy /? to see the switches etc.

xcopy \windows\*.exe /L /S /D:12-01-2000 .

This command will output a list of .EXE files and paths in the \windows folder recursively, that were modified on or after 12/1/2000, without actually copying them. NOTE there is a period at then end of the command. Its hard to see with a small font.

Edit 1: I took out the /F from the original command, as it was extraneous.

Edit 2: You can pipe the output to "| more" if you want

  • 2
    just before I jump on this... which part is the part that says "don't actually copy"? ... is it the . e.g. copy to the files original position? – Todd McArthur Aug 21 '11 at 17:05
  • 2
    /L just lists, not copies – Keltari Aug 21 '11 at 17:12
  • @Todd McArthur do xcopy /? man – barlop Aug 21 '11 at 18:01
  • 1
    xcopy is a great, yet underutilized tool, in Windows. xxcopy, a 3rd party program is even better. xxcopy.com/xcpymain.htm – Keltari Aug 21 '11 at 18:48
  • 1
    Elegant. Thanks. I piped the results to a file with > results.txt. Note, if you run the command in the folder you are xcopying from then you will need to replace the last . with a dummy target or you will get a warning about cyclic copying. – CAD bloke Sep 1 '15 at 23:59

protected by Community Apr 21 '13 at 6:31

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.