Windows 10: Is this script safe

*Warning may cause harm*

I seen it posted in a forum its supposed to find if any svchost.exe's running on the system contain trojans or malicious backdoors/hidden scripts and viruses.

PHP Code: @echo off
REM First release on 01/03/2017 @ 04:45
REM Updated on 07/03/2017 @ 04:05
Set "ProcessName=SVCHOST"
Set "Tmp_Services=%Tmp%\%~n0.txt"
If Exist "%Tmp_Services%" Del "%Tmp_Services%"
Set "ProcessLog=%Tmp%\%ProcessName%.log"
If Exist "%ProcessLog%" Del "%ProcessLog%"
Set "Legits_Services_SVCHOST=%~dp0Legits_Services_%ProcessName%.txt"
Set "Legit_Location=%windir%\system32\svchost.exe"
Set "LogFile=%~dp0%ProcessName%_ProcessList.txt"
Set "Suspicious_LogFile=%~dp0%ComputerName%_%ProcessName%_Suspicious_Paths.txt"
Title Finding all instances and paths of "%ProcessName%" by Hackoo 2017
If Exist "%LogFile%" Del "%LogFile%"
Set /A Counter=0
setlocal enableDelayedExpansion
for /F "skip=1" %%a in ('WMIC Path win32_process where "name like '%%%ProcessName%%%'" get commandline') do (
for /F "delims=" %%b in ("%%a") do (
Color 0A
set /A Counter+=1
set "p=%%b"
for /f %%f in ('echo !p! ^|Findstr /LI "%Legit_Location%"') do (
echo [!Counter!] : !p!
)
( echo "!p!" )>>"%LogFile%"
)
)


Powershell.exe Get-WmiObject Win32_Process ^| select ProcessID,ProcessName,Handle,commandline,ExecutablePath ^| Out-File -Append "%ProcessLog%" -Encoding ascii
Type "%ProcessLog%" | find /i "%Legit_Location%" > "%Tmp_Services%"


(
echo(
echo Those are legitimes services of "%ProcessName%.exe"
Tasklist /SVC /FO TABLE /FI "IMAGENAME eq %ProcessName%.exe"
)>con


(
echo(
echo Those are legitimes services of "%ProcessName%.exe"
Tasklist /SVC /FO TABLE /FI "IMAGENAME eq %ProcessName%.exe"
)>> "%Tmp_Services%"
CMD /U /C Type "%Tmp_Services%" > "%Legits_Services_SVCHOST%"
echo(
Echo All instances of "%ProcessName%" in this path "%Legit_Location%" are legitimes services
echo(
echo Hit any key to look for a suspicious "%ProcessName%" paths
Findstr /LVI "%Legit_Location%" "%LogFile%" > "%Suspicious_LogFile%"
pause>nul
Start "" "%Suspicious_LogFile%"
Start "" "%Legits_Services_SVCHOST%" & exit
::*********************************************************************************************
code.txt you can view it plainly in the text form I attached

:)

 

java script

Hi BryanGibson78

You may try checking out this link.
http://www.thewindowsclub.com/scripts-are-usually-safe-do-you-want-to-allow-scripts-to-run

 

java script

scripts are usually safe, allow scripts to run anyway? this message will not go away. also says I need java to run scripts

 

Not sure, if it is very helpful, it just list processes not located within System32's folder.
Windows processes are listed separately, so that is a dead giveaway for that one.
Malware usually use hijacked svchost.exe and this script will not tell you that.

 

That is helpful, thank you.