Use Everything to find and kill running scripts

[Rafaello]

Since es.exe (Everything CLI) finds files instantly (if they're stored in the index), we can use it to terminate a hidden, invisible, or hanging script, process, or virus from PowerShell:

• Download and add
  es.exe
  to
  Path
  if not added:

  Code: Select all

  Install-Module Environment.Path
  Import-Module Environment.Path -Function Add-EnvPath
  
  # path to downloaded es.exe
  Add-EnvPath "C:\Program Files\Everything 1.5a\es.exe"
  # restart isn't required!
  

• Install and import functions:

  Code: Select all

  Install-Module SystemEssentials
  Import-Module SystemEssentials -Function Stop-HiddenScript
  

Now you can kill any script by filename:

Code: Select all

Stop-HiddenScript malware.py, malware.ps1
Stop-HiddenScript edgeupdate  # all matches

kills.gif

Or by specifying it's interpreter:

Code: Select all

Stop-HiddenScript taphold -launcher autohotkey  # all matches
Stop-HiddenScript svchost -launcher cmd.exe  # windows svchost is not launched by cmd...

Stop-Script.png

Under the hood it calls

es.exe file:nopath:"$name"

so can you:

Code: Select all

es.exe malware.cmd | Stop-HiddenScript

If it's an executable:

Code: Select all

es.exe malware.exe | Stop-Process