Option Explicit
' 1-recon.vbs -- double-click. Read-only, no admin needed.
' Output: C:\Users\Public\tool\recon.txt (opened in Notepad)
Dim fso, out, wmi, p, s, cnt, fn

fn = "C:\Users\Public\tool\recon.txt"
Set fso = CreateObject("Scripting.FileSystemObject")
If Not fso.FolderExists("C:\Users\Public\tool") Then fso.CreateFolder "C:\Users\Public\tool"
Set out = fso.CreateTextFile(fn, True)
Set wmi = GetObject("winmgmts:")

out.WriteLine "RECON  " & Now
out.WriteLine ""

out.WriteLine "=== 1. TARGET PROCESSES (expect 2-3, 0 = assistant not running)"
cnt = 0
For Each p In wmi.ExecQuery("Select Name,ProcessId,ExecutablePath from Win32_Process")
  If IsTarget(LCase(p.Name), p.ExecutablePath) Then
    out.WriteLine "  HIT  " & p.Name & "  pid=" & p.ProcessId
    out.WriteLine "       " & p.ExecutablePath
    cnt = cnt + 1
  End If
Next
out.WriteLine "  total = " & cnt
out.WriteLine ""

out.WriteLine "=== 2. SERVICE"
For Each s In wmi.ExecQuery("Select Name,State,StartMode,PathName from Win32_Service Where Name='zmserv'")
  out.WriteLine "  " & s.State & " / " & s.StartMode
  out.WriteLine "  " & s.PathName
Next
out.WriteLine "  (no line above = service does not exist)"
out.WriteLine ""

out.WriteLine "=== 3. HOSTS"
On Error Resume Next
out.WriteLine "  size = " & fso.GetFile("C:\Windows\System32\drivers\etc\hosts").Size & "   (824 = stock, 4000+ = blocked list)"
Err.Clear
out.WriteLine "  hosts-bak exist = " & fso.FileExists("C:\Windows\System32\drivers\etc\hosts-bak")
out.WriteLine "  hosts2   exist = " & fso.FileExists("C:\Windows\System32\drivers\etc\hosts2")
On Error GoTo 0
out.WriteLine ""

out.WriteLine "=== 4. INSTALL DIRS"
out.WriteLine "  C:\f40967408 (12.97) = " & fso.FolderExists("C:\f40967408")
out.WriteLine "  C:\q40967584 (13.1)  = " & fso.FolderExists("C:\q40967584")
out.WriteLine "  C:\windows\jf        = " & fso.FolderExists("C:\windows\jf")
out.WriteLine ""
out.WriteLine "DONE"
out.Close
CreateObject("WScript.Shell").Run "notepad """ & fn & """", 1, False

Function AllInRange(t, lo, hi)
  Dim i, ch
  AllInRange = False
  For i = 1 To Len(t)
    ch = Asc(Mid(t, i, 1))
    If ch < lo Or ch > hi Then Exit Function
  Next
  AllInRange = True
End Function

Function IsTarget(b, pth)
  Dim base
  IsTarget = False
  base = LCase(b)
  If Right(base, 4) = ".exe" Then base = Left(base, Len(base) - 4)
  If base = "jfglzsn" Or base = "zmserv" Or base = "przs" Then
    IsTarget = True
    Exit Function
  End If
  If Len(base) = 5 And AllInRange(base, 105, 114) Then IsTarget = True
  If Len(base) = 4 And AllInRange(base, 97, 106) Then
    If InStr(LCase(pth & ""), "\program files (x86)\") > 0 Then IsTarget = True
  End If
End Function