Ejemplo n.º 1
0
        public static List <Autorunpoints> StartAudit()
        {
            var lstAutoRuns = new List <Autorunpoints>();

            try
            {
                List <string> regprof = RegistryUtil.GetRegProfiles();

                foreach (var prf in regprof)
                {
                    AuditHive(prf, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", false, "Run", lstAutoRuns);
                    AuditHive(prf, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", false, "RunOnce", lstAutoRuns);
                    AuditHive(prf, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run", false, "Run", lstAutoRuns);
                    AuditHive(prf, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load", false, "Load", lstAutoRuns);
                }
                AuditHive("LocalMachine", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", false, "Run", lstAutoRuns);
                AuditHive("LocalMachine", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", false, "RunOnce", lstAutoRuns);

                if (PlatformCheck.IsWow64() == true)
                {
                    AuditHive("LocalMachine", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true, "Run", lstAutoRuns);
                    AuditHive("LocalMachine", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", true, "RunOnce", lstAutoRuns);
                }
            }
            catch (Exception)
            {
            }
            return(lstAutoRuns);
        }
Ejemplo n.º 2
0
        public static List <InstalledApp> StartAudit()
        {
            var reginstalllist = new List <InstalledApp>();

            try
            {
                string[] subkeys_wow = RegistryUtil.GetSubKeys("LocalMachine", "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", false);
                if (subkeys_wow != null)
                {
                    foreach (var sk in subkeys_wow)
                    {
                        InstalledApp rg        = new InstalledApp();
                        string       subk2_wow = "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" + sk.ToString();
                        rg.DisplayName = RegistryUtil.GetStringSubValue("LocalMachine", subk2_wow, "DisplayName", false);
                        if (string.IsNullOrEmpty(rg.DisplayName))
                        {
                            continue;
                        }
                        rg.Version     = RegistryUtil.GetStringSubValue("LocalMachine", subk2_wow, "DisplayVersion", false);
                        rg.InstallDate = RegistryUtil.GetStringSubValue("LocalMachine", subk2_wow, "InstallDate", false);
                        rg.InstallDate = GetValidDate(rg.InstallDate);

                        rg.Key  = "LocalMachine\\" + subk2_wow;
                        rg.Is64 = false;
                        reginstalllist.Add(rg);
                    }
                }

                ////Proceed only for 64 bit
                if (PlatformCheck.IsWow64())
                {
                    string[] subkeys_64 = RegistryUtil.GetSubKeys("LocalMachine", "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", true);
                    if (subkeys_64 != null)
                    {
                        foreach (var sk in subkeys_64)
                        {
                            InstalledApp rg       = new InstalledApp();
                            string       subk2_64 = "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" + sk.ToString();
                            rg.DisplayName = RegistryUtil.GetStringSubValue("LocalMachine", subk2_64, "DisplayName", true);
                            if (string.IsNullOrEmpty(rg.DisplayName))
                            {
                                continue;
                            }
                            rg.Version     = RegistryUtil.GetStringSubValue("LocalMachine", subk2_64, "DisplayVersion", true);
                            rg.InstallDate = RegistryUtil.GetStringSubValue("LocalMachine", subk2_64, "InstallDate", true);
                            rg.InstallDate = GetValidDate(rg.InstallDate);
                            rg.Key         = "LocalMachine\\" + subk2_64;
                            rg.Is64        = true;
                            reginstalllist.Add(rg);
                        }
                    }
                }
                List <string> regprof = RegistryUtil.GetRegProfiles();

                foreach (var prf in regprof)
                {
                    string[] users = RegistryUtil.GetSubKeys(prf, "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", true);
                    if (users != null)
                    {
                        foreach (var sk in users)
                        {
                            InstalledApp rg        = new InstalledApp();
                            string       innnerKey = "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" + sk.ToString();
                            rg.DisplayName = RegistryUtil.GetStringSubValue(prf, innnerKey, "DisplayName", true);
                            if (string.IsNullOrEmpty(rg.DisplayName))
                            {
                                continue;
                            }
                            rg.Version     = RegistryUtil.GetStringSubValue(prf, innnerKey, "DisplayVersion", true);
                            rg.InstallDate = RegistryUtil.GetStringSubValue(prf, innnerKey, "InstallDate", true);
                            rg.InstallDate = GetValidDate(rg.InstallDate);
                            rg.Key         = prf + "\\" + innnerKey;
                            reginstalllist.Add(rg);
                        }
                    }
                }
            }
            catch (Exception)
            {
            }

            return(reginstalllist);
        }