Example #1
0
        private static void EnumMRUList(RegistryKey regKey)
        {
            foreach (string strValueName in regKey.GetValueNames())
            {
                string filePath, fileArgs;

                // Ignore MRUListEx and others
                if (!Regex.IsMatch(strValueName, "[0-9]"))
                {
                    continue;
                }

                string fileName = ExtractUnicodeStringFromBinary(regKey.GetValue(strValueName));

                // If filename is empty -> remove it
                if (string.IsNullOrEmpty(fileName.Trim()))
                {
                    ScanDlg.StoreInvalidKey(Strings.InvalidRegKey, regKey.ToString(), strValueName);
                    continue;
                }
                else
                {
                    string shortcutPath = string.Format("{0}\\{1}.lnk", Environment.GetFolderPath(Environment.SpecialFolder.Recent), fileName);

                    ScanDlg.CurrentScannedObject = shortcutPath;

                    // See if file exists in Recent Docs folder
                    if (!Utils.FileExists(shortcutPath) || !Utils.ResolveShortcut(shortcutPath, out filePath, out fileArgs))
                    {
                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.ToString(), strValueName);
                        continue;
                    }
                }
            }
        }
Example #2
0
        private static void ScanRegistryKey(RegistryKey baseRegKey)
        {
            if (baseRegKey == null)
            {
                return;
            }

            Main.Logger.WriteLine("Scanning " + baseRegKey.Name + " for empty registry keys");

            foreach (string strSubKey in baseRegKey.GetSubKeyNames())
            {
                // Skip needed keys, we dont want to mess the system up
                //if (strSubKey == "Microsoft" ||
                //    strSubKey == "Policies" ||
                //    strSubKey == "Classes" ||
                //    strSubKey == "Printers" ||
                //    strSubKey == "Wow6432Node")
                //    continue;

                if (IsEmptyRegistryKey(baseRegKey.OpenSubKey(strSubKey, true)))
                {
                    ScanDlg.StoreInvalidKey(Strings.NoRegKey, baseRegKey.Name + "\\" + strSubKey);
                }
            }

            baseRegKey.Close();
            return;
        }
Example #3
0
        /// <summary>
        /// Checks MUI Cache for invalid file references (XP Only)
        /// </summary>
        private static void ScanMUICache()
        {
            try
            {
                using (RegistryKey regKey = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\ShellNoRoam\MUICache"))
                {
                    if (regKey == null)
                    {
                        return;
                    }

                    foreach (string valueName in regKey.GetValueNames())
                    {
                        if (valueName.StartsWith("@") || valueName == "LangID")
                        {
                            continue;
                        }

                        ScanDlg.CurrentScannedObject = valueName;

                        if (!Utils.FileExists(valueName))
                        {
                            ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.Name, valueName);
                        }
                    }
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
        }
Example #4
0
        /// <summary>
        /// Scan for missing links to DLLS
        /// </summary>
        public static void Scan()
        {
            try
            {
                RegistryKey regKey = Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs");

                if (regKey == null)
                {
                    return;
                }

                Main.Logger.WriteLine("Scanning for missing shared DLLs");

                // Validate Each DLL from the value names
                foreach (string strFilePath in regKey.GetValueNames())
                {
                    // Update scan dialog
                    ScanDlg.CurrentScannedObject = strFilePath;

                    if (!string.IsNullOrEmpty(strFilePath))
                    {
                        if (!Utils.FileExists(strFilePath))
                        {
                            ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.Name, strFilePath);
                        }
                    }
                }

                regKey.Close();
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
        }
Example #5
0
        /// <summary>
        /// Scans for invalid references to fonts
        /// </summary>
        public static void Scan()
        {
            try
            {
                using (RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32"))
                {
                    if (regKey == null)
                    {
                        return;
                    }

                    Main.Logger.WriteLine("Scanning for missing drivers");

                    foreach (string strDriverName in regKey.GetValueNames())
                    {
                        string strValue = regKey.GetValue(strDriverName) as string;

                        ScanDlg.CurrentScannedObject = strValue;

                        if (!string.IsNullOrEmpty(strValue))
                        {
                            if (!Utils.FileExists(strValue))
                            {
                                ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.Name, strDriverName);
                            }
                        }
                    }
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
        }
        private static void ScanAppPaths()
        {
            RegistryKey regKey = Registry.LocalMachine.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\App Paths");

            if (regKey == null)
            {
                return;
            }

            foreach (string strSubKey in regKey.GetSubKeyNames())
            {
                RegistryKey regKey2 = regKey.OpenSubKey(strSubKey);

                if (regKey2 != null)
                {
                    ScanDlg.CurrentScannedObject = regKey2.ToString();

                    if (Convert.ToInt32(regKey2.GetValue("BlockOnTSNonInstallMode")) == 1)
                    {
                        continue;
                    }

                    string strAppPath = regKey2.GetValue("") as string;
                    string strAppDir  = regKey2.GetValue("Path") as string;

                    if (string.IsNullOrEmpty(strAppPath))
                    {
                        ScanDlg.StoreInvalidKey(Strings.InvalidRegKey, regKey2.ToString());
                        continue;
                    }

                    if (!string.IsNullOrEmpty(strAppDir))
                    {
                        if (Utils.SearchPath(strAppPath, strAppDir))
                        {
                            continue;
                        }
                        else if (Utils.SearchPath(strSubKey, strAppDir))
                        {
                            continue;
                        }
                    }
                    else
                    {
                        if (Utils.FileExists(strAppPath))
                        {
                            continue;
                        }
                    }

                    ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey2.Name);
                }
            }

            regKey.Close();
        }
Example #7
0
        private static void ValidateExplorerExt(RegistryKey regKey)
        {
            try
            {
                // Sees if icon file exists
                string strHotIcon = regKey.GetValue("HotIcon") as string;
                if (!string.IsNullOrEmpty(strHotIcon))
                {
                    if (!Utils.IconExists(strHotIcon))
                    {
                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.ToString(), "HotIcon");
                    }
                }

                string strIcon = regKey.GetValue("Icon") as string;
                if (!string.IsNullOrEmpty(strIcon))
                {
                    if (!Utils.IconExists(strIcon))
                    {
                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.ToString(), "Icon");
                    }
                }

                // Lookup CLSID extension
                string strClsidExt = regKey.GetValue("ClsidExtension") as string;
                if (!string.IsNullOrEmpty(strClsidExt))
                {
                    ScanDlg.StoreInvalidKey(Strings.MissingCLSID, regKey.ToString(), "ClsidExtension");
                }

                // See if files exist
                string strExec = regKey.GetValue("Exec") as string;
                if (!string.IsNullOrEmpty(strExec))
                {
                    if (!Utils.FileExists(strExec))
                    {
                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.ToString(), "Exec");
                    }
                }

                string strScript = regKey.GetValue("Script") as string;
                if (!string.IsNullOrEmpty(strScript))
                {
                    if (!Utils.FileExists(strScript))
                    {
                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.ToString(), "Script");
                    }
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
        }
        const int CSIDL_FONTS = 0x0014;    // windows\fonts

        /// <summary>
        /// Finds invalid font references
        /// </summary>
        public static void Scan()
        {
            StringBuilder strPath = new StringBuilder(260);

            try
            {
                using (RegistryKey regKey = Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows NT\\CurrentVersion\\Fonts"))
                {
                    if (regKey == null)
                    {
                        return;
                    }

                    Main.Logger.WriteLine("Scanning for invalid fonts");

                    if (!SHGetSpecialFolderPath(IntPtr.Zero, strPath, CSIDL_FONTS, false))
                    {
                        return;
                    }

                    foreach (string strFontName in regKey.GetValueNames())
                    {
                        string strValue = regKey.GetValue(strFontName) as string;

                        // Skip if value is empty
                        if (string.IsNullOrEmpty(strValue))
                        {
                            continue;
                        }

                        // Check value by itself
                        if (Utils.FileExists(strValue))
                        {
                            continue;
                        }

                        // Check for font in fonts folder
                        string strFontPath = String.Format("{0}\\{1}", strPath.ToString(), strValue);

                        ScanDlg.CurrentScannedObject = strFontPath;

                        if (!File.Exists(strFontPath))
                        {
                            ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.ToString(), strFontName);
                        }
                    }
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
        }
        /// <summary>
        /// Do a cross-reference check on ARP Cache keys
        /// </summary>
        /// <param name="regKey"></param>
        private static void checkARPCache(RegistryKey regKey)
        {
            if (regKey == null)
            {
                return;
            }

            foreach (string subKey in regKey.GetSubKeyNames())
            {
                if (Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" + subKey) == null)
                {
                    ScanDlg.StoreInvalidKey(Strings.ObsoleteRegKey, string.Format("{0}/{1}", regKey.Name, subKey));
                }
            }
        }
Example #10
0
        /// <summary>
        /// Looks for invalid references to AppIDs
        /// </summary>
        private static void ScanAppIds(RegistryKey regKey)
        {
            if (regKey == null)
            {
                return;
            }

            Main.Logger.WriteLine("Scanning " + regKey.Name + " for invalid AppID's");

            try
            {
                foreach (string strAppId in regKey.GetSubKeyNames())
                {
                    using (RegistryKey rkAppId = regKey.OpenSubKey(strAppId))
                    {
                        if (rkAppId != null)
                        {
                            // Update scan dialog
                            ScanDlg.CurrentScannedObject = rkAppId.ToString();

                            // Check for reference to AppID
                            string strCLSID = rkAppId.GetValue("AppID") as string;

                            if (!string.IsNullOrEmpty(strCLSID))
                            {
                                if (!appidExists(strCLSID))
                                {
                                    ScanDlg.StoreInvalidKey(Strings.MissingAppID, rkAppId.ToString());
                                }
                            }
                        }
                    }
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
            catch (System.UnauthorizedAccessException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }



            regKey.Close();
        }
        private static void ScanInstallFolders()
        {
            RegistryKey regKey = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders");

            if (regKey == null)
            {
                return;
            }

            foreach (string strFolder in regKey.GetValueNames())
            {
                ScanDlg.CurrentScannedObject = strFolder;

                if (!Utils.DirExists(strFolder))
                {
                    ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.Name, strFolder);
                }
            }
        }
Example #12
0
        /// <summary>
        /// Checks if the AppID exists
        /// </summary>
        /// <param name="appID">The AppID or GUID</param>
        /// <returns>True if it exists</returns>
        private static bool appidExists(string appID)
        {
            List <RegistryKey> listRegKeys = new List <RegistryKey>();

            listRegKeys.Add(Registry.ClassesRoot.OpenSubKey(@"AppID"));
            listRegKeys.Add(Registry.LocalMachine.OpenSubKey(@"Software\Classes\AppID"));
            listRegKeys.Add(Registry.CurrentUser.OpenSubKey(@"Software\Classes\AppID"));

            if (Utils.Is64BitOS)
            {
                listRegKeys.Add(Registry.ClassesRoot.OpenSubKey(@"Wow6432Node\AppID"));
                listRegKeys.Add(Registry.LocalMachine.OpenSubKey(@"Software\Wow6432Node\Classes\AppID"));
                listRegKeys.Add(Registry.CurrentUser.OpenSubKey(@"Software\Wow6432Node\Classes\AppID"));
            }

            try
            {
                foreach (RegistryKey rk in listRegKeys)
                {
                    if (rk == null)
                    {
                        continue;
                    }

                    using (RegistryKey subKey = rk.OpenSubKey(appID))
                    {
                        if (subKey != null)
                        {
                            if (!ScanDlg.IsOnIgnoreList(subKey.ToString()))
                            {
                                return(true);
                            }
                        }
                    }
                }
            }
            catch
            {
                return(false);
            }

            return(false);
        }
Example #13
0
        /// <summary>
        /// Checks for invalid files in startup registry key
        /// </summary>
        /// <param name="regKey">The registry key to scan</param>
        private static void checkAutoRun(RegistryKey regKey)
        {
            if (regKey == null)
            {
                return;
            }

            Main.Logger.WriteLine("Checking for invalid files in " + regKey.Name);

            foreach (string strProgName in regKey.GetValueNames())
            {
                string strRunPath = regKey.GetValue(strProgName) as string;
                string strFilePath, strArgs;

                if (!string.IsNullOrEmpty(strRunPath))
                {
                    ScanDlg.CurrentScannedObject = strRunPath;

                    // Check run path by itself
                    if (Utils.FileExists(strRunPath))
                    {
                        continue;
                    }

                    // See if file exists (also checks if string is null)
                    if (Utils.ExtractArguments(strRunPath, out strFilePath, out strArgs))
                    {
                        continue;
                    }

                    if (Utils.ExtractArguments2(strRunPath, out strFilePath, out strArgs))
                    {
                        continue;
                    }

                    ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.Name, strProgName);
                }
            }

            regKey.Close();
            return;
        }
        /// <summary>
        /// Goes deep into sub keys to see if files exist
        /// </summary>
        /// <param name="rk">Registry subkey</param>
        private static void ParseSoundKeys(RegistryKey rk)
        {
            foreach (string strSubKey in rk.GetSubKeyNames())
            {
                // Ignores ".Default" Subkey
                if ((strSubKey.CompareTo(".Current") == 0) || (strSubKey.CompareTo(".Modified") == 0))
                {
                    // Gets the (default) key and sees if the file exists
                    RegistryKey rk2 = rk.OpenSubKey(strSubKey);

                    if (rk2 != null)
                    {
                        ScanDlg.CurrentScannedObject = rk2.ToString();

                        string strSoundPath = rk2.GetValue("") as string;

                        if (!string.IsNullOrEmpty(strSoundPath))
                        {
                            if (!Utils.FileExists(strSoundPath))
                            {
                                ScanDlg.StoreInvalidKey(Strings.InvalidFile, rk2.Name, "(default)");
                            }
                        }
                    }
                }
                else if (!string.IsNullOrEmpty(strSubKey))
                {
                    RegistryKey rk2 = rk.OpenSubKey(strSubKey);
                    if (rk2 != null)
                    {
                        ScanDlg.CurrentScannedObject = rk2.ToString();
                        ParseSoundKeys(rk2);
                    }
                }
            }

            return;
        }
        /// <summary>
        /// Scans for invalid windows help files
        /// </summary>
        private static void CheckHelpFiles(RegistryKey regKey)
        {
            if (regKey == null)
            {
                return;
            }

            Main.Logger.WriteLine("Checking for missing help files in " + regKey.Name);

            foreach (string strHelpFile in regKey.GetValueNames())
            {
                string strHelpPath = regKey.GetValue(strHelpFile) as string;

                ScanDlg.CurrentScannedObject = strHelpPath;

                if (!HelpFileExists(strHelpFile, strHelpPath))
                {
                    ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey.ToString(), strHelpFile);
                }
            }

            return;
        }
        /// <summary>
        /// Verifies installed programs in add/remove list
        /// </summary>
        public static void Scan()
        {
            try
            {
                Main.Logger.WriteLine("Verifying programs in Add/Remove list");

                using (RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"))
                {
                    if (regKey == null)
                    {
                        return;
                    }

                    foreach (string strProgName in regKey.GetSubKeyNames())
                    {
                        using (RegistryKey regKey2 = regKey.OpenSubKey(strProgName))
                        {
                            if (regKey2 != null)
                            {
                                ScanDlg.CurrentScannedObject = regKey2.ToString();

                                Common_Tools.ProgramInfo progInfo = new Common_Tools.ProgramInfo(regKey2);

                                if (regKey2.ValueCount <= 0)
                                {
                                    ScanDlg.StoreInvalidKey(Strings.InvalidRegKey, regKey2.ToString());
                                    continue;
                                }

                                if (progInfo.WindowsInstaller)
                                {
                                    continue;
                                }

                                if (string.IsNullOrEmpty(progInfo.DisplayName) && (!progInfo.Uninstallable))
                                {
                                    ScanDlg.StoreInvalidKey(Strings.InvalidRegKey, regKey2.ToString());
                                    continue;
                                }

                                // Check display icon
                                if (!string.IsNullOrEmpty(progInfo.DisplayIcon))
                                {
                                    if (!Utils.IconExists(progInfo.DisplayIcon))
                                    {
                                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey2.ToString(), "DisplayIcon");
                                    }
                                }

                                // Check install location
                                if (!string.IsNullOrEmpty(progInfo.InstallLocation))
                                {
                                    if ((!Utils.DirExists(progInfo.InstallLocation)) && (!Utils.FileExists(progInfo.InstallLocation)))
                                    {
                                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey2.ToString(), "InstallLocation");
                                    }
                                }

                                // Check install source
                                if (!string.IsNullOrEmpty(progInfo.InstallSource))
                                {
                                    if ((!Utils.DirExists(progInfo.InstallSource)) && (!Utils.FileExists(progInfo.InstallSource)))
                                    {
                                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKey2.ToString(), "InstallSource");
                                    }
                                }

                                // Check ARP Cache
                                if (progInfo.SlowCache)
                                {
                                    if (!string.IsNullOrEmpty(progInfo.FileName))
                                    {
                                        if (!Utils.FileExists(progInfo.FileName))
                                        {
                                            ScanDlg.StoreInvalidKey(Strings.InvalidRegKey, progInfo.SlowInfoCacheRegKey);
                                        }
                                    }
                                }
                            }
                        }
                    }
                }

                Main.Logger.WriteLine("Verifying registry entries in Add/Remove Cache");

                checkARPCache(Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\"));
                checkARPCache(Registry.CurrentUser.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\"));
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
        }
Example #17
0
        /// <summary>
        /// Finds invalid File extensions + ProgIDs referenced
        /// </summary>
        private static void ScanClasses(RegistryKey regKey)
        {
            if (regKey == null)
            {
                return;
            }

            Main.Logger.WriteLine("Scanning " + regKey.Name + " for invalid Classes");

            try
            {
                foreach (string strSubKey in regKey.GetSubKeyNames())
                {
                    // Update scan dialog
                    ScanDlg.CurrentScannedObject = string.Format("{0}\\{1}", regKey.Name, strSubKey);

                    // Skip any file (*)
                    if (strSubKey == "*")
                    {
                        continue;
                    }

                    if (strSubKey[0] == '.')
                    {
                        // File Extension
                        using (RegistryKey rkFileExt = regKey.OpenSubKey(strSubKey))
                        {
                            if (rkFileExt != null)
                            {
                                // Find reference to ProgID
                                string strProgID = rkFileExt.GetValue("") as string;

                                if (!string.IsNullOrEmpty(strProgID))
                                {
                                    if (!progIDExists(strProgID))
                                    {
                                        ScanDlg.StoreInvalidKey(Strings.MissingProgID, rkFileExt.ToString());
                                    }
                                }
                            }
                        }
                    }
                    else
                    {
                        // ProgID or file class

                        // See if DefaultIcon exists
                        using (RegistryKey regKeyDefaultIcon = regKey.OpenSubKey(string.Format("{0}\\DefaultIcon", strSubKey)))
                        {
                            if (regKeyDefaultIcon != null)
                            {
                                string iconPath = regKeyDefaultIcon.GetValue("") as string;

                                if (!string.IsNullOrEmpty(iconPath))
                                {
                                    if (!Utils.IconExists(iconPath))
                                    {
                                        if (!ScanDlg.IsOnIgnoreList(iconPath))
                                        {
                                            ScanDlg.StoreInvalidKey(Strings.InvalidFile, regKeyDefaultIcon.Name);
                                        }
                                    }
                                }
                            }
                        }

                        // Check referenced CLSID
                        using (RegistryKey rkCLSID = regKey.OpenSubKey(string.Format("{0}\\CLSID", strSubKey)))
                        {
                            if (rkCLSID != null)
                            {
                                string guid = rkCLSID.GetValue("") as string;

                                if (!string.IsNullOrEmpty(guid))
                                {
                                    if (!clsidExists(guid))
                                    {
                                        ScanDlg.StoreInvalidKey(Strings.MissingCLSID, string.Format("{0}\\{1}", regKey.Name, strSubKey));
                                    }
                                }
                            }
                        }
                    }

                    // Check for unused progid/extension
                    using (RegistryKey rk = regKey.OpenSubKey(strSubKey))
                    {
                        if (rk != null)
                        {
                            if (rk.ValueCount <= 0 && rk.SubKeyCount <= 0)
                            {
                                ScanDlg.StoreInvalidKey(Strings.InvalidProgIDFileExt, rk.Name);
                            }
                        }
                    }
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
            catch (System.UnauthorizedAccessException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }

            regKey.Close();

            return;
        }
Example #18
0
        /// <summary>
        /// Finds invalid windows explorer entries
        /// </summary>
        private static void ScanExplorer()
        {
            try
            {
                // Check Browser Help Objects
                using (RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects"))
                {
                    Main.Logger.WriteLine("Checking for invalid browser helper objects");

                    if (regKey != null)
                    {
                        RegistryKey rkBHO = null;

                        foreach (string strGuid in regKey.GetSubKeyNames())
                        {
                            if ((rkBHO = regKey.OpenSubKey(strGuid)) != null)
                            {
                                // Update scan dialog
                                ScanDlg.CurrentScannedObject = rkBHO.ToString();

                                if (!clsidExists(strGuid))
                                {
                                    ScanDlg.StoreInvalidKey(Strings.MissingCLSID, rkBHO.ToString());
                                }
                            }
                        }
                    }
                }

                // Check IE Toolbars
                using (RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar"))
                {
                    Main.Logger.WriteLine("Checking for invalid explorer toolbars");

                    if (regKey != null)
                    {
                        foreach (string strGuid in regKey.GetValueNames())
                        {
                            // Update scan dialog
                            ScanDlg.CurrentScannedObject = "CLSID: " + strGuid;

                            if (!IEToolbarIsValid(strGuid))
                            {
                                ScanDlg.StoreInvalidKey(Strings.InvalidToolbar, regKey.ToString(), strGuid);
                            }
                        }
                    }
                }

                // Check IE Extensions
                using (RegistryKey regKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Internet Explorer\\Extensions"))
                {
                    RegistryKey rkExt = null;

                    Main.Logger.WriteLine("Checking for invalid explorer extensions");

                    if (regKey != null)
                    {
                        foreach (string strGuid in regKey.GetSubKeyNames())
                        {
                            if ((rkExt = regKey.OpenSubKey(strGuid)) != null)
                            {
                                // Update scan dialog
                                ScanDlg.CurrentScannedObject = rkExt.ToString();

                                ValidateExplorerExt(rkExt);
                            }
                        }
                    }
                }

                // Check Explorer File Exts
                using (RegistryKey regKey = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts"))
                {
                    RegistryKey rkFileExt = null;

                    Main.Logger.WriteLine("Checking for invalid explorer file extensions");

                    if (regKey != null)
                    {
                        foreach (string strFileExt in regKey.GetSubKeyNames())
                        {
                            if ((rkFileExt = regKey.OpenSubKey(strFileExt)) == null || strFileExt[0] != '.')
                            {
                                continue;
                            }

                            // Update scan dialog
                            ScanDlg.CurrentScannedObject = rkFileExt.ToString();

                            ValidateFileExt(rkFileExt);
                        }
                    }
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
            catch (System.UnauthorizedAccessException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }

            return;
        }
Example #19
0
        private static void ValidateFileExt(RegistryKey regKey)
        {
            bool bProgidExists = false, bAppExists = false;

            try
            {
                // Skip if UserChoice subkey exists
                if (regKey.OpenSubKey("UserChoice") != null)
                {
                    return;
                }

                // Parse and verify OpenWithProgId List
                using (RegistryKey rkProgids = regKey.OpenSubKey("OpenWithProgids"))
                {
                    if (rkProgids != null)
                    {
                        foreach (string strProgid in rkProgids.GetValueNames())
                        {
                            if (progIDExists(strProgid))
                            {
                                bProgidExists = true;
                            }
                        }
                    }
                }

                // Check if files in OpenWithList exist
                using (RegistryKey rkOpenList = regKey.OpenSubKey("OpenWithList"))
                {
                    if (rkOpenList != null)
                    {
                        foreach (string strValueName in rkOpenList.GetValueNames())
                        {
                            if (strValueName == "MRUList")
                            {
                                continue;
                            }

                            string strApp = rkOpenList.GetValue(strValueName) as string;

                            if (appExists(strApp))
                            {
                                bAppExists = true;
                            }
                        }
                    }
                }

                if (!bProgidExists && !bAppExists)
                {
                    ScanDlg.StoreInvalidKey(Strings.InvalidFileExt, regKey.ToString());
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
            catch (System.UnauthorizedAccessException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }

            return;
        }
Example #20
0
        /// <summary>
        /// Scans for the CLSID subkey
        /// <param name="regKey">Location of CLSID Sub Key</param>
        /// </summary>
        private static void ScanCLSIDSubKey(RegistryKey regKey)
        {
            if (regKey == null)
            {
                return;
            }

            Main.Logger.WriteLine("Scanning " + regKey.Name + " for invalid CLSID's");

            try
            {
                foreach (string strCLSID in regKey.GetSubKeyNames())
                {
                    RegistryKey rkCLSID = regKey.OpenSubKey(strCLSID);

                    if (rkCLSID == null)
                    {
                        continue;
                    }

                    ScanDlg.CurrentScannedObject = rkCLSID.ToString();

                    // Check for valid AppID
                    string strAppID = regKey.GetValue("AppID") as string;
                    if (!string.IsNullOrEmpty(strAppID))
                    {
                        if (!appidExists(strAppID))
                        {
                            ScanDlg.StoreInvalidKey(Strings.MissingAppID, rkCLSID.ToString(), "AppID");
                        }
                    }

                    // See if DefaultIcon exists
                    using (RegistryKey regKeyDefaultIcon = rkCLSID.OpenSubKey("DefaultIcon"))
                    {
                        if (regKeyDefaultIcon != null)
                        {
                            string iconPath = regKeyDefaultIcon.GetValue("") as string;

                            if (!string.IsNullOrEmpty(iconPath))
                            {
                                if (!Utils.IconExists(iconPath))
                                {
                                    if (!ScanDlg.IsOnIgnoreList(iconPath))
                                    {
                                        ScanDlg.StoreInvalidKey(Strings.InvalidFile, string.Format("{0}\\DefaultIcon", rkCLSID.ToString()));
                                    }
                                }
                            }
                        }
                    }

                    // Look for InprocServer files
                    using (RegistryKey regKeyInprocSrvr = rkCLSID.OpenSubKey("InprocServer"))
                    {
                        if (regKeyInprocSrvr != null)
                        {
                            string strInprocServer = regKeyInprocSrvr.GetValue("") as string;

                            if (!string.IsNullOrEmpty(strInprocServer))
                            {
                                if (!Utils.FileExists(strInprocServer))
                                {
                                    ScanDlg.StoreInvalidKey(Strings.InvalidInprocServer, regKeyInprocSrvr.ToString());
                                }
                            }

                            regKeyInprocSrvr.Close();
                        }
                    }

                    using (RegistryKey regKeyInprocSrvr32 = rkCLSID.OpenSubKey("InprocServer32"))
                    {
                        if (regKeyInprocSrvr32 != null)
                        {
                            string strInprocServer32 = regKeyInprocSrvr32.GetValue("") as string;

                            if (!string.IsNullOrEmpty(strInprocServer32))
                            {
                                if (!Utils.FileExists(strInprocServer32))
                                {
                                    ScanDlg.StoreInvalidKey(Strings.InvalidInprocServer32, regKeyInprocSrvr32.ToString());
                                }
                            }

                            regKeyInprocSrvr32.Close();
                        }
                    }

                    rkCLSID.Close();
                }
            }
            catch (System.Security.SecurityException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }
            catch (System.UnauthorizedAccessException ex)
            {
                System.Diagnostics.Debug.WriteLine(ex.Message);
            }

            regKey.Close();
            return;
        }