Example #1
0
        public override IEnumerable <JunkNode> FindJunk()
        {
            var returnList = new List <JunkNode>();

            returnList.AddRange(ScanForJunk());

            returnList.AddRange(ScanFirewallRules());

            returnList.AddRange(ScanTracing());

            returnList.AddRange(ScanClsid());

            returnList.AddRange(ScanAudioPolicyConfig());

            returnList.AddRange(ScanUserAssist());

            returnList.AddRange(ScanAppCompatFlags());

            returnList.AddRange(ScanEventLogs());

            returnList.AddRange(ScanInstallerFolders());

            if (Uninstaller.RegKeyStillExists())
            {
                var regKeyNode = new RegistryKeyJunkNode(PathTools.GetDirectory(Uninstaller.RegistryPath),
                                                         Uninstaller.RegistryKeyName, Uninstaller.DisplayName);
                regKeyNode.Confidence.Add(ConfidencePart.IsUninstallerRegistryKey);
                returnList.Add(regKeyNode);
            }

            return(returnList);
        }
Example #2
0
        private IEnumerable <JunkNode> ScanTracing()
        {
            const string tracingKey     = @"SOFTWARE\Microsoft\Tracing";
            const string fullTracingKey = @"HKEY_LOCAL_MACHINE\" + tracingKey;

            var results = new List <JunkNode>();

            using (var key = Registry.LocalMachine.OpenSubKey(tracingKey))
            {
                if (key != null)
                {
                    foreach (var subKeyName in key.GetSubKeyNames())
                    {
                        var i = subKeyName.LastIndexOf('_');
                        if (i <= 0)
                        {
                            continue;
                        }

                        var str = subKeyName.Substring(0, i);

                        var conf = GenerateConfidence(str, Path.Combine(fullTracingKey, subKeyName), 0).ToList();
                        if (conf.Any())
                        {
                            var node = new RegistryKeyJunkNode(fullTracingKey, subKeyName, Uninstaller.DisplayName);
                            node.Confidence.AddRange(conf);
                            results.Add(node);
                        }
                    }
                }
            }
            return(results);
        }
Example #3
0
        private IEnumerable <JunkNode> ScanRelatedKeys(IEnumerable <JunkNode> itemsToCompare)
        {
            var input  = itemsToCompare.ToList();
            var output = new List <JunkNode>();

            foreach (var registryJunkNode in input)
            {
                var nodeName = registryJunkNode.FullName;

                // Check Wow first because non-wow path will match wow path
                var softwareKey = new[] { KeyLmWow, KeyCuWow, KeyLm, KeyCu }.First(
                    key => nodeName.StartsWith(key, StringComparison.InvariantCultureIgnoreCase));

                nodeName = nodeName.Substring(softwareKey.Length + 1);

                foreach (var keyToTest in SoftwareRegKeys.Except(new[] { softwareKey }))
                {
                    var nodePath = Path.Combine(keyToTest, nodeName);
                    // Check if the same node exists in other root keys
                    var node = input.FirstOrDefault(x => PathTools.PathsEqual(x.FullName, nodePath));

                    if (node != null)
                    {
                        // Add any non-duplicate confidence to the existing node
                        node.Confidence.AddRange(registryJunkNode.Confidence.ConfidenceParts
                                                 .Where(x => !node.Confidence.ConfidenceParts.Any(x.Equals)));
                    }
                    else
                    {
                        try
                        {
                            // Check if the key acually exists
                            using (var nodeKey = RegistryTools.OpenRegistryKey(nodePath, false))
                            {
                                if (nodeKey != null)
                                {
                                    var newNode = new RegistryKeyJunkNode(Path.GetDirectoryName(nodePath),
                                                                          Path.GetFileName(nodePath), Uninstaller.DisplayName);
                                    newNode.Confidence.AddRange(registryJunkNode.Confidence.ConfidenceParts);
                                    output.Add(newNode);
                                }
                            }
                        }
                        catch
                        {
                            // Ignore keys that don't exist
                        }
                    }
                }
            }

            return(output);
        }
Example #4
0
        private IEnumerable <JunkNode> ScanAudioPolicyConfig()
        {
            var returnList = new List <JunkNode>();

            if (string.IsNullOrEmpty(Uninstaller.InstallLocation))
            {
                return(returnList);
            }

            var pathRoot         = Path.GetPathRoot(Uninstaller.InstallLocation);
            var unrootedLocation = pathRoot.Length >= 1
                ? Uninstaller.InstallLocation.Replace(pathRoot, string.Empty)
                : Uninstaller.InstallLocation;

            if (string.IsNullOrEmpty(unrootedLocation.Trim()))
            {
                return(returnList);
            }

            using (var key = RegistryTools.OpenRegistryKey(Path.Combine(KeyCu,
                                                                        @"Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore")))
            {
                if (key == null)
                {
                    return(returnList);
                }

                foreach (var subKeyName in key.GetSubKeyNames())
                {
                    using (var subKey = key.OpenSubKey(subKeyName))
                    {
                        if (subKey == null)
                        {
                            continue;
                        }

                        var defVal = subKey.GetValue(null) as string;
                        if (defVal != null &&
                            defVal.Contains(unrootedLocation, StringComparison.InvariantCultureIgnoreCase))
                        {
                            var junk = new RegistryKeyJunkNode(key.Name, subKeyName, Uninstaller.DisplayName);
                            junk.Confidence.Add(ConfidencePart.ExplicitConnection);
                            returnList.Add(junk);
                        }
                    }
                }
            }

            return(returnList);
        }
Example #5
0
        private IEnumerable <JunkNode> ScanEventLogs()
        {
            if (string.IsNullOrEmpty(Uninstaller.InstallLocation))
            {
                yield break;
            }

            using (var key = Registry.LocalMachine.OpenSubKey(
                       @"SYSTEM\CurrentControlSet\Services\EventLog\Application"))
            {
                if (key == null)
                {
                    yield break;
                }

                var query = from name in key.GetSubKeyNames()
                            let m = MatchStringToProductName(name)
                                    where m >= 0 && m < 3
                                    //orderby m ascending
                                    select name;

                foreach (var result in query)
                {
                    using (var subkey = key.OpenSubKey(result))
                    {
                        var exePath = subkey?.GetValue("EventMessageFile") as string;
                        if (string.IsNullOrEmpty(exePath) || !TestPathsMatchExe(exePath))
                        {
                            continue;
                        }

                        var node = new RegistryKeyJunkNode(key.Name, result, Uninstaller.DisplayName);
                        // Already matched names above
                        node.Confidence.Add(ConfidencePart.ProductNamePerfectMatch);

                        if (OtherUninstallers.Any(x => TestPathsMatch(x.InstallLocation, Path.GetDirectoryName(exePath))))
                        {
                            node.Confidence.Add(ConfidencePart.DirectoryStillUsed);
                        }

                        yield return(node);
                    }
                }
            }
        }
Example #6
0
        private IEnumerable <JunkNode> ScanClsid()
        {
            var results = new List <JunkNode>();

            foreach (var keyName in ClsidKeys)
            {
                using (var key = RegistryTools.OpenRegistryKey(keyName))
                {
                    if (key == null)
                    {
                        continue;
                    }

                    string[] subKeyNames;
                    try
                    {
                        subKeyNames = key.GetSubKeyNames();
                    }
                    catch (Exception ex)
                    {
                        Console.WriteLine(ex);
                        continue;
                    }

                    foreach (var x in subKeyNames)
                    {
                        var         subKeyName = x.TrimEnd('\"'); // For some reason GetSubKeyNames puts quotes at end sometimes
                        RegistryKey subKey     = null;

                        try
                        {
                            subKey = key.OpenSubKey(Path.Combine(subKeyName, "InprocServer32"));
                            var path = subKey?.GetValue(null) as string;

                            if (string.IsNullOrEmpty(path))
                            {
                                continue;
                            }

                            path = Environment.ExpandEnvironmentVariables(path).Trim('\"');

                            if (!Path.IsPathRooted(path) || TestPathsMatch(WindowsDirectory, path))
                            {
                                continue;
                            }

                            if (TestPathsMatchExe(path))
                            {
                                var node = new RegistryKeyJunkNode(keyName, subKeyName, Uninstaller.DisplayName);
                                node.Confidence.Add(ConfidencePart.ExplicitConnection);
                                results.Add(node);
                            }
                        }
                        catch
                        {
                            // TODO better handling?
                        }
                        finally
                        {
                            subKey?.Close();
                        }
                    }
                }
            }

            return(results);
        }
Example #7
0
        private IEnumerable <JunkNode> FindJunkRecursively(RegistryKey softwareKey, int level = -1)
        {
            var returnList = new List <JunkNode>();

            try
            {
                // Don't try to scan root keys
                if (level > -1)
                {
                    var keyName    = Path.GetFileName(softwareKey.Name);
                    var keyDir     = Path.GetDirectoryName(softwareKey.Name);
                    var confidence = GenerateConfidence(keyName, keyDir, level).ToList();

                    // Check if application's location is explicitly mentioned in any of the values
                    if (GetValueNamesSafe(softwareKey).Any(valueName => TestValueForMatches(softwareKey, valueName)))
                    {
                        confidence.Add(ConfidencePart.ExplicitConnection);
                    }

                    if (confidence.Any())
                    {
                        // TODO Add extra confidence if the key is, or will be empty after junk removal
                        var newNode = new RegistryKeyJunkNode(keyDir, keyName, Uninstaller.DisplayName);
                        newNode.Confidence.AddRange(confidence);
                        returnList.Add(newNode);
                    }
                }

                // Limit recursion depth
                if (level <= 1)
                {
                    foreach (var subKeyName in softwareKey.GetSubKeyNames())
                    {
                        if (KeyBlacklist.Contains(subKeyName, StringComparison.InvariantCultureIgnoreCase))
                        {
                            continue;
                        }

                        using (var subKey = softwareKey.OpenSubKey(subKeyName, false))
                        {
                            if (subKey != null)
                            {
                                returnList.AddRange(FindJunkRecursively(subKey, level + 1));
                            }
                        }
                    }
                }
            }
            // Reg key invalid
            catch (ArgumentException)
            {
            }
            catch (SecurityException)
            {
            }
            catch (ObjectDisposedException)
            {
            }

            return(returnList);
        }