function fred_report_info() { var info={report_cat : "SOFTWARE", report_name : "Autoruns", report_author : "Gillen Daniel", report_desc : "Dump autoruns", fred_api : 2, hive : "SOFTWARE" }; return info; } var table_style = "border-collapse:collapse; margin-left:20px; font-family:arial; font-size:12"; var cell_style = "border:1px solid #888888; padding:5; white-space:nowrap;"; function IsValid(val) { return (typeof val!=='undefined'); } function PrintTableHeaderCell(str) { println(" ",str,""); } function PrintTableDataCell(alignment,str) { var style=cell_style+" text-align:"+alignment+";"; println(" ",str,""); } function PrintTableDataRowSpanCell(alignment,rows,str) { var style=cell_style+" text-align: "+alignment+";"; println(" ",str,""); } function PrintTableDataColSpanCell(alignment,columns,str) { var style=cell_style+" text-align: "+alignment+";"; println(" ",str,""); } function ListAutoruns(autorun_path,autorun_key) { var run_keys=GetRegistryKeys(autorun_path+autorun_key); if(IsValid(run_keys) && run_keys.length>0) { for(var i=0;i"); if(i==0) PrintTableDataRowSpanCell("left",run_keys.length,autorun_key); PrintTableDataCell("left",run_keys[i]); PrintTableDataCell("left",RegistryKeyValueToString(val.value,val.type)); println(" "); } } else { println(" "); PrintTableDataCell("left",autorun_key); PrintTableDataColSpanCell("center",2,"None"); println(" "); } } function fred_report_html() { var val; println("

System Autoruns

"); println("

"); println(" "); println(" "); PrintTableHeaderCell("Registry key"); PrintTableHeaderCell("Name"); PrintTableHeaderCell("Executable"); println(" "); // Run ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","Run"); // RunOnce ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","RunOnce"); // RunOnceEx ListAutoruns("\\Microsoft\\Windows\\CurrentVersion\\","RunOnceEx"); // TODO: There might be a Run under WindowsNT\CurrentVersion\Run too! println("
"); println("

"); }