#125409 - 2004-08-21 12:06 AM
READVALUE Problem
|
JTT
Fresh Scripter
Registered: 2002-10-14
Posts: 32
Loc: Utah
|
I've been playing with Kix for about a year mainly for logon scripts and I've slowly been playing with other code to read and write to the registry. Mainly to help battle virus outbreaks.
I've been trying to write a script that will read a registry key, and if it exists copy down the symantec removal tool from the server and run it. I can do everything but the READVALUE will not read the string registry type, only the DWORD.
My script that does the read is as follows:
$VIRI = ReadValue("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" ,"drvddll.exe")
I test this by simulating the registry key, but the only data type I've been able to get work is the DWORD. Is there something I'm not seening in the command reference on the site or in the manual that I need to have to read string keys?
Thanks for any help in advance...
JTT
|
|
Top
|
|
|
|
#125416 - 2004-08-22 05:03 PM
Re: READVALUE Problem
|
Kdyer
KiX Supporter
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Using the var $VIRI does not sit right with me (IMHO).. I know that is what you are trying to target.. Just trying to out-think the virus authors..
Kent
|
|
Top
|
|
|
|
|
#125417 - 2004-08-26 09:02 PM
Re: READVALUE Problem
|
JTT
Fresh Scripter
Registered: 2002-10-14
Posts: 32
Loc: Utah
|
Les-
You are right it has something to do with the way that I'm using the returned variable. If I run the code the way you've presented it I do get the value returned to me.
I also relized that I'm wanting the EXISTKEY function and not the readvalue, because I simply want to know if the key exists and if it does run the subroutine. So if I understand the command reference correctly I should only need to do the following:
$BVC = ExistKey("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\drdvdll.exe")
If $BVC = 0
? "Key exists...."
Endif
|
|
Top
|
|
|
|
|
#125420 - 2004-08-26 09:39 PM
Re: READVALUE Problem
|
JTT
Fresh Scripter
Registered: 2002-10-14
Posts: 32
Loc: Utah
|
Les-
Actually I do know my keys from my values. The virus puts the subkey "drvddll.exe" under the run, the value of the subkey is actually "%System%\drvddll.exe".
|
|
Top
|
|
|
|
|
#125421 - 2004-08-26 09:41 PM
Re: READVALUE Problem
|
JTT
Fresh Scripter
Registered: 2002-10-14
Posts: 32
Loc: Utah
|
I have it working with this simple code to check to see if it exists:
$BVC = KeyExist("\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\drdvdll.exe")
If $BVC = 0
RUN Subroutine
ENDIF
Edited by JTT (2004-08-26 09:53 PM)
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 1046 anonymous users online.
|
|
|
