) Registry Reader

Write common registry reading programs and view several registry items that I am very concerned about.

The following table lists the registry items that a virus accesses.

HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ runonce
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ runonce
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ runonceex
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon

Compiled in VC ++ SP6 and Windows XP SP1.

The querykey function is used to enumerate subkeys. queryvalue is used to enumerate the key values of each subkey,

M_listvalue is a ListBox control.

The Code is as follows:

Void cautorunreaderdlg: querykey (hkey)
{
Char achkey [max_path] = "";
Lptstr lpname = achkey;
Char achclass [max_path] = "";
Lptstr lpclass = achclass;
Filetime ftlastwritetime;
DWORD dwindex = 0;
DWORD lpcname = max_path;
DWORD lpcclass = max_path;
DWORD I = 0;
DWORD retcode;
// Cstring strtemp;
Setcursor (loadcursor (null, idc_wait ));
Retcode = error_success;
Do
{
Retcode = regenumkeyex (
Hkey,
Dwindex,
Lpname,
& Amp; lpcname,
Null,
Lpclass,
& Lpcclass,
& Ftlastwritetime );
If (retcode = (DWORD) error_success)
{
M_listvalue.addstring (lpname );
}
If (retcode = (DWORD) error_invalid_handle)
{
Setcursor (loadcursor (null, idc_arrow ));
M_listvalue.addstring ("invalid handle ");
Return;
}
Dwindex ++;
Lpcname = max_path; // You must reconfigure the buffer size for each loop. Otherwise, an error occurs.
Lpcclass = max_path;
} While (error_no_more_items! = Retcode );
Setcursor (loadcursor (null, idc_arrow ));
}

Void cautorunreaderdlg: queryvalue (hkey)
{
Char valuename [max_path] = "";
Lptstr lpvaluename = valuename;
Byte lpdata [max_path];
 
// Filetime ftlastwritetime;
DWORD dwindex = 0;
DWORD lpcvaluename = max_path;
DWORD lpcbdata = max_path;
DWORD lptype;
DWORD retcode;
Cstring strtemp;
Cstring strtypename;
Setcursor (loadcursor (null, idc_wait ));
Retcode = error_success;
Do
{
Retcode = regenumvalue (
Hkey,
Dwindex,
Lpvaluename,
& Amp; lpcvaluename,
Null,
& Lptype,
Lpdata,
& Amp; lpcbdata );
If (retcode = (DWORD) error_success)
{
Switch (lptype)
{
Case REG_BINARY:
Strtypename = "REG_BINARY ";
Break;
Case REG_DWORD:
Strtypename = "REG_DWORD ";
Break;
/*
Case reg_dword_little_endian:
Strtypename = "reg_dword_little_endian ";
Break;
*/
Case reg_dword_big_endian:
Strtypename = "reg_dword_big_endian ";
Break;
Case REG_EXPAND_SZ:
Strtypename = "reg_expand_sz ";
Break;
Case reg_link:
Strtypename = "reg_link ";
Break;
Case reg_multi_sz:
Strtypename = "reg_multi_sz ";
Break;
Case reg_none:
Strtypename = "reg_none ";
Break;
/*
Case reg_qword:
Strtypename = "reg_qword ";
Break;
Case reg_qword_little_endian:
Strtypename = "reg_qword_little_endian ";
Break;
*/
Case REG_SZ:
Strtypename = "REG_SZ ";
Break;
Default:
Strtypename = "unknown type ";
Break;
}
Strtemp. Format ("% s = % s, % s = % d", lpvaluename, lpdata, strtypename, lptype );
M_listvalue.addstring (strtemp );
}
If (retcode = (DWORD) error_invalid_handle)
{
Setcursor (loadcursor (null, idc_arrow ));
M_listvalue.addstring ("invalid handle ");
Return;
}
Dwindex ++;
Lpcvaluename = max_path; // You must reconfigure the buffer size for each loop. Otherwise, an error occurs.
Lpcbdata = max_path;
} While (error_no_more_items! = Retcode );
Setcursor (loadcursor (null, idc_arrow ));
}