Windows NT Server Resource Kit includes ScanReg.exe
which can scan the local or remote registries for strings in key names,
value names, or data. This can be very helpful. As a commandline utility, it has
potential in login scripts – for example, to scan for the telltale sign of virus
scanning or unapproved hacks. The help from ScanReg :
usage:
scanreg 1.05 <[-s] string> < [-k] [-v] [-d] > [[-r] key] [-c] [-e] [-n]
-s string to search for
-r root key to start search from (default = HKEY_CURRENT_USER)
root key can be abbreviated as follows :
HKEY_LOCAL_MACHINE – lm
HKEY_CURRENT_USER – cu
HKEY_CLASSES_ROOT – cr
HKEY_USERS – us
-k search keynames (NB : must specify at least one of -k -v or -d)
-v search valuenames
-d search data
-c search case sensitive (default : case INsensitive)
-e return only exact match (default : return all matches)
-n no color in output (default : keys red, values green, data yellow)
Examples: SCANREG -s Windows -k -v -d
SCANREG -s Windows -kvd
SCANREG /s Windows /r \lm\software /kvde
SCANREG Windows \lm -kd -n
SCANREG Windows \\MOON\HKEY_LOCAL_MACHINE -d
SCANREG Windows HKEY_CURRENT_USER\software -kvd
Experiment with scanreg. It has great potential. Use the above help syntax as
a starting point.
