Const HKEY_LOCAL_MACHINE = &H80000002
Const REG_EXPAND_SZ = 2
strComputer = "." ' Use . for current machine
hDefKey = HKEY_LOCAL_MACHINE
strKeyPath = "SYSTEM\CurrentControlSet\Services"
On Error Resume Next
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
oReg.EnumKey hDefKey, strKeyPath, arrSubKeys
For Each strSubkey In arrSubKeys
strSubKeyPath = strKeyPath & "\" & strSubkey
oReg.EnumValues hDefKey, strSubKeyPath, arrValueNames, arrTypes
For i = LBound(arrValueNames) To UBound(arrValueNames)
strValueName = arrValueNames(i)
Select Case arrTypes(i)
Case REG_EXPAND_SZ
oReg.GetStringValue hDefKey, strSubKeyPath, strValueName, strValue
If InStr(1, strValue, Chr(34), 1) = 0 Then
strValueTemp = Chr(34) & strValue
wscript.echo " " & strValueName & " (REG_EXPAND_SZ) = " & strValueTemp
End IF
End Select
Next
Next
This code outputs these strings:
ImagePath (REG_EXPAND_SZ) = "C:\Windows\system32\svchost.exe -k netsvcs -p
ImagePath (REG_EXPAND_SZ) = "C:\Windows\system32\svchost.exe -k netsvcs -p
ImagePath (REG_EXPAND_SZ) = "\SystemRoot\System32\drivers\xboxgip.sys
How could I add another quote to each string at the point where the string has .exe or .sys providing this output.
ImagePath (REG_EXPAND_SZ) = "C:\Windows\system32\svchost.exe" -k netsvcs -p
ImagePath (REG_EXPAND_SZ) = "C:\Windows\system32\svchost.exe" -k netsvcs -p
ImagePath (REG_EXPAND_SZ) = "\SystemRoot\System32\drivers\xboxgip.sys"
This code is to apply fix to a Windows Security flaw.