This is an example script and DOES NOT include all methods of how applications or processes start up on Windows.

Since there is COLOR output, it is designed to be run from a CONSOLE window with KIX32.EXE , however the script could easily be modified to remove the color commands and write this data to a log file, or add other vars to make decisions based upon the findings.



Code:

Break On

Dim $SO

$SO=SetOption('Explicit','On')

$SO=SetOption('NoVarsInStrings','On')

$SO=SetOption('WrapAtEOL','On')



; Declare variables 

Dim $HKLMR,$HKCUR,$HKLMRDATA,$HKCURDATA,$Entry,$HKLMRApp,$HKCURApp

$HKLMR='HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

$HKCUR='HKCU\Software\Microsoft\Windows\CurrentVersion\Run'

; Assign return from ArrayEnumValue UDF to variable, once for HKLM and once for HKCU

; This will enumerate all the keys under the given location for other sub-keys

$HKLMRDATA=ArrayEnumValue($HKLMR)

$HKCURDATA=ArrayEnumValue($HKCUR)

  

; Set the forground color to WHITE and the background color to LIGHT RED

COLOR 'w+/r+'



? '***********************************************************************'

? '* [ HK Local Machine Software Microsoft Windows Current Version Run ] *'

? '***********************************************************************'





; Set the forground color to YELLOW and the background color to BLACK

COLOR 'y+/n'

; Check the array $HKLMRDATA and for each item in the array if not blank, Read the registry and assign the return to a variable

For Each $Entry In $HKLMRDATA

	If $Entry

		; Read the value of each of the entries for applications, etc...

		$HKLMRApp = ReadValue($HKLMR,$Entry)

		? 'Path for HKLMR ' + $Entry + ' is: ' + $HKLMRApp

	EndIf

Next

  

; Set the forground color to WHITE and the background color to DARK BLUE

COLOR 'w+/b'



?

? '**********************************************************************'

? '* [ HK Current User Software Microsoft Windows Current Version Run ] *'

? '**********************************************************************'





; Set the forground color to YELLOW and the background color to BLACK

COLOR 'y+/n'

; Check the array $HKCURDATA and for each item in the array if not blank, Read the registry and assign the return to a variable

For Each $Entry In $HKCURDATA

	If $Entry

		$HKCURApp = ReadValue($HKCUR,$Entry)

		? 'Path for HKCUR ' + $Entry + ' is: ' + $HKCURApp

	EndIf

Next

 

; UDF written by Jens 

Function ArrayEnumValue($regsubkey)

  dim $retcode, $valuecounter, $currentvalue, $valuearray

  if not keyexist($regsubkey)

    exit 87

  endif

  $valuecounter=0

  do

    $currentvalue=enumvalue($regsubkey,$valuecounter)

    if not @ERROR

      redim preserve $valuearray[$valuecounter]

      $valuearray[$valuecounter]=$currentvalue

      $valuecounter=$valuecounter+1

    endif

  until @ERROR

  $arrayenumvalue=$valuearray

  exit 0

EndFunction