-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathSearchRegistry.ps1
47 lines (40 loc) · 1.63 KB
/
SearchRegistry.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
# Function to search for the token "uvlig" in the registry
function Search-RegistryForToken {
param (
[string]$token = "uvlig",
[string]$newToken = "uvzen"
)
$hives = "HKLM", "HKCU", "HKCR", "HKU", "HKCC"
foreach ($hive in $hives) {
Write-Host "Searching in $hive..."
# Searching keys, values, and data for the token
Get-ChildItem "Registry::$hive" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
try {
$key = $_.PSPath
Write-Host "`r$key" -ForegroundColor green -NoNewLine
if ($key -match "CLasses") {
continue # Skip this iteration
}
# Search in the name and data of each registry entry
$entries = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
foreach ($entry in $entries.PSObject.Properties) {
if ($entry.Name -like "*$token*" -or $entry.Value -like "*$token*") {
Write-Host "`r"
Write-Host "Found $token in $key -> $($entry.Name): $($entry.Value)" -ForegroundColor red
if (false) {
# Replace the old token with the new one
$newValue = $entry.Value -replace $oldToken, $newToken
Set-ItemProperty -Path $path -Name $entry.Name -Value $newValue
Write-Host "Replaced $oldToken with $newToken in $path -> $($entry.Name)"
}
}
}
} catch {
# Handle access denied errors or other exceptions
Write-Host "Error accessing $key"
}
}
}
}
# Call the function
Search-RegistryForToken "uvlig"