PE Builder v3 plugin

# RunScanner Plugin

This is a pebuilder plugin for the RunScanner registry redirector plugin developed by Paraglider. It is used for launching spy ware detector programs and has been tested with WebRoots SpySweeper and LavaSoft Ad-Aware. Unfortunately it does not appear to work with Spybot

By default on startup the program will scan all drives looking for boot.ini files. The directory of the windows installation will be found from the default entry in any found boot.ini files. It will be assumed to be on the same drive as the boot.ini file. If multiple such directories are found then you will be prompted to choose one of them. If only one is found then that will be assumed to hold the registry hives. If none are found then you will be prompted to select a directory from the list of drives. Finally you will be asked if you want to load a user profile. If so a list of user directories will be shown and you will need to select the ntuser.dat file from the appropriate user. See below for the parameter options that allow the default behavior to be overridden.

After the registry hives have been loaded the selected program will be launched and the RunScannerDLL dll will be attached to the process. After the default timeout of 10 seconds all registry access will be redirected to the loaded hives as appropriate. The timeout period is to allow the application to initialize using the Bart PE registry. Webroot Spysweeper appears to be very sensitive to this timeout period. Without it the program either crashed or was inoperative.

The program is launched as follows:

    RunScanner {/ac}
               {/cp}
               {/d}
    	   {/m}
               {/m+}
               {/max}
    	   {/n}
    	   {/ns}
               {/s}
               {/sd}
               {/sv}
               {/t <timeout>}
    	   {/q}
               {/u <User Profile registry hive>}
               {/v}
               {/w <windows directory>}
               {/x}
               {/y}
               <Program To Launch>

If /ac is specified then if only one real user profile is found then this will automatically set to the HKCU hive without showing the select user dialog.

If /cp is specified then any processes launched directly by the target process will have their registry redirected.

If /d is specified then debug information will be output from the target process.

If /m is specified then after prompting for a user profile then a multiple selection dialog is shown which allows any or all of the remaining user profiles to be loaded. Note that its first user profile selected to which the HKCU registry access is redirected. There is only any point in using this option for Spyware programs like ad-aware se that scans all user profiles loaded in the HKEY_USERS key.

If /m+ is specified then after prompting for a user profile which is used for the redirection of HKCU then all remaining remote user profiles are loaded.

If /max is specified the target process is run maximized.

If /n is specified then the controlled program will be launched without asking for a user profile.

If /ns is specified then if the boot drive is not the drive containing runscanner then the target program will be executed without registry redirection.

If /s is specified then the automatic scanning for boot.ini files will be suppressed and the program will present a dialog asking for the windows installation directory to be selected.

If /sd is specified then scan all root directories on all drives looking for windows installations.

If /sv is specified then use bcdedit.exe to scan vista boot manager files for windows installations.

If /t is specified then this allows the default timeout of 10 seconds to be overridden. The value is the timeout in milliseconds.

If /q is specified then runscanner will ask if you want to load the remote registry before it attempts to do so. If you respond no then the target program will be launched without registry redirection.

If /u is specified then this allows the full path of the user registry hive to be specified. This will suppress the dialogs asking for the file to be chosen.

If /v is specified then when the timeout period expires all environment variables from the target registry are set to the environment of the target process.

If /w is specified then this allows the full path of the windows directory to be specified. This will suppress the dialog asking for the directory to be chosen.

If /x is specified then in the ExpandEnvironmentStrings intercept if the string starts with <driveletter>: the drive letter is replaced with the drive letter that corresponds to the drive letter it would have used in the target OS. Also if the string starts with a relative path or no drive information then the path is expanded to make the path relative to the target windows directory. This is mainly to fix problems with the Sysinternals autoruns program. It is entirely possible this option could cause program crashes or other strange behaviour with other programs.

If /y is specified then the dialog asking for the user profile registry hive to be selected will be presented without asking the question if you want to load the hive.

Note that for the /t, /u and /w parameters that one of more spaces can separate the option and the option value. If the option value contains spaces then it should be enclosed in double quotes.

Example use:

RunScanner /t 5000 /u "C:\Documents and Settings\Administrator\NTUSER.DAT" /w c:\windows Ad-Aware.exe

Runscanner also allows other options to be specified via the BartPE registry. The following registry settings are currently supported:

    [Software.AddReg]
    0x1,"Paraglider\RunScanner","Software","%s_ON_%c"
    0x1,"Paraglider\RunScanner","System","%s_ON_%c"
    0x1,"Paraglider\RunScanner","Security","%s_ON_%c"
    0x1,"Paraglider\RunScanner","Sam","%s_ON_%c"
    0x1,"Paraglider\RunScanner","Default","%s_ON_%c"
    0x1,"Paraglider\RunScanner","User0","%s_ON_%c"
    0x1,"Paraglider\RunScanner","User1","%s_ON_%c"
    0x1,"Paraglider\RunScanner","User2","%s_ON_%c"
    0x1,"Paraglider\RunScanner","User3","%s_ON_%c"

The following control what registry keys do not get redirected for a particular target program ::

    [Software.AddReg]
    0x1, "Paraglider\RunScanner\<Program Name>", _
         "HKCU","<Registry Key 0>"
    0x1, "Paraglider\RunScanner\<Program Name>", _
         "HKLM","<Registry Key 0>"

    0x1, "Paraglider\RunScanner\<Program Name>\HKLM", _
         "<Registry Key 0>",""

    ...

    0x1, "Paraglider\RunScanner\<Program Name>\HKLM", _
         "<Registy Key N>",""

    0x1, "Paraglider\RunScanner\<Program Name>\HKCR", _
         "<Registry Key 0>",""

    ...

    0x1, "Paraglider\RunScanner\<Program Name>\HKCR", _
         "<Registy Key N>",""

The following is how you could stop SpySweeper registry settings being updated in the target registry:

0x1,"Paraglider\RunScanner\SpySweeper.exe","HKCU","Software\WebRoot"
0x1,"Paraglider\RunScanner\SpySweeper.exe","HKLM","Software\WebRoot"
and / or
0x1,"Paraglider\RunScanner\SpySweeper.exe\HKLM","Software\WebRoot",""
0x1,"Paraglider\RunScanner\SpySweeper.exe\HKLM", _
"`System\CurrentControlSet\Services\svcWRSSSDK",""`

Thus this specifies that the registry keys:

1) HKEY_LOCAL_MACHINE\Software\WebRoot
2) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\svcWRSSSDK
3) HKEY_CURRENT_USER\Software\WebRoot will not be redirected for SpySweeper.exe

The registry values directly under RunScanner allow the names of the loaded registry hives to be renamed. All these values are optional. If the value is specified then it defines the format of the name of the loaded registry hive. Each format can have up to two substitution values %s and or %c ( must be lower case).

- %s is replaced with the hive type ( SOFTWARE, SYSTEM, SECURITY, SAM, DEFAULT or <User Name 0> ..... <User Name N> ).
- %c is replaced with the drive letter of the hive file.

The default value for any format is %s_ON_%c e.g. for the remote software hive this will be SOFTWARE_ON_E. Thus if you wanted to load the remote software hive into a hive named FRED then you would define the registry value:

`[HKEY_LOCAL_MACHINE\SOFTWARE\Paraglider\RunScanner]
"Software"="FRED"
`

If you wanted to load it as "DRIVE_C_SOFTWARE" then you would use "DRIVE_%c_%s" etc.

Each controlled program also has the option to allow a specified registry key and its sub keys to not be redirected to the remote hive. You are allowed to specify one HKEY_LOCAL_MACHINE key and one HKEY_CURRENT_USER key to not be redirected. The program name ( including extension ) is used to select the registry values used to control this feature.

The HKLM value defines the key in HKEY_LOCAL_MACHINE that is not redirected.

The HKCU value defines the key in HKEY_CURRENT_USER that is not redirected.

If its required to override multiple HKLM keys then the HKLM subkey of the program subkey can be used to list the names of the sub keys that will not be redirected. The value name is the name of the subkey not to be redirected. If the HKLM sub-key is used then these values replace any redirection exception specified in the HKLM value.

Some programs start a service. As the runscanner debugger is not notified when a service starts then its not normally possible to redirect the registry for the service. A new facility is now available to monitor one specified service for starting and attach the redirection dll to that service when the service starts. This is configured by the following registry key:

`[HKEY_LOCAL_MACHINE\SOFTWARE\Paraglider\RunScanner\<Program Name>]
"Monitor"="<Service Name>"`

Note that <Service Name> is the name of the program that appears in the Performance manager which is probably the same as the name of the program that appears in TAsk Manager without the file extension.

Note that this mechanism does not work correctly with SpySweeper 4.0. The registry is redirected but the service does not work correctly - you get an error reported from SpySweeper when a scan is attempted. If it did work then it would be configured as follows:

`[HKEY_LOCAL_MACHINE\SOFTWARE\Paraglider\RunScanner\SpySweeper.exe]
"Monitor"="WRSSSDK"`

Copyright (c) 2008 Paraglider. All rights reserved.

PE Builder Copyright (c) 2002-2003 Bart Lagerweij. All rights reserved.