#region Using directives using System; using System.IO; using System.Text; using Microsoft.Win32; #endregion namespace CleanUpMRU { class CleanUpMRUWin2000 : Object { const string Version = "1.0.0.4"; //HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\* private void CleanMalware(ref FileStream stream) { string REGISTRY_PREFIX = @"Software\Igor V. Gunko"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey0; try { MyKey0 = hklm.OpenSubKey(REGISTRY_PREFIX, true); if (null != MyKey0) { hklm.DeleteSubKeyTree(REGISTRY_PREFIX); } } catch (Exception e) { Console.WriteLine("in CleanMalware, Exception caught " + e.ToString()); } } private void CleanExplorer(ref FileStream stream) { string REGISTRY_PREFIX = @"Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey0; MyKey0 = hklm.OpenSubKey(REGISTRY_PREFIX, true); if (null != MyKey0) { string[] subKeys = MyKey0.GetSubKeyNames(); //MyKey0.DeleteSubKeyTree(); RegistryKey MyKey1; foreach (string si in subKeys) { string REGISTRY_PATH = REGISTRY_PREFIX + "\\" + si; MyKey1 = MyKey0.OpenSubKey(si, true); if (null != MyKey1) { string output = ("[" + "HKEY_CURRENT_USER\\" + REGISTRY_PATH + "]"); if (null != stream) { StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } string[] strs = MyKey1.GetValueNames(); foreach (string s in strs) { if (null != stream) { StreamWriter writer = new StreamWriter(stream); if (RegistryValueKind.Binary == MyKey1.GetValueKind(s)) output = ("\"" + s + "\"=hex:" + MyKey1.GetValue(s).ToString()); else if (RegistryValueKind.DWord == MyKey1.GetValueKind(s)) output = ("\"" + s + "\"=dword:" + MyKey1.GetValue(s).ToString()); else if (RegistryValueKind.ExpandString == MyKey1.GetValueKind( s )) { string keyVal = MyKey1.GetValue( s ).ToString( ); output = ("\"" + s + "\"=hex(2):" ); short bVal; int j = 0; for (; j < keyVal.Length - 1; j++) { bVal = (short)keyVal[j]; output += bVal.ToString("%2x") +","; } bVal = (short)keyVal[j]; output += bVal.ToString( "%2x" ); } else output = ("\"" + s + "\"=\"" + MyKey1.GetValue( s ).ToString( ) + "\""); writer.WriteLine(output); writer.Flush(); } try { MyKey1.SetValue(s, 0, MyKey1.GetValueKind(s)); } catch (ArgumentException) { Console.WriteLine("cannot modify key " + s + "in reg"); MyKey1.DeleteValue(s, false); //MyKey.SetValue( s, 0, RegistryValueKind.Binary); } } MyKey1.Close(); } } } } private void CleanMSVC( ref FileStream stream ) { try { string REGISTRY_PREFIX = @"Software\Microsoft\VisualStudio\8.0\FileMRUList"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey0; MyKey0 = hklm.OpenSubKey( REGISTRY_PREFIX , true ); if (null != MyKey0) { string[] subKeys = MyKey0.GetValueNames( ); string output = ("[" + "HKEY_CURRENT_USER\\" + REGISTRY_PREFIX + "]"); if (null != stream) { StreamWriter writer = new StreamWriter( stream ); writer.WriteLine( output ); writer.Flush( ); } foreach (string si in subKeys) { //string REGISTRY_PATH = REGISTRY_PREFIX + "\\" + si; RegistryValueKind valKind = MyKey0.GetValueKind( si ); Object MyKey1 = MyKey0.GetValue( si , valKind ); if (null != MyKey1) { string keyVal = MyKey1.ToString( ); if (null != stream) { StreamWriter writer = new StreamWriter( stream ); if (RegistryValueKind.Binary == valKind) output = ("\"" + keyVal + "\"=hex:" + MyKey1.ToString( )); else if (RegistryValueKind.DWord == valKind) output = ("\"" + keyVal + "\"=dword:" + MyKey1.ToString( )); else if (RegistryValueKind.ExpandString == valKind) { output = ("\"" + keyVal + "\"=hex(2):"); uint bVal; int j = 0; for (; j < keyVal.Length - 1; j++) { bVal = System.Convert.ToUInt32( keyVal[j].ToString(), 16 ); output += bVal.ToString( "0" ) + ",00,"; } bVal = System.Convert.ToUInt32( keyVal[j].ToString( ) , 16 ); output += bVal.ToString( "0" ) + ",00" + ",00" + ",00"; } else output = ("\"" + keyVal + "\"=\"" + keyVal + "\""); writer.WriteLine( output ); } try { MyKey0.SetValue( keyVal , (object)null , MyKey0.GetValueKind( keyVal ) ); } catch (Exception) { Console.WriteLine( "cannot modify key " + MyKey0.ToString( ) + " name=" + si + " in registry!" ); MyKey0.DeleteValue( keyVal , false ); //MyKey.SetValue( s, 0, RegistryValueKind.Binary); } //MyKey1.Close( ); } } } } catch (Exception e) { Console.WriteLine( "in CleanAll, Exception caught " + e.ToString( ) ); } } private void CleanWordPad(ref FileStream stream) { // Windows Media Player string REGISTRY_PATH = @"Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey; MyKey = hklm.OpenSubKey(REGISTRY_PATH, true); if (null != MyKey) { if (null != stream) { string output = ("[" + "HKEY_CURRENT_USER\\" + REGISTRY_PATH + "]"); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } string[] strs = MyKey.GetValueNames(); foreach (string s in strs) { if (null != stream) { string output = ("\"" + s + "\"=\"" + MyKey.GetValue(s).ToString()+"\""); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } MyKey.SetValue( s, ""); } MyKey.Close(); } } private void CleanAdobeReader6(ref FileStream stream) { string REGISTRY_PREFIX = @"Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey; for (int i = 1; i <= 4;i++ ) { string si = i.ToString(); string REGISTRY_PATH = REGISTRY_PREFIX + si; MyKey = hklm.OpenSubKey( REGISTRY_PATH, true); if (null != MyKey) { string[] strs = MyKey.GetValueNames(); foreach (string s in strs) { if (null != stream) { string output = ("[" + "HKEY_CURRENT_USER\\" + REGISTRY_PATH + "]"); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); if ( RegistryValueKind.Binary == MyKey.GetValueKind(s)) output = ("\"" + s + "\"=hex:" + MyKey.GetValue(s).ToString()); else if ( RegistryValueKind.DWord==MyKey.GetValueKind(s)) output = ("\"" + s + "\"=dword:" + MyKey.GetValue(s).ToString()); else output = ("\"" + s + "\"=\"" + MyKey.GetValue(s).ToString() + "\""); writer.WriteLine( output); writer.Flush(); } try { MyKey.SetValue( s, 0, RegistryValueKind.Binary); } catch (ArgumentException) { Console.WriteLine("cannot modify key "+s+"in reg"); MyKey.DeleteValue(s, false); //MyKey.SetValue( s, 0, RegistryValueKind.Binary); } } MyKey.Close(); } } } private void CleanIEMRU(ref FileStream stream) { // Windows Media Player string REGISTRY_PATH = @"Software\Microsoft\Internet Explorer\TypedURLs"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey; MyKey = hklm.OpenSubKey(REGISTRY_PATH, true); if (null != MyKey) { if (null != stream) { string output = ("[" + "HKEY_CURRENT_USER\\" + REGISTRY_PATH + "]"); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } string[] strs = MyKey.GetValueNames(); foreach (string s in strs) { if (null != stream) { string output = ("\"" + s + "\"=\"" + MyKey.GetValue(s).ToString() + "\""); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } MyKey.SetValue(s, ""); } MyKey.Close(); } } private void CleanYahoo(ref FileStream stream) { string REGISTRY_PATH = @"Software\Yahoo\Companion\SearchHistory"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey; MyKey = hklm.OpenSubKey(REGISTRY_PATH, true); if (null != MyKey) { if (null != stream) { string output = ("[" + hklm.ToString()+ "\\" + REGISTRY_PATH + "]"); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } string[] strs = MyKey.GetValueNames(); foreach (string s in strs) { if (null != stream) { string output = ("\"" + s + "\"=\""+ MyKey.GetValue(s).ToString() + "\""); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } MyKey.SetValue(s, ""); } MyKey.Close(); } } private void CleanMSMediaPlayerMRU(ref FileStream stream) { // Windows Media Player string REGISTRY_PATH = @"Software\Microsoft\MediaPlayer\Player\RecentFileList"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey; MyKey = hklm.OpenSubKey(REGISTRY_PATH, true); if (null != MyKey) { if (null != stream) { string output = ("[" + "HKEY_CURRENT_USER\\" + REGISTRY_PATH + "]"); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } string[] strs = MyKey.GetValueNames(); foreach (string s in strs) { if (null != stream) { string output = ("\"" + s + "\"=\"" + MyKey.GetValue(s).ToString() + "\""); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } MyKey.SetValue(s, ""); } MyKey.Close(); } } private void CleanMSMediaPlayerURL(ref FileStream stream) { // Windows Media Player string REGISTRY_PATH = @"Software\Microsoft\MediaPlayer\Player\RecentURLList"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey; MyKey = hklm.OpenSubKey(REGISTRY_PATH, true); if (null != MyKey) { if (null != stream) { string output = ("[" + "HKEY_CURRENT_USER\\" + REGISTRY_PATH + "]"); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } string[] strs = MyKey.GetValueNames(); foreach (string s in strs) { if (null != stream) { string output = ("\"" + s + "\"=\"" + MyKey.GetValue(s).ToString() + "\""); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } MyKey.SetValue(s, ""); } MyKey.Close(); } } private void CleanMSMediaPlayerSet(ref FileStream stream) { // Windows Media Player string REGISTRY_PATH = @"Software\Microsoft\MediaPlayer\Player\Settings"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey; MyKey = hklm.OpenSubKey(REGISTRY_PATH, true); if (null != MyKey) { if (null != stream) { string output = ("[" + "HKEY_CURRENT_USER\\" + REGISTRY_PATH + "]"); StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); writer.Flush(); } MyKey.SetValue("OpenDir", @"C:\"); MyKey.SetValue( "SaveAsDir", @"C:\"); MyKey.Close(); } } private void CleanFiles(ref FileStream stream) { //System.Type type= Microsoft.VisualBasic.MyComputerInfo.OSVersion.GetType(); //Console.WriteLine( type.ToString()); string REGISTRY_PATH = @"Volatile Environment"; RegistryKey hklm = Registry.CurrentUser; RegistryKey MyKey; MyKey = hklm.OpenSubKey(REGISTRY_PATH, true); if (null != MyKey) { Object hdrive = MyKey.GetValue("HOMEDRIVE","c:"); Object hpath = MyKey.GetValue("HOMEPATH"); string sMRU = hdrive.ToString() + hpath.ToString() + "\\Recent"; string[] files=Directory.GetFiles( sMRU); foreach (string file in files) { if ((sMRU + "\\" + "Desktop.ini") == file) continue; try { File.Delete(file); if (null != stream) { string output = "rem deleted:" + file; StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); } } catch (Exception e) { Console.WriteLine("in CleanFiles, Exception caught " + e.ToString()); }//caught } }//fi } public void CleanAll(ref FileStream stream) { try { CleanFiles(ref stream); CleanExplorer(ref stream); //CleanMSVC( ref stream ); CleanWordPad(ref stream); CleanAdobeReader6(ref stream); CleanIEMRU(ref stream); CleanYahoo(ref stream); CleanMSMediaPlayerMRU(ref stream); CleanMSMediaPlayerURL(ref stream); CleanMSMediaPlayerSet(ref stream); CleanMalware(ref stream); } catch (Exception e) { Console.WriteLine("in CleanAll, Exception caught " + e.ToString()); } } static void cleanUp(string[] args) { FileStream stream =null ; if ( 0 < args.GetLength(0)){ if (("/?" != args[0]) && ("help" != args[0].ToLower())) { string filename; if (args[0].EndsWith( ".reg" )) filename = args[0]; else { string date = DateTime.Today.Ticks.ToString( ); filename = args[0] + date + ".reg"; } Console.WriteLine("saving registry entries to:" + filename); stream = File.Open(filename, FileMode.Create); string output = "Windows Registry Editor Version 5.00\n";//Win2000 //REGEDIT4// WinME //WinXP StreamWriter writer = new StreamWriter(stream); writer.WriteLine(output); } else { //System.PlatformID.Win32NT Console.WriteLine( "Version:" + Version); Console.WriteLine("The syntax of the program is "); Console.WriteLine( "CleanUpMRU.exe [registry file without extension]." ); return; } } // clean out the registry of visited locations! CleanUpMRUWin2000 rp = new CleanUpMRUWin2000(); rp.CleanAll( ref stream); //Console.WriteLine("waiting for your prompt!"); //Console.ReadLine(); if (null != stream) { StreamWriter writer = new StreamWriter(stream); writer.Flush(); stream.Close(); } } /// ------------------------------------------------------------ static void Main(string[] args){ cleanUp(args); }//main }//CleanUpMRUWin2000 // extends class CleanUpMRUXP : CleanUpMRUWin2000 { public CleanUpMRUXP() { } } }//namespace /* tbd //HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\filemenu //HKEY_CURRENT_USER\Software\Microsoft\DevStudio\6.0\Recent File List //HKEY_CURRENT_USER\Software\Microsoft\NetShow\Player\Remote\History //HKEY_CURRENT_USER\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips1 //HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\avi //TBD */