We have a particular piece of malware that will put some binary code in the HKLM/System/ControlSet001/Services/{5083B7D5-47AF-8FF9-657C651C2B10}/
I am using an sql script along with Microsofts logparser to parse some data out of the registry on a windows box and I am having trouble with the last bit of the code.
The data is located at HKLM/System/ControlSet001/Services/{5083B7D5-47AF-8FF9-657C651C2B10}/
The date inside the parenthesis is never the same so my script looks like this.
SELECT TOP 1000
ComputerName,
Path,
Keyname,
ValueName,
Valuetype,
Value,
Lastwritetime
INTO *.-servi001ces.csv
FROM \$NAME$HKLMControlSet001Services{550D0230-5A10-46A2-B53E-6050E712BBCD}
I get an error of "error opening key.
The values inside the parenthesis is never the same and sql does not like the hyphens. Is there a wildcard that can be used for each value and how do I get around the hyphen problem.
I have tried the * for each value but no success.
Mark
Software/Hardware used:
ASKED:
October 5, 2009 9:03 PM
UPDATED:
January 23, 2010 7:35 PM
Have you tried enclosing the key in [ ]