# READ-ONLY registry audit — OLE DB providers, ODBC drivers, CLSIDs # No modifications. No secrets displayed. param([switch]$OleDb, [switch]$OdbcReg, [switch]$Clsid, [switch]$All) $ErrorActionPreference = "SilentlyContinue" if ($All -or $OleDb) { Write-Host "========== OLE DB PROVIDERS ==========" $classesRoots = @("HKLM:\SOFTWARE\Classes", "HKLM:\SOFTWARE\WOW6432Node\Classes") # Search ProgIDs foreach ($c in $classesRoots) { Get-ChildItem $c -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match "^PCSOFT\.|^HFSQL|HyperFile" } | ForEach-Object { $progid = $_.PSChildName Write-Host "ProgID: $progid (under $c)" $clsidPath = Join-Path $c "$progid\CLSID" if (Test-Path $clsidPath) { $clsid = (Get-ItemProperty $clsidPath).'(default)' Write-Host " CLSID: $clsid" if ($clsid) { $detail = Join-Path $c "CLSID\$clsid" if (Test-Path $detail) { $dll = (Get-ItemProperty "$detail\InprocServer32").'(default)' if ($dll) { Write-Host " DLL: $dll" } $ver = (Get-ItemProperty "$detail\Version").'(default)' if ($ver) { Write-Host " Version: $ver" } } } } Write-Host "---" } } # Search OLE DB Provider descriptions Write-Host "`n=== OLE DB Provider Descriptions (HFSQL/PC SOFT) ===" foreach ($c in $classesRoots) { $clsidBase = Join-Path $c "CLSID" if (Test-Path $clsidBase) { Get-ChildItem $clsidBase -ErrorAction SilentlyContinue | ForEach-Object { $clsid = $_.PSChildName $olePath = "$clsidBase\$clsid\OLE DB Provider" if (Test-Path $olePath) { $desc = (Get-ItemProperty $olePath).'(default)' if ($desc -match "HFSQL|Hyper.?File|PC.?SOFT|PCSOFT") { Write-Host "Description: $desc" Write-Host "CLSID: $clsid" $dll = (Get-ItemProperty "$clsidBase\$clsid\InprocServer32").'(default)' if ($dll) { Write-Host "DLL: $dll" } Write-Host "---" } } } } } } if ($All -or $OdbcReg) { Write-Host "`n========== ODBC REGISTRY (HFSQL/WINDEV) ==========" $odbcPaths = @( "HKLM:\SOFTWARE\ODBC\ODBCINST.INI\ODBC Drivers", "HKLM:\SOFTWARE\WOW6432Node\ODBC\ODBCINST.INI\ODBC Drivers" ) foreach ($p in $odbcPaths) { if (Test-Path $p) { $props = Get-ItemProperty $p $props.PSObject.Properties | Where-Object { $_.Name -match "HFSQL|Hyper.?File|PC.?SOFT|PCSOFT|WINDEV|WD300" } | ForEach-Object { Write-Host "Driver: $($_.Name) Value: $($_.Value) Path: $p" } } } # Driver details $iniPaths = @( "HKLM:\SOFTWARE\ODBC\ODBCINST.INI", "HKLM:\SOFTWARE\WOW6432Node\ODBC\ODBCINST.INI" ) foreach ($p in $iniPaths) { Get-ChildItem $p -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match "HFSQL|Hyper.?File|PC.?SOFT|PCSOFT|WINDEV|WD300" } | ForEach-Object { $name = $_.PSChildName Write-Host "`nDriverSection: $name (under $p)" $props = Get-ItemProperty "$p\$name" $props.PSObject.Properties | Where-Object { $_.Name -notin @("PSPath","PSParentPath","PSChildName","PSDrive","PSProvider") } | ForEach-Object { Write-Host " $($_.Name)=$($_.Value)" } } } } if ($All -or $Clsid) { Write-Host "`n========== CLSID Search (PCSOFT/HFSQL specific) ==========" # We use a targeted approach — search ProgID first $found = @{} foreach ($c in @("HKLM:\SOFTWARE\Classes","HKLM:\SOFTWARE\WOW6432Node\Classes")) { Get-ChildItem $c -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match "^PCSOFT|^WD300|^HAccess|HFSQL" } | ForEach-Object { $progid = $_.PSChildName if (-not $found[$progid]) { $found[$progid] = $true Write-Host "ProgID: $progid" $clsidPath = "$c\$progid\CLSID" if (Test-Path $clsidPath) { $clsid = (Get-ItemProperty $clsidPath).'(default)' Write-Host " CLSID: $clsid" } } } } } Write-Host "`nDone."