NOT
(
(
version of regapp "iexplore.exe" >= "7"
)
AND
(
exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry
)
AND
(
exists folder "macromed\flash" whose
(
exists file whose
(
(
(
it starts with "flash" AND it ends with ".ocx"
)
OR
(
it = "swflash.ocx"
)
)
of
(
name of it as lowercase
)
AND version of it >= "9"
)
of it
)
of system folder
)
AND
(
exists key
(
"HKEY_USERS\" &
(
(
if it = "LocalSystem" then "S-1-5-18" else if it = "LocalService" then "S-1-5-19" else if it = "NetworkService" then "S-1-5-20" else
(
string value of select
(
(
"SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
(
(
if it = "." then computer name else it
)
of preceding text of last "\" of it
)
& "'"
)
of
(
(
login account of service "BESWebReportsServer"
)
as string
)
)
of wmi
)
)
of login account of service "BESWebReportsServer"
)
& "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" &
(
first match
(
regex "^[^:]+"
)
of first match
(
regex "[^/]+$"
)
of
(
it as string
)
)
of value "Hostname" of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\" of registry
)
whose
(
exists value "http" whose
(
it = 2
)
of it AND exists value "https" whose
(
it = 2
)
of it
)
of registry
)
AND
(
exists key "HKLM\Software\BigFix\Enterprise Server\BESReports" whose
(
(
(
exists value "PDFEnable" whose
(
it = "1"
)
of it
)
OR
(
exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
(
exists value
(
(
(
(
if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it
)
of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry
)
as string
)
& "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps"
)
of it
)
of native registry
)
)
AND value "PDFPostScriptPath" of it =
(
(
(
(
if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it
)
of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry
)
as string
)
& "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps"
)
AND value "PDFPrinterName" of it = "BES Web Reports Printer"
)
of registry
)
AND
(
exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" whose
(
(
exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" whose
(
exists value "UninstallString" of it
)
of registry
)
AND
(
(
it contains parenthesized part 1 of
(
first match
(
regex "^(.*)uninstgs.exe"
)
of
(
value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
)
)
& "gs8.60\bin" AND it contains parenthesized part 1 of
(
first match
(
regex "^(.*)uninstgs.exe"
)
of
(
value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
)
)
& "gs8.60\lib"
)
of
(
value "Path" of it as string
)
)
)
of registry
)
AND
(
exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
(
exists value
(
(
(
(
if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it
)
of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry
)
as string
)
& "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps"
)
of it
)
of native registry
)
AND
(
exists key
(
"HKU\" &
(
(
if it = "LocalSystem" then "S-1-5-18" else if it = "LocalService" then "S-1-5-19" else if it = "NetworkService" then "S-1-5-20" else
(
string value of select
(
(
"SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
(
(
if it = "." then computer name else it
)
of preceding text of last "\" of it
)
& "'"
)
of
(
(
login account of service "BESWebReportsServer"
)
as string
)
)
of wmi
)
)
of login account of service "BESWebReportsServer"
)
& "\Software\Microsoft\Internet Explorer\PageSetup"
)
of registry
)
)
NOT ((version of regapp "iexplore.exe" >= "7") AND (exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry) AND (exists folder "macromed\flash" whose (exists file whose (((it starts with "flash" AND it ends with ".ocx") OR (it = "swflash.ocx")) of (name of it as lowercase) AND version of it >= "9") of it) of system folder) AND (exists key ("HKEY_USERS\" & ((if it = "LocalSystem" then "S-1-5-18" else if it = "LocalService" then "S-1-5-19" else if it = "NetworkService" then "S-1-5-20" else (string value of select (("SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" & ((if it = "." then computer name else it) of preceding text of last "\" of it) & "'") of ((login account of service "BESWebReportsServer") as string)) of wmi)) of login account of service "BESWebReportsServer") & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" & (first match (regex "^[^:]+") of first match (regex "[^/]+$") of (it as string)) of value "Hostname" of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\" of registry) whose (exists value "http" whose (it = 2) of it AND exists value "https" whose (it = 2) of it) of registry) AND (exists key "HKLM\Software\BigFix\Enterprise Server\BESReports" whose (((exists value "PDFEnable" whose (it = "1") of it) OR (exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose (exists value ((((if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it) of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry) as string) & "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps") of it) of native registry)) AND value "PDFPostScriptPath" of it = ((((if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it) of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry) as string) & "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps") AND value "PDFPrinterName" of it = "BES Web Reports Printer") of registry) AND (exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" whose ((exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" whose (exists value "UninstallString" of it) of registry) AND ((it contains parenthesized part 1 of (first match (regex "^(.*)uninstgs.exe") of (value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string)) & "gs8.60\bin" AND it contains parenthesized part 1 of (first match (regex "^(.*)uninstgs.exe") of (value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string)) & "gs8.60\lib") of (value "Path" of it as string))) of registry) AND (exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose (exists value ((((if x64 of operating system then value "ProgramFilesDir (x86)" of it else value "ProgramFilesDir" of it) of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" of registry) as string) & "\BigFix Enterprise\BES Server\BESReportsData\ArchiveData\__pdf\out.ps") of it) of native registry) AND (exists key ("HKU\" & ((if it = "LocalSystem" then "S-1-5-18" else if it = "LocalService" then "S-1-5-19" else if it = "NetworkService" then "S-1-5-20" else (string value of select (("SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" & ((if it = "." then computer name else it) of preceding text of last "\" of it) & "'") of ((login account of service "BESWebReportsServer") as string)) of wmi)) of login account of service "BESWebReportsServer") & "\Software\Microsoft\Internet Explorer\PageSetup") of registry))
