(
(
version of regapp "iexplore.exe" >= "7"
)
AND
(
exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry
)
AND
(
exists folder "macromed\flash" whose
(
exists file whose
(
(
(
it starts with "flash" AND it ends with ".ocx"
)
OR
(
it = "swflash.ocx"
)
)
of
(
name of it as lowercase
)
AND version of it >= "9"
)
of it
)
of system folder
)
AND
(
exists key
(
"HKEY_USERS\" &
(
(
if
(
it = "LocalSystem"
)
then
(
"S-1-5-18"
)
else if
(
it = "LocalService"
)
then
(
"S-1-5-19"
)
else if
(
it = "NetworkService"
)
then
(
"S-1-5-20"
)
else if
(
it contains "@"
)
then
(
component string of sid of security account
(
it
)
)
else
(
string value of select
(
(
"SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
(
(
if it = "." then computer name else it
)
of preceding text of last "\" of it
)
& "'"
)
of
(
(
login account of service "BESWebReportsServer"
)
as string
)
)
of wmi
)
)
of login account of service "BESWebReportsServer"
)
& "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" &
(
first match
(
regex "^[^:]+"
)
of first match
(
regex "[^/]+$"
)
of
(
it as string
)
)
of value "Hostname" of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\" of registry
)
whose
(
exists value "http" whose
(
it = 2
)
of it AND exists value "https" whose
(
it = 2
)
of it
)
of registry
)
AND
(
exists key "HKLM\Software\BigFix\Enterprise Server\BESReports" whose
(
(
(
exists value "PDFEnable" whose
(
it = "1"
)
of it
)
OR
(
exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
(
exists value
(
(
(
value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
)
as string
)
& "BESReportsData\ArchiveData\__pdf\out.ps"
)
of it
)
of native registry
)
)
AND value "PDFPostScriptPath" of it =
(
(
(
value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
)
as string
)
& "BESReportsData\ArchiveData\__pdf\out.ps"
)
AND value "PDFPrinterName" of it = "BES Web Reports Printer"
)
of registry
)
AND
(
exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" whose
(
(
exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" whose
(
exists value "UninstallString" of it
)
of registry
)
AND
(
(
it contains parenthesized part 1 of
(
first match
(
regex "^(.*)uninstgs.exe"
)
of
(
value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
)
)
& "gs8.60\bin" AND it contains parenthesized part 1 of
(
first match
(
regex "^(.*)uninstgs.exe"
)
of
(
value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string
)
)
& "gs8.60\lib"
)
of
(
value "Path" of it as string
)
)
)
of registry
)
AND
(
exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose
(
exists value
(
(
(
value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry
)
as string
)
& "BESReportsData\ArchiveData\__pdf\out.ps"
)
of it
)
of native registry
)
AND
(
exists key
(
"HKU\" &
(
(
if
(
it = "LocalSystem"
)
then
(
"S-1-5-18"
)
else if
(
it = "LocalService"
)
then
(
"S-1-5-19"
)
else if
(
it = "NetworkService"
)
then
(
"S-1-5-20"
)
else if
(
it contains "@"
)
then
(
component string of sid of security account
(
it
)
)
else
(
string value of select
(
(
"SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" &
(
(
if it = "." then computer name else it
)
of preceding text of last "\" of it
)
& "'"
)
of
(
(
login account of service "BESWebReportsServer"
)
as string
)
)
of wmi
)
)
of login account of service "BESWebReportsServer"
)
& "\Software\Microsoft\Internet Explorer\PageSetup"
)
of registry
)
)
((version of regapp "iexplore.exe" >= "7") AND (exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry) AND (exists folder "macromed\flash" whose (exists file whose (((it starts with "flash" AND it ends with ".ocx") OR (it = "swflash.ocx")) of (name of it as lowercase) AND version of it >= "9") of it) of system folder) AND (exists key ("HKEY_USERS\" & ((if (it = "LocalSystem") then ("S-1-5-18") else if (it = "LocalService") then ("S-1-5-19") else if (it = "NetworkService") then ("S-1-5-20") else if (it contains "@") then (component string of sid of security account (it)) else (string value of select (("SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" & ((if it = "." then computer name else it) of preceding text of last "\" of it) & "'") of ((login account of service "BESWebReportsServer") as string)) of wmi)) of login account of service "BESWebReportsServer") & "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\" & (first match (regex "^[^:]+") of first match (regex "[^/]+$") of (it as string)) of value "Hostname" of key "HKLM\SOFTWARE\BigFix\Enterprise Server\Installer\" of registry) whose (exists value "http" whose (it = 2) of it AND exists value "https" whose (it = 2) of it) of registry) AND (exists key "HKLM\Software\BigFix\Enterprise Server\BESReports" whose (((exists value "PDFEnable" whose (it = "1") of it) OR (exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose (exists value (((value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") of it) of native registry)) AND value "PDFPostScriptPath" of it = (((value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") AND value "PDFPrinterName" of it = "BES Web Reports Printer") of registry) AND (exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" whose ((exists key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" whose (exists value "UninstallString" of it) of registry) AND ((it contains parenthesized part 1 of (first match (regex "^(.*)uninstgs.exe") of (value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string)) & "gs8.60\bin" AND it contains parenthesized part 1 of (first match (regex "^(.*)uninstgs.exe") of (value "UninstallString" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GPL Ghostscript 8.60" of registry as string)) & "gs8.60\lib") of (value "Path" of it as string))) of registry) AND (exists key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" whose (exists value (((value "EnterpriseServerFolder" of key "HKLM\SOFTWARE\BigFix\Enterprise Server" of x32 registry) as string) & "BESReportsData\ArchiveData\__pdf\out.ps") of it) of native registry) AND (exists key ("HKU\" & ((if (it = "LocalSystem") then ("S-1-5-18") else if (it = "LocalService") then ("S-1-5-19") else if (it = "NetworkService") then ("S-1-5-20") else if (it contains "@") then (component string of sid of security account (it)) else (string value of select (("SID from Win32_UserAccount where NAME='" & following text of last "\" of it & "' and DOMAIN='" & ((if it = "." then computer name else it) of preceding text of last "\" of it) & "'") of ((login account of service "BESWebReportsServer") as string)) of wmi)) of login account of service "BESWebReportsServer") & "\Software\Microsoft\Internet Explorer\PageSetup") of registry))
