安装软件
我们可以直接用注册表进行伪装,打开记事本复制对应内容,重命名为asm.reg,双击安装即可
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
| Windows Registry Editor Version 5.00
; 注册虚拟软件 WPS Office 和 腾讯御点 到 64 位和 32 位路径
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WPS Office]
"DisplayName"="WPS Office"
"DisplayVersion"="11.8.2.8361"
"Publisher"="Kingsoft"
"InstallLocation"="C:\\Program Files\\Kingsoft\\WPS Office\\"
"UninstallString"="C:\\Program Files\\Kingsoft\\WPS Office\\uninstall.exe"
"DisplayIcon"="C:\\Program Files\\Kingsoft\\WPS Office\\WPS.exe"
"QuietUninstallString"="C:\\Program Files\\Kingsoft\\WPS Office\\uninstall.exe /quiet"
"InstallDate"="20241213"
"Publisher"="Kingsoft"
; 对应 32 位注册表路径
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WPS Office]
"DisplayName"="WPS Office"
"DisplayVersion"="11.8.2.8361"
"Publisher"="Kingsoft"
"InstallLocation"="C:\\Program Files (x86)\\Kingsoft\\WPS Office\\"
"UninstallString"="C:\\Program Files (x86)\\Kingsoft\\WPS Office\\uninstall.exe"
"DisplayIcon"="C:\\Program Files (x86)\\Kingsoft\\WPS Office\\WPS.exe"
"QuietUninstallString"="C:\\Program Files (x86)\\Kingsoft\\WPS Office\\uninstall.exe /quiet"
"InstallDate"="20241213"
"Publisher"="Kingsoft"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QQPCMgr]
"DisplayName"="Tencent EPM" ; 软件显示名称，这个是关键
"DisplayVersion"="15.5.0.1234"
"Publisher"="Tencent"
"InstallLocation"="C:\\Program Files\\Tencent\\PC Manager\\"
"UninstallString"="C:\\Program Files\\Tencent\\PC Manager\\uninstall.exe"
"DisplayIcon"="C:\\Program Files\\Tencent\\PC Manager\\PCMgr.exe"
"QuietUninstallString"="C:\\Program Files\\Tencent\\PC Manager\\uninstall.exe /quiet"
"InstallDate"="20231213"
"Publisher"="Tencent"
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\QQPCMgr]]
"DisplayName"="Tencent EPM"
"DisplayVersion"="15.5.0.1234"
"Publisher"="Tencent"
"InstallLocation"="C:\\Program Files (x86)\\Tencent\\PC Manager\\"
"UninstallString"="C:\\Program Files (x86)\\Tencent\\PC Manager\\uninstall.exe"
"DisplayIcon"="C:\\Program Files (x86)\\Tencent\\PC Manager\\PCMgr.exe"
"QuietUninstallString"="C:\\Program Files (x86)\\Tencent\\PC Manager\\uninstall.exe /quiet"
"InstallDate"="20231213"
"Publisher"="Tencent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ThreatBook Agent]
"DisplayName"="ThreatBook Agent"
"DisplayVersion"="3.7.5.2024"
"Publisher"="ThreatBook Inc."
"InstallLocation"="C:\\Program Files\\ThreatBook\\Endpoint Agent\\"
"UninstallString"="\"C:\\Program Files\\ThreatBook\\Endpoint Agent\\uninstaller.exe\" /mode unattended"
"DisplayIcon"="C:\\Program Files\\ThreatBook\\Endpoint Agent\\TbAgentGUI.exe,0"
"QuietUninstallString"="\"C:\\Program Files\\ThreatBook\\Endpoint Agent\\uninstaller.exe\" /silent"
"InstallDate"="20231015"
"URLUpdateInfo"="https://www.threatbook.com/support/updates"
"HelpLink"="https://support.threatbook.com/endpoint"
"EstimatedSize"=dword:00000200 ; 512MB
"SystemComponent"=dword:00000000
"NoRepair"=dword:00000001
"RealTimeProtection"=dword:00000001
"FirewallIntegration"=dword:00000001
"LastVirusDefinitionUpdate"="20231015153000"
|
卸载软件
卸载软件的修改也是找到指定的DisplayName,手动进行修改或删除
office软件推测识别的是否包含Microsoft Office
64位：HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\
32位：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall