HTML output color codes sample.

This is an output sample of the tool with all the colors that the html output uses currently.

Registry values
Key	Value	Data	Key_Timestamp
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\:::*:::\Default,
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\igfxcui	Default	{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}	2007-12-13T21:59:58Z
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}	Default	GraphicsShellExt Class	2007-12-13T21:59:58Z
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}\InProcServer32	Default	C:\WINDOWS\system32\igfxpph.dll	2007-12-13T21:59:58Z
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}\ProgID	Default	igfxpph.GraphicsShellExt.1	2007-12-13T21:59:58Z
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\New	Default	{D969A300-E7FF-11d0-A93B-00A0C90F2719}	2007-12-13T22:04:28Z
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D969A300-E7FF-11d0-A93B-00A0C90F2719}	Default	Microsoft New Object Service	2007-12-13T22:04:28Z [Expected value: New Menu Handler]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D969A300-E7FF-11d0-A93B-00A0C90F2719}\InProcServer32	Default	%SystemRoot%\system32\SHELL32.dll	2007-12-13T22:04:28Z [Expected value: %SystemRoot%\system32\shell32.dll]
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters	ServiceDll	%SystemRoot%\System32\mswsock.dll	2009-06-11T09:40:54Z [Match: %SystemRoot%\System32\mswsock.dll][Info: Microsoft Windows Sockets 2.0 Service Provider]
ntuser_john.dat
HKU\Software\Microsoft\Windows\CurrentVersion\Run\:::vk:::,
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	CTFMON.EXE	C:\WINDOWS\system32\ctfmon.exe	2012-10-29T16:40:24Z
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	H/PC Connection Agent	"C:\ARCHIV~1\MI3AA1~1\wcescomm.exe"	2012-10-29T16:40:24Z
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	AbGame	c:\Winis7\opera.exe	2012-10-29T16:40:24Z [Match: Winis7\opera.exe][Info: W32.Winiga]

Maybe you can think that there are too much colors in the html output of Regkeval but you must keep in mind that there can be several thousand lines in the output to review.

The normal output will be full of green lines meaning that it matches exactly with the value that is expected to find so you can browse very quickly the document. Whenever the tool finds any mismatch with a value that is included in the file containing the expected values for the system, the regkeval_val_justif.tsv file, the line will be displayed as red text on white background and it will append to the time field the expected value as it appears in the regkeval_val_justif.tsv file.

When there is a match with any of the keywords contained in the regkeval_val_malw_espec.tsv file the entry is displayed as white on red background if it is classified as malware. But if it is classified as a special value then it will be displayed as blue on yellow background. The classification as malware or value of interest can be made by assigning to the corresponding keyword the string "dos" for malware or the string "cuatro" for values of interest in the regkeval_val_malw_espec.tsv file. In both cases the information included in the regkeval_val_malw_espec.tsv file will be appended to the time field in the output.

If there is no info about the value it is displayed as sunset color (http://en.wikipedia.org/wiki/Sunset_%28color%29 :-) ).

Finally the grey background color is used to display the beginning of the corresponding search path output and the blue background color is used to indicate the beginning of a ntuser.dat file analysis.