Find Installed Torrent Clients?

[ken82m]

I know their are and endless number of these clients and I will never find them all...

But does anyone know of a descent list of torrent client executables and default install directories?

Or perhaps an existing tool or script to detect installed bit torrent clients on a windows machine? Primarily Windows 7.

Thanks guys,

Kenny

[JLogan3o13]

Hi, ken82m. As you mentioned, there are a ton of different torrent clients out there. You might be better off just returning a list of what is installed on the machine (minus any windows update), and then go from there. I provided a script in the link below that will allow you to return a list of applications on a remote PC. That may get you started.

[DicatoroftheUSA]

There are portable apps for torrents as well and I suspect those who use torrents, and are malicious enough to use it on someone else's network are aware of them. The only way to really prevent it is to control what processes do run and monitoring traffic for abnormal usage. Policies can be applied to windows 7 for this level of control.

Edited November 16, 2012 by DicatoroftheUSA

[Morthawt]

I don't see how it will be doable. Aside from getting the window titles of every torrent client and searching if they are active or something.

[DicatoroftheUSA]

Its doable with native tools in a w7 environment.

http://lifehacker.com/5442636/create-an-application-whitelist-in-windows-7

http://www.infoworld.com/d/security-central/application-whitelisting-in-windows-7-and-windows-server-2008-r2-845

[ken82m]

Thanks guys. One more question, Any idea how to pull the username or SID that installed an app?

[DicatoroftheUSA]

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,4475.0/

The above has some tips.

Also if you find some sample files in explorer, the "Owner" field metadata may show who installed it.

Here is an AI script for the metadata. I don't know who the OP is.

expandcollapse popup

$path = FileOpenDialog("Select a file to read attributes",@ScriptDir,"All (*.*)")
$prop = _GetExtProperty($path,-1)
_ArrayDisplay($prop,"Property Array")


;===============================================================================
; Function Name:    GetExtProperty($sPath,$iProp)
; Description:      Returns an extended property of a given file.
; Parameter(s):     $sPath - The path to the file you are attempting to retrieve an extended property from.
;                   $iProp - The numerical value for the property you want returned. If $iProp is is set
;                             to -1 then all properties will be returned in a 1 dimensional array in their corresponding order.
;                           The properties are as follows:
;                           Name = 0
;                           Size = 1
;                           Type = 2
;                           DateModified = 3
;                           DateCreated = 4
;                           DateAccessed = 5
;                           Attributes = 6
;                           Status = 7
;                           Owner = 8
;                           Author = 9
;                           Title = 10
;                           Subject = 11
;                           Category = 12
;                           Pages = 13
;                           Comments = 14
;                           Copyright = 15
;                           Artist = 16
;                           AlbumTitle = 17
;                           Year = 18
;                           TrackNumber = 19
;                           Genre = 20
;                           Duration = 21
;                           BitRate = 22
;                           Protected = 23
;                           CameraModel = 24
;                           DatePictureTaken = 25
;                           Dimensions = 26
;                           Width = 27
;                           Height = 28
;                           Company = 30
;                           Description = 31
;                           FileVersion = 32
;                           ProductName = 33
;                           ProductVersion = 34
; Requirement(s):   File specified in $spath must exist.
; Return Value(s):  On Success - The extended file property, or if $iProp = -1 then an array with all properties
;                   On Failure - 0, @Error - 1 (If file does not exist)
; Author(s):        Simucal (Simucal@gmail.com)
; Note(s):
;
;===============================================================================
Func _GetExtProperty($sPath, $iProp)
    Local $iExist, $sFile, $sDir, $oShellApp, $oDir, $oFile, $aProperty, $sProperty
    $iExist = FileExists($sPath)
    If $iExist = 0 Then
        SetError(1)
        Return 0
    Else
        $sFile = StringTrimLeft($sPath, StringInStr($sPath, "", 0, -1))
        $sDir = StringTrimRight($sPath, (StringLen($sPath) - StringInStr($sPath, "", 0, -1)))
        $oShellApp = ObjCreate("shell.application")
        $oDir = $oShellApp.NameSpace ($sDir)
        $oFile = $oDir.Parsename ($sFile)
        If $iProp = -1 Then
            Local $aProperty[35]
            For $i = 0 To 34
                $aProperty[$i] = $oDir.GetDetailsOf ($oFile, $i)
            Next
            Return $aProperty
        Else
            $sProperty = $oDir.GetDetailsOf ($oFile, $iProp)
            If $sProperty = "" Then
                Return 0
            Else
                Return $sProperty
            EndIf
        EndIf
    EndIf
EndFunc   ;==>_GetExtProperty

Edited November 16, 2012 by DicatoroftheUSA

[BrewManNH]

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,4475.0/

The above has some tips.

Also if you find some sample files in explorer, the "Owner" field metadata may show who installed it.

Here is an AI script for the metadata. I don't know who the OP is.

That script, unfortunately, only works well on XP because it doesn't show all properties of the file that Windows knows about under Vista/7/8. Plus the numbers for the properties only apply to one version of XP and not all the various SP updates.

I have a link in my signature that is basically the same script, but updated to work on OSs other than XP.