REGEDIT4[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer][HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\Client]
"PacketSize"=dword:00000000[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\Client\DB-Lib]
"AutoAnsiToOem"="off"[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\ISQL/w]
"ExtnOpen"="*.SQL"
"ExtnSave"="*.RPT"
"UndoOps"=dword:00000014
"EditControlFont"=hex:f3,ff,ff,ff,00,00,00,00,00,00,00,00,00,00,00,00,90,01,00,\
  00,00,00,00,00,00,01,00,30,43,6f,75,72,69,65,72,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\ISQL/w\Recent File List]
"File1"="D:\\bazh\\db104\\ALL106.sql"[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\SQL Interface][HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\SQL Interface\Graphs][HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\SQL Interface\Graphs\Database New]
"BarVertical"=dword:00000000
"BarDisplayMode"=dword:00000000
"UnitsLabel"=dword:00000001
"TitleLabel"=dword:00000000
"SolidColors"=dword:00000000
"PrintWithColors"=dword:00000001
"PrintDataNTime"=dword:00000001
"PrintLegend"=dword:00000001
"PrintDateNTimeFontSize"=hex:00,00,00,00,00,00,e8,3f
"PrintLegendFontSize"=hex:00,00,00,00,00,00,e8,3f
"CurrentPrimitive"="Bar Graph"[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\SQL Interface\Graphs\Device New]
"BarVertical"=dword:00000000
"BarDisplayMode"=dword:00000000
"UnitsLabel"=dword:00000001
"TitleLabel"=dword:00000000
"SolidColors"=dword:00000000
"PrintWithColors"=dword:00000001
"PrintDataNTime"=dword:00000001
"PrintLegend"=dword:00000001
"PrintDateNTimeFontSize"=hex:00,00,00,00,00,00,e8,3f
"PrintLegendFontSize"=hex:00,00,00,00,00,00,e8,3f
"CurrentPrimitive"="Bar Graph"[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\SQLEW]
"PromptBeforeExit"=dword:00000001
"ResultSwitch"=dword:00000001
"AutoDisconnect"=dword:00000000
"UserRegistrationInfo"=dword:00000001
"AutoShowTips"=dword:00000000
"Login Timeout"=dword:00000005
"Query Timeout"=dword:00000000
"UndoMode"=dword:00000000
"ViewToolBar"=dword:00000001
"ViewStatusBar"=dword:10000000
"ViewExternalToolsBar"=dword:00000001
"ServerStatePoll"=dword:0000000a
"ServerDimensions"=hex:00,00,00,00,00,00,00,00,08,01,00,00,ae,01,00,00
"RegisteredServersSource"=""
"LastSQLServer"="GREATWALL"
"WindowDimensions"="0,1,1,800,600"[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\SQLEW\Registered Servers]
"RegistrationVersion"=dword:00000003[HKEY_CURRENT_USER\Software\Microsoft\MSSQLServer\SQLEW\Registered Servers\SQL 6.5]
"GREATWALL"=hex:47,52,45,41,54,57,41,4c,4c,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,73,61,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,6a,37,34,39,32,39,74,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  b0,e0,14,00,01,00,00,00,00,00,00,00,06,00,00,00,32,00,00,00,01,00,00,00,01,\
  00,00,00,02,00,00,00,01,00,00,00,00,00,00,00REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\DB-Lib]
"AutoAnsiToOem"="ON"
"UseIntlSettings"="ON"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\TDS]
"greatwall"="4.2"
"(local)"="4.2"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer]
"ResourceMgrID"="{870E3FE0-964A-11D3-B261-00D0091356F9}"
"Tapeloadwaittime"=dword:ffffffff
"LoginMode"=dword:00000000
"DefaultLogin"="guest"
"DefaultDomain"="GREAT"
"AuditLevel"=dword:00000000
"Map_"="\\"
"Map#"="-"
"Map$"=" "
"SetHostname"=dword:00000000
"ListenOn"=hex(7):53,53,4e,4d,50,4e,36,30,2c,5c,5c,2e,5c,70,69,70,65,5c,73,71,\
  6c,5c,71,75,65,72,79,00,00[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\CurrentVersion]
"RegisteredOwner"="JING"
"SerialNumber"=dword:81270040
"CurrentVersion"="6.50.416"
"RegisteredOrganization"="BANK"
"RegisteredProductID"="228-075-040-50649-415-0205025"
"SoftwareType"="System"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\Parameters]
"SQLArg0"="-dC:\\MSSQL\\DATA\\MASTER.DAT"
"SQLArg1"="-eC:\\MSSQL\\LOG\\ERRORLOG"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Replication]
"WorkingDirectory"="C:\\MSSQL\\REPLDATA"
"DistributionDB"=""[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Setup]
"SQLPath"="C:\\MSSQL"
"SetupStatus"="Installed"
"CRC"="131009289"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\SQL Interface][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\SQL Interface\Graph Control][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\SQL Service Manager]
"Action Verify"=dword:00000000
"Services"=hex(7):4d,53,53,51,4c,53,65,72,76,65,72,00,53,51,4c,45,78,65,63,75,\
  74,69,76,65,00,4d,53,44,54,43,00,00
"DefaultSvc"="MSSQLServer"
"Remote"=dword:00000001
"Background Interval"=dword:00000005
"Foreground Interval"=dword:00000002
"WindowDimensions"="0,262,193,275,214"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\SQLExecutive]
"CmdExecAccount"=hex:49,b6,89,d7,a8,1e,63,bd,bd,c0,44,de,7b,22,b0,77
"NonAlertableErrors"="1204,4002"
"TaskHistoryMaxRows"=dword:00000064
"RestartSQLServer"=dword:00000001
"RestartSQLServerInterval"=dword:00000005
"SyshistoryLimitRows"=dword:00000001
"SyshistoryMaxRows"=dword:000003e8
"MailAutoStart"=dword:00000001
"ServerHost"=""[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\SQLExecutive\Subsystems]
"CmdExec"="C:\\MSSQL\\BINN\\CMDEXEC.DLL,CmdExecStart,CmdEvent,CmdExecStop,10"
"Sync"="C:\\MSSQL\\BINN\\SQLREPL.DLL,sync_start,sync_event,sync_stop,100"
"LogReader"="C:\\MSSQL\\BINN\\SQLREPL.DLL,logreader_start,logreader_event,logreader_stop,25"
"Distribution"="C:\\MSSQL\\BINN\\SQLREPL.DLL,distribution_start,distribution_event,distribution_stop,100"注册表找到了,可分别在CURRENT_USER和LOCAL_MACHINE下找到。
虽然注册表找到了,仍然不能保证,是否有SQL SERVER存在,因为非法删除文件.另外,由于SQL SERVER对登录及数据库的权限设置,在没有密码的情况下很难访问的到。如果幸运,SA没有口令,可用生成ISQL进程的操作执行SQL 脚本。
  ISQL -Sserver -Usa -P -ic:\mysql.sql -oc:\output
在脚本可写:
   use master
   go
   select * from sysdatabase
   go
   select @@version
   go等等查询语句。
  另外,我想还可通过查找MSSQLSERVER服务进程来发现SERVER是否运行,存在。
  但一些和SERVICE有关的函数我还没搞清。