rapid7/metasploit-framework — pull request #134 by averagesecurityguy (2012-01-27 00:42:39+00:00)
Title: Updates to enum_artifacts

data/post/enum_artifacts_list.txt was modified to use yaml format
modules/post/windows/gather/enum_artifacts.rb was modified to read the yaml format.
lib/msf/core/post/file.rb was modified to correctly handle a non-existent file on the remote system

I modified the enum_artifacts.rb file significantly to handle the new yaml format. Also all file and registry entries are organized by what they are evidence of. I would like to build enum_artifacts_list.txt to identify evidence of infection of major malware like conficker.

Let me know what I need to fix.