rule Portable_Photoshop_CS3_Launcher meta: description = "Detects known portable CS3 launcher signatures" strings: $launcher_sig = "VirtualRegistry" nocase ascii wide $ps_path = "Photoshop.exe" ascii wide $no_install = "No Install Needed" ascii wide $portable_key = "HKCU\\Software\\Adobe\\Photoshop\\10.0" condition: ($launcher_sig or $no_install) and $ps_path and $portable_key