crouchie1998

Is the key to do with a Windows service?

What is the key?

Crouchie1998
BA (HONS) MCP MCSE

mark v

My impression thus far is that this is not a permissions issue.
Rather a key specifically created to be unreadable using the Win32
API registry functions. Typical of both rootkits and some vendors
licensing keys.

The only known to me methods are
Use the Native NT APIs
Manually edit a binary hive file in offline mode. NOT
recommended!
Un-install the application that created such a key. This may or
may not be effective. Often not effective if the software was a
"trial version".

charles

Thanks to both of you for replying.

Yes, I don't think it is a permissions issue and yes, I think it is
specifically designed to be unreadable. I found it using Sysinternals'
rootkitrevealer. When I asked the author he replied that he has had a
number of reports of this particular incident.

The application that probably installed the key has been removed form
this box long ago. I do remember that getting rid of the rest of it took
some work so they apparently have little respect for their customers'
property.

Exporting the branch fails. The best I've been able to do is to copy the
key name in regedit which loses the hidden chars. It is

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\System

I'm having at it with a hex editor but still having a problem just
finding the key.

Thanks again for any help.

crouchie1998

Are you sure its the key is not called Default?

I wasn't saying that this is a permissions issue, but that I would code a
program for you that forces full registry permissions on that key. You
misunderstood what I meant I think & so did the other user.

If you're getting an error 2 then the file... isn't found - correct, but I
have many applications that have been removed from my computer & I can
remove all registry keys.

Those tools you mention from that website I know because I have tried them
in the past. If you don't need my help then I will remove the flag from the
post & leave you to it.

Good luck

Crouchie1998
BA (HONS) MCP MCSE

mark v

Only sharing some information and ideas.

mark v

That sounds familiar.

(excerts from another server/group):
==========================================
Have either/both of you used software from O&O?
It may be that the trial version of some of their software creates
that key with an embedded nul character as part of the trial
license...

Based only on:
http://groups-
beta.google.com/group/microsoft.public.platformsdk.base/browse_thre
ad/thread/8c07688122c95cfb/9caec8f093286455?q=HKEY_LOCAL_MACHINE
\SOFTWARE\Microsoft\Windows\CurrentVersion\system# 9caec8f093286455
or
http://makeashorterlink.com/?X575114AA
=========================================

=========================================
Bingo! I installed O&O Defrag on 1/6/2003, and thanks to a Total
Uninstall log I created at that time, I see that O&O Defrag added
the
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Sy stem" key.
=========================================

=========================================
Sure enough, I followed the advice given in that newsgroup posting
(i.e.
opened the SOFTWARE hive in WinHex, searched for
0700000053797374656D00,
and changed the trailing "00" to "AA"), and now I have the
following two
values showing under the "Systemª" key:

OODEFRAG04.00.00.01SERVER
OODEFRAG06.00.00.01WORKSTATION

....with some very long hex strings for data.

Mind, you, I did this on a previously-saved SOFTWARE hive, backed
up a few days ago with ERUNT. Haven't "gone live" with it yet.
=========================================


The manual hive editing procedure is *hazardous*! Adequate full
registry backups are *manadatory*. Fallback or "un-do" procedures
*must* be available. Not recommended. It would be safest to just
leave such a key in place. Provided FWIW and YMMV

keith miller

Just a guess here, but it might be a dword (0x00000007) indicating the length of the string in bytes (53 79 73 74 65 6D 00)

Keith