Some Registry scanned values not working

[apineda]

Hi Everyone,

I've just upgraded to version 3.5, and the first thing I'm trying to do is to scan some specific values on the registry.

I've added the following lines on the "registry scanned keys" option in the management console:

RegPath=SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific SA Standard Time, value=TZI
RegPath = SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific SA Standard Time\Dynamic DST, value=2008
RegPath = SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific SA Standard Time\Dynamic DST, value=2009
RegPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific SA Standard Time\Dynamic DST, value=LastEntry

The problem is that I only see some value for the last key, the others 3 just reports null values, so it seems that is not a problem with the scanning process itself.

As far as I see, the only difference between the registry values, is that the "LastEntry" is a REG_DWORD type, and the others 3 are REG_BINARY.

What can be wrong?

Thanks for your help.

[tellis]

I am trying to scan:
RegPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
RegValue=ProxyEnable

It is a DWORD and its actual value is "1" but it is showing up in the DB as "0".
Do I need to scan a differant way to get a DWORD??

[Hemoco]

tellis wrote:
I am trying to scan:
RegPath=HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
RegValue=ProxyEnable

It is a DWORD and its actual value is "1" but it is showing up in the DB as "0".
Do I need to scan a differant way to get a DWORD??

What you are doing is correct but the "current user" is the one performing the scan, not the one you want.

[Hemoco]

Since these values are binary it's impossible to decode them.
Some could be just text strings, just could be specific binary code to use in software.

[sticky]

I second this - please add it to the wishlist!

[apineda]

Thanks for the reply !!

Another case of RTM 🙂

Please add it to the wishlist.

[Hemoco]

REG_BINARY values cannot be scanned (which was also the case in 3.2)