> I've done some googling and am finding that the new RR version checks the
> security hive(which I believe to be 'invisible' to regedit-can someone
> correct me if I'm wrong?).

Hello,

I know I am coming late on this one, but registry keys that contain NULL
characters cannot be accessed through REGEDIT. You have to rely on the
low-level NTDLL API to access them. It is known "copy protection" trick :)

More information here:
http://www.microsoft.com/technet/sysinternals/information/tipsandtrivia.
mspx#E3B

BTW, Vic, if you happen to have a copy of the mysterious "a.exe" file, I
am interested in having a look at it.

Regards,
- Nicolas RUFF

[ reply ]