PDA

View Full Version : Problem with catching key creation


ignign0kt
August 25th, 2007, 03:03 AM
I have added this to the list of rules:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components*

The problem is, when I run a program that creates a new key under that key, RegMonitor doesn't catch it.
I can't figure out why. The program creates a key, and then creates a string value under the newly created key.
Any ideas?

Edit: I added another * to the end of the rule, and it worked. But what's the difference of using 1 or 2 *'s?

Bubba
August 25th, 2007, 06:12 AM
{QUOTE-> Edit: I added another * to the end of the rule, and it worked. But what's the difference of using 1 or 2 *'s? <-QUOTE}Advanced Wildcards (http://www.ghostsecurity.com/gsshelp/rd_wildcard.htm)
{QUOTE-> *
When used in registry keys it will only match to until a backslash (\) is found.

HKLM\Software\*

Yes HKLM\Software\Ghost Security
Yes HKLM\Software\Microsoft
No HKLM\Software\Ghost Security\Subkey
No HKLM\Software\Microsoft\Explorer
<-QUOTE}HTH's,
Bubba

ignign0kt
August 25th, 2007, 01:55 PM
Ok, thank you.