Problem with catching key creation

Discussion in 'Ghost Security Suite (GSS)' started by ignign0kt, Aug 25, 2007.

Thread Status:
Not open for further replies.
  1. ignign0kt

    ignign0kt Registered Member

    Joined:
    Aug 25, 2007
    Posts:
    5
    I have added this to the list of rules:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components*

    The problem is, when I run a program that creates a new key under that key, RegMonitor doesn't catch it.
    I can't figure out why. The program creates a key, and then creates a string value under the newly created key.
    Any ideas?

    Edit: I added another * to the end of the rule, and it worked. But what's the difference of using 1 or 2 *'s?
     
    Last edited: Aug 25, 2007
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Advanced Wildcards
    HTH's,
    Bubba
     
  3. ignign0kt

    ignign0kt Registered Member

    Joined:
    Aug 25, 2007
    Posts:
    5
    Ok, thank you.
     
Thread Status:
Not open for further replies.