Well, I have a different view. Probably, it may be that it's some malware who has rendered your registry key unavailable, as intended....I would sugget you run an AntiVirus Scan as well as a setup to clean/repair the registry.
Regards Tanishk -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of loyd.darby Sent: Monday, December 06, 2010 8:28 PM To: [email protected] Subject: Re: [ossec-list] Some of my clients are starting to get registry errors Could be permissions error. ossec runs under the system account and "system" should have full control and read. use regedit to check permissions on the key. On 12/03/2010 02:21 PM, dan (ddp) wrote: > On Thu, Dec 2, 2010 at 7:33 PM,<[email protected]> wrote: > >> Anyone see these errors, from WinXP clients. Just started getting these on a >> few devices. Thank You >> >> 2010/11/09 12:54:39 ossec-agent(1758): ERROR: Unable to open registry key: >> 'Software\Microsoft\Windows\CurrentVersion\RunOnceEx'. >> >> 2010/11/09 12:56:51 ossec-agent: INFO: Ending syscheck scan. >> >> 2010/11/10 07:51:51 ossec-agent: INFO: Starting rootcheck scan. >> >> 2010/11/10 07:51:59 ossec-agent: INFO: Ending rootcheck scan.2010/11/10 >> 08:56:59 ossec-agent: INFO: Starting syscheck scan. >> >> 2010/11/10 09:06:16 ossec-agent(1758): ERROR: Unable to open registry key: >> 'Software\Microsoft\Windows\CurrentVersion\RunOnceEx'. >> >> 2010/11/10 09:08:27 ossec-agent: INFO: Ending syscheck scan. >> > I haven't noticed any errors like that. Does the registry key that's > causing the error exist? > -- R. Loyd Darby, OSSIM-OCSE Project Manager DOC/NOAA/NMFS Infrastructure coordinator Southeast Fisheries Science Center 305-361-4297
