Hello Vili, On Sun, 18 Dec 2005 08:53:57 +0100 GMT(12/18/2005, 1:53 AM -0600 GMT), per mid:[EMAIL PROTECTED] Vili wrote:
>> Yes, but the really strange thing is it turned up when I was >> filtering on 'thebat.exe' which is why I asked the question here. > It is just some logging done by the Windows. So, it is not TB! related > issue, I think. The log file was created with RegMon from http://www.sysinternals.com/Utilities/Regmon.html which monitors the registry of Windows. The log was NOT created by Windows. Sysinternals has provided HIGHLY respected utilities to the market for years. Per the web site on RegMon: ,----- [ Quote per http://www.sysinternals.com/Utilities/Regmon.html ] | Regmon is a Registry monitoring utility that will show you which | applications are accessing your Registry, which keys they are | accessing, and the Registry data that they are reading and writing - | all in real-time. This advanced utility takes you one step beyond what | static Registry tools can do, to let you see and understand exactly | how programs use the Registry. With static tools you might be able to | see what Registry values and keys changed. With Regmon you'll see how | the values and keys changed.. `----- In addition you have the ability to filter what you monitor. When I created the Log file I was filtering on 'thebat.exe'. Since I realized that TB Beta was changing the registry, I wanted to monitor what was being changed, hence the filter on 'thebat.exe'. After looking into the log I decided to look at the specifics of 'Request' changes in the Registry. The criteria I used was "CreateKey" Or "DeleteValueKey" Or "SetValue". Since I didn't provide the headers originally, I have done so below on the first line in the quote box. ,----- [ ] | "No","Time","Process","Request","Path","Result","Other" | 2920,59.15,"Email_Program.exe:1844","CreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec23-6d09-11da-9254-806d6172696f}\","SUCCESS","Access: 0x2000000" | 2921,59.15,"Email_Program.exe:1844","SetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec23-6d09-11da-9254-806d6172696f}\BaseClass","SUCCESS","""Drive""" | 2923,59.15,"Email_Program.exe:1844","CreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec22-6d09-11da-9254-806d6172696f}\","SUCCESS","Access: 0x2000000" | 2924,59.15,"Email_Program.exe:1844","SetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec22-6d09-11da-9254-806d6172696f}\BaseClass","SUCCESS","""Drive""" | 2926,59.15,"Email_Program.exe:1844","CreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec24-6d09-11da-9254-806d6172696f}\","SUCCESS","Access: 0x2000000" | 2927,59.15,"Email_Program.exe:1844","SetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec24-6d09-11da-9254-806d6172696f}\BaseClass","SUCCESS","""Drive""" | 2929,59.15,"Email_Program.exe:1844","CreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec25-6d09-11da-9254-806d6172696f}\","SUCCESS","Access: 0x2000000" | 2930,59.15,"Email_Program.exe:1844","SetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1b6ec25-6d09-11da-9254-806d6172696f}\BaseClass","SUCCESS","""Drive""" | 3433,96.84,"Email_Program.exe:1844","CreateKey","HKLM\Software\Microsoft\Tracing","SUCCESS","Access: 0xF003F" `----- I'll let you know what I find out from other sources. :) -- Best Regards, Greg Strong Using The Bat! v3.62.14 on Windows XP Pro 5.1 Build 2600 Service Pack 2 ________________________________________________________ Current beta is 3.63.14 | 'Using TBBETA' information: http://www.silverstones.com/thebat/TBUDLInfo.html IMPORTANT: To register as a Beta tester, use this link first - http://www.ritlabs.com/en/partners/testers/
