V1.9.0.531 Vista x64 Registry Scanner Invalid Detections

siliconman01

When running PT 2009 Registry Scanner in Aggressive mode, structured list, there are 800+ detections that I believe to be invalid detections on Vista x64. They appear to be related to accessing the System32 file on x64. I want to bring these to your attention now that work is in progress for full compatibility on Vista x64.

jv16

Does this also occur with the special build I made for you?

siliconman01

Unfortunately yes. The list looks like it is exactly the same.

jv16

Does this change anything related to this problem:

http://www.macecraft.com/downloads/betas/jv16pt_setup_siliconman04.exe

siliconman01

With siliconman04, I had to drop into SAFE MODE to get it to complete the Aggressive scan. In Normal Mode, it hangs on the final analysis phase.

I've attached the debug logs and also the scan results information. It found some different keys, but overall, it still looks like it is detecting a lot of invalid keys.

siliconman01

One bit of information that may or may not be relevant. All the files that PT 2009 Aggressive is saying that it cannot find in C:\Windows\System32 folder are, in fact, in the C:\Windows\SysWow64 folder.

It looks like a Filesystem Redirector gets involved.

http://www.tipandtrick.net/2008/how-to-suppress-and-bypass-system32-file-system-redirect-to-syswow64-folder-with-sysnative/

Also: One thing I know for sure is if the keys below for ODBC are deleted, then picture management program Thumbsplus 7 cannot open its picture database. These were detect by special build siliconman04.

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\driver do microsoft access (*.mdb)\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\driver do microsoft access (*.mdb)\Setup : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\driver do microsoft dbase (*.dbf)\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\driver do microsoft dbase (*.dbf)\Setup : %WINDIR%\system32\oddbse32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\driver do microsoft excel(*.xls)\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\driver do microsoft excel(*.xls)\Setup : %WINDIR%\system32\odexl32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\driver do microsoft paradox (*.db )\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\driver do microsoft paradox (*.db )\Setup : %WINDIR%\system32\odpdx32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft access driver (*.mdb)\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft access driver (*.mdb)\Setup : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft dbase driver (*.dbf)\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft dbase driver (*.dbf)\Setup : %WINDIR%\system32\oddbse32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft dbase vfp driver (*.dbf)\Driver : %WINDIR%\system32\vfpodbc.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft dbase vfp driver (*.dbf)\Setup : %WINDIR%\system32\vfpodbc.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft excel driver (*.xls)\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft excel driver (*.xls)\Setup : %WINDIR%\system32\odexl32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft foxpro vfp driver (*.dbf)\Driver : %WINDIR%\system32\vfpodbc.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft foxpro vfp driver (*.dbf)\Setup : %WINDIR%\system32\vfpodbc.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft odbc for oracle\Driver : %WINDIR%\system32\msorcl32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft odbc for oracle\Setup : %WINDIR%\system32\msorcl32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft paradox driver (*.db )\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft paradox driver (*.db )\Setup : %WINDIR%\system32\odpdx32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft text driver (*.txt; *.csv)\Driver : %WINDIR%\system32\odbcjt32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft text driver (*.txt; *.csv)\Setup : %WINDIR%\system32\odtext32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft visual foxpro driver\Driver : %WINDIR%\system32\vfpodbc.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\microsoft visual foxpro driver\Setup : %WINDIR%\system32\vfpodbc.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\ms code page translator\Translator : %WINDIR%\system32\MSCPXL32.dll

HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini\ms code page translator\Setup : %WINDIR%\system32\MSCPXL32.dll

siliconman01

It is also interesting to note that the ODBC items in the Quote above are not located at HKEY_LOCAL_MACHINE\software\odbc\odbcinst.ini. They are located at HKEY_LOCAL_MACHINE\software\Wow6432Node\odbc\odbcinst.ini. This is via using the Vista x64 default Regedit.exe which is the x64 version of Regedit.exe. I continue to believe that PT 2009 is addressing the x64 registry with 32bit routines; whereas, it needs to address with 64bit routines. I dunno... :?