Re: Mystery Registry Key After SP2 Installation

[OShah]

"Jon" > wrote in
:

>
> From the names of the 2 value keys
>
> "Prompt"=dword:00000000
> "MsgPrivacy"=dword:00000001
>
> it's probably more likely to be related to a program like Windows
> Messenger, than to SP2 eg an add-in I've installed. Not a major problem
> anyhow, was just curious.
>
>

I know it's way too late to post on this topic, and you're probably no
longer reading this newsgroup, but JIC, I've posted an analysis of this
problem at microsoft.public.windowsxp.messenger

Mystery Reg Key caused by Windows messenger:



Well it's not exactly the same problem, but it is similar, and possibly
related, particularly if Windows Messenger created your key.


--
------------------------------------------------------------------------
oshah
Control Panel -> System -> Advanced -> Error Reporting -> Choose Programs
-> Do not report errors for these programs:

Acrobat.exe
waol.exe

------------------------------------------------------------------------

[Jon]

Hi OShah

Thanks for your reply.

I didn't repost to my original thread because I wasn't sure anyone was
interested, but what I did discover is that the key

HKEY_CURRENT_USER\S\P\2846389128
(where the final number may vary according to machine)

was recreated, (if I deleted it) each time I ran Windows Messenger version
4.7.3000
It is NOT created, when running the version of Windows Messenger prior to XP
Service Pack 2 (ie version 4.7.2009)

Thanks for your analysis. Pleased that it appears to be a coding error
rather than anything else.

Jon


"OShah" > wrote in message
...
> "Jon" > wrote in
> :
>
>>
>> From the names of the 2 value keys
>>
>> "Prompt"=dword:00000000
>> "MsgPrivacy"=dword:00000001
>>
>> it's probably more likely to be related to a program like Windows
>> Messenger, than to SP2 eg an add-in I've installed. Not a major problem
>> anyhow, was just curious.
>>
>>
>
> I know it's way too late to post on this topic, and you're probably no
> longer reading this newsgroup, but JIC, I've posted an analysis of this
> problem at microsoft.public.windowsxp.messenger
>
> Mystery Reg Key caused by Windows messenger:
>
>
>
> Well it's not exactly the same problem, but it is similar, and possibly
> related, particularly if Windows Messenger created your key.
>
>
> --
> ------------------------------------------------------------------------
> oshah
> Control Panel -> System -> Advanced -> Error Reporting -> Choose Programs
> -> Do not report errors for these programs:
>
> Acrobat.exe
> waol.exe
>
> ------------------------------------------------------------------------

[Jon]

However, perhaps slightly differently from your
Windows Messenger 5.0.0.468 case is that the key also seems to be created
with Windows Messenger 4.7.3000 when

i internet access is readily available
ii Windows Messenger is not blocked by a firewall
ii and when signing in is as normal

Strange


Jon


"Jon" > wrote in message
...
> Hi OShah
>
> Thanks for your reply.
>
> I didn't repost to my original thread because I wasn't sure anyone was
> interested, but what I did discover is that the key
>
> HKEY_CURRENT_USER\S\P\2846389128
> (where the final number may vary according to machine)
>
> was recreated, (if I deleted it) each time I ran Windows Messenger
> version 4.7.3000
> It is NOT created, when running the version of Windows Messenger prior to
> XP Service Pack 2 (ie version 4.7.2009)
>
> Thanks for your analysis. Pleased that it appears to be a coding error
> rather than anything else.
>
> Jon
>
>
> "OShah" > wrote in message
> ...
>> "Jon" > wrote in
>> :
>>
>>>
>>> From the names of the 2 value keys
>>>
>>> "Prompt"=dword:00000000
>>> "MsgPrivacy"=dword:00000001
>>>
>>> it's probably more likely to be related to a program like Windows
>>> Messenger, than to SP2 eg an add-in I've installed. Not a major problem
>>> anyhow, was just curious.
>>>
>>>
>>
>> I know it's way too late to post on this topic, and you're probably no
>> longer reading this newsgroup, but JIC, I've posted an analysis of this
>> problem at microsoft.public.windowsxp.messenger
>>
>> Mystery Reg Key caused by Windows messenger:
>>
>>
>>
>> Well it's not exactly the same problem, but it is similar, and possibly
>> related, particularly if Windows Messenger created your key.
>>
>>
>> --
>> ------------------------------------------------------------------------
>> oshah
>> Control Panel -> System -> Advanced -> Error Reporting -> Choose Programs
>> -> Do not report errors for these programs:
>>
>> Acrobat.exe
>> waol.exe
>>
>> ------------------------------------------------------------------------
>
>

[Jon]

Actually I was wrong. The number in the key

HKEY_CURRENT_USER\S\P\4876289128

doesn't vary according to machine, but rather by the particular .net
password that you log in with.

So if you log onto your account using a different machine then the SAME
number is created in the subkey ie 4876289128

Also, if you use a different .net password from the same account, on the
same machine, then a separate key is created for that one, again with a
uniquely identifying number

Jon




"Jon" > wrote in message
...
> However, perhaps slightly differently from your
> Windows Messenger 5.0.0.468 case is that the key also seems to be created
> with Windows Messenger 4.7.3000 when
>
> i internet access is readily available
> ii Windows Messenger is not blocked by a firewall
> ii and when signing in is as normal
>
> Strange
>
>
> Jon
>
>
> "Jon" > wrote in message
> ...
>> Hi OShah
>>
>> Thanks for your reply.
>>
>> I didn't repost to my original thread because I wasn't sure anyone was
>> interested, but what I did discover is that the key
>>
>> HKEY_CURRENT_USER\S\P\2846389128
>> (where the final number may vary according to machine)
>>
>> was recreated, (if I deleted it) each time I ran Windows Messenger
>> version 4.7.3000
>> It is NOT created, when running the version of Windows Messenger prior to
>> XP Service Pack 2 (ie version 4.7.2009)
>>
>> Thanks for your analysis. Pleased that it appears to be a coding error
>> rather than anything else.
>>
>> Jon
>>
>>
>> "OShah" > wrote in message
>> ...
>>> "Jon" > wrote in
>>> :
>>>
>>>>
>>>> From the names of the 2 value keys
>>>>
>>>> "Prompt"=dword:00000000
>>>> "MsgPrivacy"=dword:00000001
>>>>
>>>> it's probably more likely to be related to a program like Windows
>>>> Messenger, than to SP2 eg an add-in I've installed. Not a major
>>>> problem
>>>> anyhow, was just curious.
>>>>
>>>>
>>>
>>> I know it's way too late to post on this topic, and you're probably no
>>> longer reading this newsgroup, but JIC, I've posted an analysis of this
>>> problem at microsoft.public.windowsxp.messenger
>>>
>>> Mystery Reg Key caused by Windows messenger:
>>>
>>>
>>>
>>> Well it's not exactly the same problem, but it is similar, and possibly
>>> related, particularly if Windows Messenger created your key.
>>>
>>>
>>> --
>>> ------------------------------------------------------------------------
>>> oshah
>>> Control Panel -> System -> Advanced -> Error Reporting -> Choose
>>> Programs
>>> -> Do not report errors for these programs:
>>>
>>> Acrobat.exe
>>> waol.exe
>>>
>>> ------------------------------------------------------------------------
>>
>>
>
>

[OShah]

"Jon" > wrote in news:eYJm8pAnEHA.556
@tk2msftngp13.phx.gbl:

>
> Actually I was wrong. The number in the key
>
> HKEY_CURRENT_USER\S\P\4876289128
>
> doesn't vary according to machine, but rather by the particular .net
> password that you log in with.
>
> So if you log onto your account using a different machine then the SAME
> number is created in the subkey ie 4876289128
>
> Also, if you use a different .net password from the same account, on the
> same machine, then a separate key is created for that one, again with a
> uniquely identifying number
>
> Jon
>
>
>

I was wrong, you are still reading!

In your case, that key should have been "PerPassportSettings" instead of
P. The reg key setting is a hash of your passport ID, and that key stores
settings for that user id.


This either suggests that the problem code is being utilised multiple
times, or that my spot is not the only part which suffers from WCHAR
detection troubles.


It's a good thing that Messenger is calling the char version with a
wchar_t string, and not the other way round (calling RegCreateKeyExW with
char strings). In that case you would get keys with garbage letters in
them, or a potential buffer overflow.



--
------------------------------------------------------------------------
oshah
Control Panel -> System -> Advanced -> Error Reporting -> Choose Programs
-> Do not report errors for these programs:

Acrobat.exe
waol.exe

------------------------------------------------------------------------