Reg Organizer stuck when making snapshot

[Chemtable Software]

Hi,

Sorry, but we only need RegistryTracing.log, not RegistryTracingDemo.log. All files other than RegistryTracing.log are not required either.

[Dobrus]

I'm sorry, my mistake. In attachment is a file you wanted.

[Chemtable Software]

Hi,

Here is the updated application. Please run it again. It will probably no longer hang. Anyway please send the resulting file RegistryTracing.log from your desktop:
https://files.chemtable.com/special/Reg ... gDemo3.zip

[Dobrus]

Hi, It's still the same. Program finished with the same error.

RegistryTracing.log is in the attachment.

[Chemtable Software]

Hi,

The problem is almost localized, please repeat with the new version and send the RegistryTracing.log file:
https://files.chemtable.com/special/Reg ... gDemo4.zip

[Dobrus]

Newest log is in the attachment as always. So can you tell me more about this, what causes this problem and why? regards.

[Chemtable Software]

Hi,

The most likely the reason for this is that access to some of the registry keys within HKEY_LOCAL_MACHINE\SYSTEM is incorrectly blocked by some driver(?). Instead of returning an access denied error, it simply doesn't return control to our application when accessing the WinAPI function.
This time we have added the detection of this type of blocking, please check the version below:

https://files.chemtable.com/special/Reg ... gDemo5.zip

The log file as before is appreciated (even if this version does not hang).

[Dobrus]

Hello, this time the test went very quickly, but as usual, the same error occurred. In the log generated by the program, I noticed that the last key it attempted to access was "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control". Strangely enough, even when using REGEDIT, an error pops up when I attempt to access that key. Is this normal? I am aware that some keys require additional permissions that the administrator might not have access to, but in this case, it seems to be a read error. I have attached a screenshot of the mentioned error. Unfortunately, it is in Polish, but translated into English, it means "Unable to display: Error while reading content," or something along those lines. I'm not entirely sure about the exact wording on the English version of Windows. The problem also persists in Windows safe mode, and even if I try to run it as "SYSTEM". I have also created a new administrator profile in the system and tried again, but it hasn't change anything. Could this be due to a virus or something similar? The strange thing is that I formatted the drive and installed a fresh system roughly around the time when I created this topic. Regards.

Edit: In Reg Organizer there is no problem accessing that key in registry, also I can export all keys to .reg file without any issue. Also scanned system with Malwarebytes, Microsoft Removal Tool, Zemana Anti-Malware - everything looks clean.


EDIT2!: Reg Organizer works without problems (apps from you also) if I change the Default value in "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control" to anything else. I also noticed that by creating a copy of that key in Reg Organizer to the .reg file it has an additional entry which changes "Default" value:

""=hex:7b,fb,6d,0b,39,11,0f,8b,ce,19,57,fb,9a,9b,86,7b,8a,45,e9,1b,df,ec,3d,a2,\
5a,a7,dd,7a,9f,cc,4e,4b,c6,e0,7f,30,99,ee,b6,da,24,9d,68,a8,03,ef,28,6b,43,\
62,8f,54,a0,3e,eb,c7,13,d5,7c,84,3a,d8,96,f8,d3,56,6e,40,04,e7,7b,c0,9d,35,\
92,10,53,70,30,b7,7d,d0,43,a8,17,9e,c6,59,bc,1f,a3,bd,65,a9,3e,75,53,e2,f9,\
5f,50,f0,81,c3,11,e0,dd,44,97,b1,78,35,79,a6,55,d1,16,11,b7,f4,69,bb,dc,0e,\
f2,3d,93,d8,5a,94,ec,13,1e,8b,54,05,f9,96,ea,9b,36,54,ed,63,f9,6a,ee,13,2d,\
3c,29,51,3a,6a,70,74,ab,8b,d1,70,ca,01,59,e8,4d,f4,9b,22,78,a5,a0,da,01,93,\
1e,c7,72,66,8f,4c,c1,aa,e3,25,85,51,ef,5f,b9,ba,e0,58,c9,ed,6a,c1,7c,a0,4f,\
80,51,98,a9,83,8c,cc,4d,0c,e5,d7,40,d2,03,ed,8e,c7,f4,17,a9,7a,b1,48,33,db,\
1a,b2,3a,24,34,19,e2,7b,ce,8f,05,79,c6,05,1a,e6,b3,e7,70,ea,62,d2,73,e8,f3,\
be,27,cd,45,c3,b1,eb,c6,0a,49,a9,09,2e,ff,d9,7c,28,0b,0c,90,6d,9d,2d,39,b2,\
ee,31,b0,e2,1f,3c,11,c1,17,a5,5d,f2,c7,92,c7,75,a5,f3,fe,99,83,57,25,3b,a3,\
c6,28,b1,4b,55,38,d5,b6,01,03,0d,dc,ec,a5,9b,fc,76,5f,25,e9,28,32,2f,74,7f,\
c9,8e,6e,1a,f8,a8,71,07,fe,4b,1a,34,22,8f,3a,b7,a5,4b,5b,5e,df,64,55,d4,c7,\
97,e5,52,a0,86,73,26,42,eb,b6,91,c5,3c,14,f0,1b,77,3f,0e,46,58,de,71,73,ea,\
2d,52,6c,38,2f,1e,b7,61,28,29,4c,87,cb,aa,a0,47,8d,a7,5d,94,73,b3,b5,a9,55,\
c8,8d,9a,2b,12,b7,2e,2c,1a,ea,d0,ec,47,29,f2,50,74,17,ee,f5,9f,28,7b,f5,77,\
77,62,33,d3,51,38,9d,2e,c4,fc,ff,d8,51,52,cb,22,b1,f1,0b,d6,81,b3,55,63,e2,\
4b,8b,85,f7,6c,8f,bb,16,c3,d0,02,61,97,cf,de,b3,cd,0f,83,3e,55,a8,d9,6c,55,\
69,9c,9a,bf,ff,aa,21,20,83,ed,a4,1c,74,86,35,2f,4c,5c,dd,dc,b0,22,38,f6,b3,\
60,50,5d,e1,f7,e4,7e,2d,9c,15,f7,e7,6c,f9,4d,92,5e,58,70,39,25,ad,63,62,98,\
a3,f7,0e,99,fd,21,1d,fc,56,40,7c,5c,19,80,93,df,40,3c,f7,f1,c8,9a,63,c9,b5,\
9c,36,20,c5,9c,87,51,8b,1d,63,01,a6,1d,bd,4a,62,bd,6a,4e,43,a5,62,bc,c6,bc,\
1d,11,f8,9e,46,be,3e,54,ca,32,fc,f6,b9,e3,3e,93,eb,c6,15,52,31,29,3b,3e,84,\
71,0f,c0,25,2f,8b,bd,de,a5,94,5b,af,97,1b,14,6f,22,aa,0e,c0,b2,35,d1,db,08,\
68,b6,8c,10,ab,e2,56,33,bc,db,4d,84,02,54,0f,d1,98,a5,6c,5a,43,77,04,cc,9c,\
2b,d8,7e,2f,e1,b9,32,00,f9,c3,70,9f,98,72,fc,2d,90,21,d5,38,74,e3,24,bb,41,\
c1,83,e7,ff,86,70,c8,cd,f2,00,95,04,3b,e2,55,11,c1,1c,01,d5,e9,b6,55,21,97,\
69,53,ca,04,72,aa,87,79,59,cb,21,b9,25,f2,ca,4f,37,1f,8e,04,80,80,b4,29,75,\
f0,61,6b,5e,af,d0,19,8b,e1,3b,f7,8b,6a,6b,7c,1b,79

I tried to import the .reg file into the registry made in Reg Organizer (in REGEDIT I couldn't do the export of this key from the registry at all) and that's how I came across this solution, I have no idea what the hexadecimal entries mean, but I noticed that the problem only occurs if the default value is not set (you can set anything and the installation monitoring in RO will start working properly). Maybe you will know something about this, because it doesn't make any sense to me, since on another computer something like this doesn't occur. I also do not know what effect changing this value has. At this point I changed the binary data by adding zero and the value looks empty, the problem does not occur (that means no error in Regedit and RO works well). Thank you and best regards.

[Chemtable Software]

Hello,

We have tried to reproduce the problem with the registry value you specified, but to no avail: it works fine on our systems. Am I right that the problem no longer reproduces on your system after changing the value of this key?
We can only guess at the reason: it could be a physical error on the disk or a driver failure. Have you checked your drives for errors (using the built-in Windows utility)?

[Dobrus]

Hi. The problem is not when this value is set, but when no value is set - it is only visible when exporting the entry with external software (e.g. Reg Organizer or Glary Utilities). When I do an export of this entry and then import it back (using external software) then the "Default" value shows up as just that hex string I mentioned earlier. So the problem only occurs if in regedit the value of "Default" is set to "value not set". So this hex string also fixes the problem - it does not cause it. I was simply wondering where this hex value was coming from, as system REGEDIT does not see it at all. The drives were scanned with chkdsk, also SFC and DISM were run - everything looks fine. Perhaps in fact one of the drivers may be causing this error, this is something I am unable to determine. Since changing the "Default" value fixes the problem then maybe I should stop there and enjoy the Reg Organizer functioning, but I am curious about the real source of the problem.