Registry Look Alikes - Why?

This is a continuation of a previous discussion, that I started
awhile ago titled “Ad-Aware and SpyBot Questions”. In reality, that
earlier posting ended up being a discussion about the removal of McAfee
from my system…particularly as it related to removing registry entries
left behind after a normal Add/Remove procedure. With that as
background, let me proceed with a new, but related question.

While removing entries from the registry, I realized what PRC was
attempting to tell me in an earlier message…. that is, I have two sub
keys in my registry that are nearly the same. I will try to describe
these entries and hope that somebody can clarify why they are there.
Here goes with the details:

Registry Entry 1:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\Components]

Registry Entry 2:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components]

When looking at the two entries in my registry, all “Components” sub
keys (left side of the screen) are identical in both locations. The
values (right side of the screen), however, are not the same for 11 of
the 124 sub keys. The values in Registry Entry 1 are all included in
Registry Entry 2. Registry Entry 2, however, has the additional values
for eleven of the sub keys. I am starting to think that the additional
values are some more left-over registry entries from McAfee. Here are
the eleven that are different, with the different line highlighted (I
underlined the part that is different):

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\D5D379A05A7C8AB4D84A2DBDCAA204D8]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\Wininet.dll"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\Wininet.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\5B1D22D30129C7644BA42486B5664C06]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\Shlwapi.dll"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\Shlwapi.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\0B150AC107B12D11A9DD0006794C4E25]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\msvcrt.dll"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\msvcrt.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\1B1D70235E082D119BD50006794CED42]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\comcat.dll"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\comcat.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\3178400169C22D11A9790006794C4E25]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\olepro32.dll"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\olepro32.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\1F16F47424372D111A99000A9CA05BF0]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\stdole2.tlb"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\stdole2.tlb"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\269AF799760E1D113969000A9CF0729F]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\oleaut32.dll"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\oleaut32.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\8101D793267A2D119BE70006794CED42]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\msmask32.ocx"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\msmask32.ocx"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\194DE05C8538153498AD331EFE51EBA2]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\msxml3.dll"
"54FF1744DB266D112B95000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\msxml3.dll"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\msxml3.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\8ABB3AD57CC65D112852000B0DB2A83C]

"EC26CD4E59F56D112B45000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\sporder.dll"
"54FF1744DB266D112B95000CF44F4B53"="C?\\WINDOWS\\S YSTEM\\sporder.dll"
"00000000000000000000000000000000"="C?\\WINDOWS\\S YSTEM\\sporder.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\405302C3176F4E847BAF3178CC407D32]

"54FF1744DB266D112B95000CF44F4B53"=""

With the above exceptions, Registry Example 1 and 2 are exactly the
same.

Can anybody help me with the following questions?

Do you have a registry entry like Registry Entry 2?
If so, do you know why it is there?
How do I know whether the exceptions in the two registry entries are
McAfee or some other program?

Be assured that I am not about to do anything to my registry,
before I have good sound advice…as the old saying goes…if it ain’t
broke, don’t fix it. I will gladly post more details, if I know what is
needed.

Thanks in advance for any help you might send my way.

Frog

I have ONLY two entries under Registry entry 2:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\D8A8CD38CEF96D116922001020DCB2A4]
@=""
"BCDA1FF8B4D86D1169A1001020DCB2A4"="C:\\Progra m Files\\Common
Files\\Microsoft Shared\\DAO\\Dao350.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\588ACD38CEF96D116922001020DCB2A4]
@=""
"BCDA1FF8B4D86D1169A1001020DCB2A4"="C:\\Progra m Files\\Common
Files\\Microsoft Shared\\DAO\\Dao350.dll"

Finding Dao350.dll in C:\Program Files\Common Files\Microsoft
Shared\DAO I also note a DAOREAD.TXT file so I read it.
quote
snip
DAO 3.6 has been updated to use the Microsoft® Jet 4.0 database
engine.
snip
unquote

I suspect your large entries under this key are due to installing the
Jet stuff at the WinUP site as I never did buy into those massive Jet
invasions available there and thus I have only the two entries? Just a
guess.

I also have a Dao360.dll and perhaps the DAOREAD.TXT is for that file.
The mere mention of Jet in such an obscure location makes my hair stand
on end and I'm very grateful I never went there due to some convoluted
double talk as to why I need it from the WinUP site.

I could not pluck out the differences (exceptions?) you claim to have
posted but then I'm using Google groups on the web and it was a massive
posting with an unexpected tail which was apparently an attachment?

You might track down each file pointed to and see what it's
date/version is and then hope to find out something about what
application installed it that way. I see no point to this other than
to satisfy a natural curiosity. Caution! - that IS what killed the
cat, but you seem to have good instincts assuring us you don't intend
to do anything with the info requested. Sorry I couldn't nail it down
any further. I don't have McAfee either if that helps. The purpose of
this key appears to me to be some kind of backup info for older files,
but how this useful in any way escapes me.

Frog wrote:
snip
Can anybody help me with the following questions?

Do you have a registry entry like Registry Entry 2?
If so, do you know why it is there?
How do I know whether the exceptions in the two registry entries are
McAfee or some other program?

Be assured that I am not about to do anything to my registry,
before I have good sound advice...as the old saying goes...if it ain't
broke, don't fix it. I will gladly post more details, if I know what is
needed.

Thanks in advance for any help you might send my way.

Frog

Thanks, Lee, for responding to my message.

I do have information pertaining to Dao350.dll in my registry, but it is not mentioned in either Registry Entry 1 or 2. In addition, I
cannot find the DAOREAD.TXT file on
my C drive that you found on your system.

I know nothing about the Microsoft Jet 4.0 database engine. I do know that I
downloaded/installed all of the critical updates for Windows 98SE, as they were made available. Thus, I probably have it on my system, if
it was a critical update.

I have done a little more digging on this subject since my last message. As I stated in
an earlier "Ad-Aware and SpyBot Question", that really ended up talking about
removing McAfee from my system, I installed McAfee using the InCtrl5 software
package (a package that records all changes made to a system as software is being
installed). For some unknown reason, the installation report for this McAfee
installation was incomplete. I was able, however, to determine from this limited
InCtrl5 report that the unique entries in Registry Entry 2 (i.e.,
EC26CD4E59F56D112B45000CF44F4B53 and
54FF1744DB266D112B95000CF44F4B53) were added to
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\
Installer\Products]
during the McAfee installation process. I deduce, after finding this piece of
information, that the eleven unique sub key values observed in Registry Entry 2, when
compared with Registry Entry 1, are in fact McAfee left-behinds. If I were to remove these eleven entries from Registry Entry 2, I would
then have Registry Entry 1 and 2
exactly the same. Now I am lost---why would there be two registry entries exactly
the same? I will have to ponder this subject for a while.

Any additional thoughts or input would be appreciated.

Frog


Lee wrote:

I have ONLY two entries under Registry entry 2:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\D8A8CD38CEF96D116922001020DCB2A4]
@=""
"BCDA1FF8B4D86D1169A1001020DCB2A4"="C:\\Progra m Files\\Common
Files\\Microsoft Shared\\DAO\\Dao350.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Components\588ACD38CEF96D116922001020DCB2A4]
@=""
"BCDA1FF8B4D86D1169A1001020DCB2A4"="C:\\Progra m Files\\Common
Files\\Microsoft Shared\\DAO\\Dao350.dll"

Finding Dao350.dll in C:\Program Files\Common Files\Microsoft
Shared\DAO I also note a DAOREAD.TXT file so I read it.
quote
snip
DAO 3.6 has been updated to use the Microsoft® Jet 4.0 database
engine.
snip
unquote

I suspect your large entries under this key are due to installing the
Jet stuff at the WinUP site as I never did buy into those massive Jet
invasions available there and thus I have only the two entries? Just a
guess.

I also have a Dao360.dll and perhaps the DAOREAD.TXT is for that file.
The mere mention of Jet in such an obscure location makes my hair stand
on end and I'm very grateful I never went there due to some convoluted
double talk as to why I need it from the WinUP site.

I could not pluck out the differences (exceptions?) you claim to have
posted but then I'm using Google groups on the web and it was a massive
posting with an unexpected tail which was apparently an attachment?

You might track down each file pointed to and see what it's
date/version is and then hope to find out something about what
application installed it that way. I see no point to this other than
to satisfy a natural curiosity. Caution! - that IS what killed the
cat, but you seem to have good instincts assuring us you don't intend
to do anything with the info requested. Sorry I couldn't nail it down
any further. I don't have McAfee either if that helps. The purpose of
this key appears to me to be some kind of backup info for older files,
but how this useful in any way escapes me.

Frog wrote:
snip
Can anybody help me with the following questions?

Do you have a registry entry like Registry Entry 2?
If so, do you know why it is there?
How do I know whether the exceptions in the two registry entries are
McAfee or some other program?

Be assured that I am not about to do anything to my registry,
before I have good sound advice...as the old saying goes...if it ain't
broke, don't fix it. I will gladly post more details, if I know what is
needed.

Thanks in advance for any help you might send my way.

Frog

I
cannot find the DAOREAD.TXT file on
my C drive that you found on your system.

Its: C:\Program Files\Common Files\Microsoft Shared\DAO on my
computer. (Win98SE)
Gekko

Just in case you cant find it or havent got it, I copied mine for you.

---------------------------------------------------------
Microsoft Data Access Objects version 3.6 Readme File
---------------------------------------------------------

(c) 1998 Microsoft Corporation. All rights reserved.

This document provides late-breaking or other information that supplements
the Microsoft DAO documentation.

--------
CONTENTS
--------

1. PRODUCT DESCRIPTION

2. NEW FEATURES

3. TECHNICAL NOTES

4. KNOWN BUGS, LIMITATIONS, AND WORKAROUNDS

----------------------
1. PRODUCT DESCRIPTION
----------------------
Data Access Objects (DAO) are a set of objects that enable OLE Automation
clients to programmatically access data and modify datasources. It is used
by Access, Visual Basic and other Microsoft products to access data stored
by the Jet database, and all the other formats that Jet provides (such as
ODBC data sources including SQL Server, FoxPro, Paradox etc.).

---------------
2. NEW FEATURES
---------------
DAO 3.6 has been updated to use the Microsoft® Jet 4.0 database engine. This
includes enabling all interfaces for Unicode. Data is now provided in
unicode (internationally enabled) format rather than ANSI. No other new
features were implemented.

--------------------
3. TECHNICAL NOTES
------------------
* Jet property lengths have been changed to allow 65,500 rather than 4,096
bytes (or half those amounts in characters). Because of this change, the DAO
Field.Properties valid length has increased to 32,750 characters. However,
the TableDefs size remains at a smaller buffer of 16,383 characters, so
property lengths are effectively limited to that.

-----------------
4. KNOWN BUGS, LIMITATIONS, AND WORKAROUNDS
-----------------
The following is a list of DAO 3.6 known issues.

* Binding to an ActiveX control, such as a data bound grid, which expects
ANSI data will incorrectly display the unicode data that DAO now provides.
If this is encountered, update to an ActiveX control which supports unicode
data.

* Databases made replicable in code which have never been opened in
Microsoft Access will always have local projects (forms, reports, macros,
modules) and they can never be changed to make the project replicable. This
is because the system table which controls this functionality
(mSysAccessObjects) does not exist if the database was never opened in
Access prior to making the database replicable. Once the database is made
replicable the user cannot change the replicability of the project.

Gekko

Thanks for the information. I also found the readme file located at C:\Program
Files\Common Files\Microsoft Shared\DAO on my computer...as you pointed out in
your earlier message.

Frog


Gekko wrote:

Just in case you cant find it or havent got it, I copied mine for you.

---------------------------------------------------------
Microsoft Data Access Objects version 3.6 Readme File
---------------------------------------------------------

(c) 1998 Microsoft Corporation. All rights reserved.

This document provides late-breaking or other information that supplements
the Microsoft DAO documentation.

--------
CONTENTS
--------

1. PRODUCT DESCRIPTION

2. NEW FEATURES

3. TECHNICAL NOTES

4. KNOWN BUGS, LIMITATIONS, AND WORKAROUNDS

----------------------
1. PRODUCT DESCRIPTION
----------------------
Data Access Objects (DAO) are a set of objects that enable OLE Automation
clients to programmatically access data and modify datasources. It is used
by Access, Visual Basic and other Microsoft products to access data stored
by the Jet database, and all the other formats that Jet provides (such as
ODBC data sources including SQL Server, FoxPro, Paradox etc.).

---------------
2. NEW FEATURES
---------------
DAO 3.6 has been updated to use the Microsoft® Jet 4.0 database engine. This
includes enabling all interfaces for Unicode. Data is now provided in
unicode (internationally enabled) format rather than ANSI. No other new
features were implemented.

--------------------
3. TECHNICAL NOTES
------------------
* Jet property lengths have been changed to allow 65,500 rather than 4,096
bytes (or half those amounts in characters). Because of this change, the DAO
Field.Properties valid length has increased to 32,750 characters. However,
the TableDefs size remains at a smaller buffer of 16,383 characters, so
property lengths are effectively limited to that.

-----------------
4. KNOWN BUGS, LIMITATIONS, AND WORKAROUNDS
-----------------
The following is a list of DAO 3.6 known issues.

* Binding to an ActiveX control, such as a data bound grid, which expects
ANSI data will incorrectly display the unicode data that DAO now provides.
If this is encountered, update to an ActiveX control which supports unicode
data.

* Databases made replicable in code which have never been opened in
Microsoft Access will always have local projects (forms, reports, macros,
modules) and they can never be changed to make the project replicable. This
is because the system table which controls this functionality
(mSysAccessObjects) does not exist if the database was never opened in
Access prior to making the database replicable. Once the database is made
replicable the user cannot change the replicability of the project.

Gekko