RegAlyzer, It looks like a bug to me
Summary
---------
RegAlyzer search returns 2 items in the list, but both lead to the same registry key
RegAlyzer shows more data than RegEdit for this key, but only shows values for the data in common with RegEdit.
RegEdit search leads to another key. It contains exactly the same data that shows without value in RegAlyzer.
Background
------------
I was checking out a system clean up utility. It indicated I had an unnecessary startup entry. It wasn't in my startup folder, so I decided to search the registry for it.
I have a HP Pavilion laptop with 64 bit Vista, all updates and patches applied. The startup entry turned out to be for the built-in web-cam.
Here is what RegAlyzer found when I searched for "UCam_Menu"
------------------------------------------------------------------
Key= My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value= UCam_Menu
Data=""
This was repeated twice on the Search-dialog, results-tab. Double-clicking either one took me to
My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
in the RegAlyzer main window. This key is in the SOFTWARE-branch with the "64" folder icon.
The Run-key showed 16 items on the Data tab
The first 6 were listed with the ab-icon, type REG_SZ and showed values. The other 10 (including UCam_Menu) were listed with the 01-icon, type REG_NONE and no values.
What RegEdit Showed
-----------------------
When I searched for "UCam_Menu" with RegEdit it found it in:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run.
This key listed exactly the same 10 items that were shown as REG_NONE by RegAlyzer, but RegEdit showed them as type REG_SZ and with values. This was the only place RegEdit could find "UCam_Menu".
With RegEdit, I could also navigate to a key called the same as the key found by RegAlyzer, i.e.,
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
This key showed exactly the same data items that were shown as REG_SZ by RegAlyzer and with the same values.
Back to RegAlyzer
-------------------
I entered:
My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
directly in the address bar. It took me to a key of that name. It was in the SOFTWARE branch with the 64 folder icon.
RegAlyzer showed the exact same data items that I saw in RegEdit for the same key.
I guess RegAlyzer isn't handling 64-bit data properly. Maybe it is good to have all the Run data presented together, but in that case it must be a view where edit and export works correctly.
Another thing:
I notice that RegAlyzer shows 7 hives, but RegEdit only shows 5. The additional ones in RegAlyzer are My Computer\HKEY_PERFORMANCE_DATA and My Computer\HKEY_DYN_DATA. What are they?
I like the RegAlyzer interface much better than RegEdit, but I don't feel I can trust it when I find anomalies like this. I hope I am doing something wrong and that someone can explain what I should do instead.
Thanks!
