Runalyzer freezes under WinPE 2005

[Leolo]

Hi,

I'm trying to use Runalyzer under WinPE 2005, but it just freezes and stops responding whenever I double clic an entry from the host computer in order to view it.

The WinPE 2005 CD is an original CD, not a backup. (Actually, the name stamped on the CD is "Windows 2003 SP1 OEM Preinstallation Kit", but everyone refers to it as "WinPE 2005")

Oh, and by the way, Spybot v1.4 doesn't work under WinPE 2005 either. It refuses to run. The process closes just a few seconds after launch without showing anything on the screen.

Are there any solutions or workarounds?

Many thanks in advance,
Best regards.

[Leolo]

Please, please, please could you modify your program to make it compatible with Windows PE 2005 ?

RunAlyzer could be very useful to fight malware, but only if it didn't freeze!

I beg you please, please, please, make it compatible with WinPE 2005!

PLEASE!

[PepiMK]

Hmmmm I didn't see this before. What exactly did you use to create that CD? Barts PE-Builder? If so, which version?
Spybot-S&D was included successfully on a bunch of PE-CDs attached to computer magazines, so it should run with it quite well...

[Leolo]

Thank you very much for your reply.

I didn't create the CD. I obtained it from Microsoft.

I've just sent you a private message with additional information about WinPE, please check your private inbox.

Thanks a lot.
Regards.

[PepiMK]

Heise page
That's a page by the Heise Verlag (company who publishes German computer magazine c't) that includes a link to an updated Spybot-S&D version that should work on PE.

I'm not sure if this really works on the versions you informed me about (thanks), but I'm continuing to test it (that was a bit delayed due to the external HD containing my virtual machines crashing. Took some time to get all the backups back ).

edit: I tracked the problem back to some file path routines. Seems to be the missing CSIDL_COMMONAPPDATA and CSIDL_APPDATA. In that case Spybot-S&D uses %temp%, but that doesn't exist either.
This is a special case - which folder to choose for recovery files etc. on such a PE disk? Maybe we should display a popup to allow to choose one (to be able to select a USB stick or local harddisk), because I haven't found even a RAM disk like on BartPE CDs...
For now, I've updated it to create a folder C:\PERepairData\ , and if that is not possible either, showing a folder selection popup.

Testing RunAlyzer will follow next... ok, I see the problem, whenever opening one of the groups...

[PepiMK]

Ok, we found the RunAlyzer problem; NtQuerySystemInformation(SystemHandleInformation, ...) does not work on PE. Can't really blame MS for this as they clearly say this function may change from version to version.

[Leolo]

Hi PepiMK,

Thank you very much for the info. I've set the variable %temp% with this command:

set temp=c:\windows\temp

and it works very well. It's a nice workaround for me in the meantime.

I look forward to the next version of RunAlyzer. I hope the problem with that API function can be resolved.

Thanks again,
Best regards.

[PepiMK]

Could you please try this beta? Handle information in the process list is now shown only on OS versions I know that are compatible, so this crash shouldn't happen any longer.

[Leolo]

Hi PepiMK,

Thanks for the new beta. I can successfully run it under WinPE 2005 now (I have tested it both under VPC2004 SP1 and also in my physical computer, booting from CD). The only problem is that whenever you click on an item, this error pops up:



Thankfully, you can close the error dialog and continue to use the program normally. The error only pops up when you click an item.

Also, I've noticed that Sysinternal's Autoruns program detects a few registry entries that RunAlyzer doesn't detect yet.

Do you have plans to add detection for more registry entries in the future?

If so, could you add the entries currently detected by Autoruns? (You can see the entire list by checking "include empty locations" in the Options menu in Autoruns)

Thanks a million.
Best regards.

[PepiMK]

Glad to hear it (mostly) works

The RichEdit is probably about the "More information" tab in the lower pane, which would use formatted text with information about the key or value currently selected. RichEdit is basically a RTF-compatible text display (& editing if wanted) field; there are a bunch of different RichEdit control versions out there is the problem. I'll see if I can do something about this!

And yes, we're always thinking about adding more entries, and I think we've already got a list of entries to add

Oh, and on that screenshot I see a problem about the "Hide legit" button... it really needs an icon to make the autosize behave correctly