I see a funny registry entry - any way to find out what it is?

[riffwraith]

Hi all.

I found a funny-looking registry entry earlier. Tho maleware and A/V scans reveal nothing, I am still concerned about this. If I open the binary value, I see gibberish. Is there any way to c&p this to make sense out of it? Any other ideas?

Thanks in advance.

 

[cyclops]

Snap a screen shot of it and paste it here, someone is bound to look at it. I could compare it to mine

 

[riffwraith]

It's the Pencil entry. I googled "pencil entry in registry" and some other like terms, but cam up with nothing. It's in the HCU>SW tree.

Is there any way to paste the data that's in the binary value box? I can copy it, but not paste it.

Thanks!

 

[cyclops]

My HCU>SW tree is too different. I have nothing close to all the programs you have installed, but it has got to have something to do with a graphics type program is my best guess. Good luck

 

[UsernameIssues]

Scroll down the info in that small window and see if there is any text that could give you a clue.


Use Process Monitor to see what app reads that key.

Create a filter for rryWgNuAu8gJHj



Set a backing file via Menu > Backing files...

Let Process Monitor gather data while you open and close various apps.

If you need help starting and stopping the data collection, search Google for some Process Monitor videos.

 

[jumanji]

Pencil seems to be related to some drawing program. It could be a GIMP plugin. Generally it may be associated with any photo drawing program. You may have to look into any such programs you may have installed. (There is also a program called Pencil by Evolus but you would have known it if you had installed it.) - just my quick research. Nothing authoritative .

 

[riffwraith]

Thanks for the replies!

My HCU>SW tree is too different.

I figured as much; thanks anyway.

Use Process Monitor to see what app reads that key.

Good idea - thanks. Unfortunately, procmon does not work here. In an effort to find out why, I did a search and the only useful result I got was this:

http://serverfault.com/questions/341043/process-monitor-fails-to-start-on-a-64-bit-computer

So, I installed Visual Studio 2010 (took almost an hour ) and now I can open the exe. BUT - I don't get the instructions in that link. In the resource tree, expand the "BINRES" node... huh??? Where is the resource tree? How do I expand the "BINRES" node? Did a search there as well, but didn't come up with anything worthwhile. So, I tried an app I already have called resourcehacker, but can't extract the .exe... not to sure I want to start d/l-ing other 3rd party apps I am not familiar with just to try and get that .exe

Pencil seems to be related to some drawing program.

Could be, but I really have no ideas as to what.

Good ideas - keep 'em comin'!

Cheers.

 

[UsernameIssues]

Try the exe in the attached zip.

 

[riffwraith]

Try the exe in the attached zip.

That works, thanks!

So, before I even tried creating a filter, I did a search for that string in PM, and found:



So it seems as tho this is tied to my sequencer, Cubase. Which, of course, is a wanted and legit app.

Weird, that entry does not show up in my Vista registry, where I have the same version of Cubase installed. I guess it's ok then... maybe I will email tech support and dbl-check.

Thanks for the help!

 

[UsernameIssues]

Glad that you found the app

Process Monitor is a nice tool to have around.