Page 1 of 1

FIXED: Strange registry access

Posted: Fri Jan 30, 2009 8:55 am
by Syberdoor
I have a very strange thing happening whenever I start DVB Dream.
My Kaspersky IS2009 reports an access of MS Register Server to "hklm\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox".
More detailed analysis shows that dvbdream.exe seems to call cmd.exe which then calls regsvr32.exe the process that accesses the strange reg key.

The registry access itself seems to be unimportant, because blocking or allowing makes no difference.

The real problem for me is that it seems not possible to make a rule for the IS to permanently react to that, probably because it is a indirect call or something, so I have to click every time I start DVB Dream.

Does anybody know what causes this call?

Posted: Mon Feb 02, 2009 5:17 am
by Syberdoor
Ok I found that it was created by a call to ddreg.bat, whihc was done at every start. As far as I understand it this call is not necessary though as a one time registering of ddsource.ax should be suffieicent (maybe this is a precaution so it enver breaks?). So I have commented out the corresponding call and it works fine now