Page 5 of 6
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Fri Jan 22, 2010 6:38 pm
by crownixx
i know google too, but it just i can't find the website that -.- mention about windows created that key for
every program. Here is what i found
Try google ""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" instead of ""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY" and you will found
Microsoft website give official info about the key. Yes, the detail is also techie to me but i get the idea it is something about "driver"
Actually, the exact key
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UNLOCKERDRIVER5" was already verified by a programmer, redllar in
here.
Hmmm, that looks a driver key that only gets created by the system during a driver install, and the system goes into kernel mode,
Everybody know Nirsof, right? Now, lets say i wish to compare nirsoft
OpenedFilesView with Unlocker. Reason? Both have same objective and falls under same software category: to solve file that is locked by the system. They are similar. If you read from
nirsoft OpenedFilesView website, these are the interesting points that are more understandable by amateur like me
After filtering non-file handles, it uses a temporary device driver - NirSoftOpenedFilesDriver.sys for reading the information about each handle from the kernel memory
This device driver is automatically unloaded from the system when you exit from OpenedFilesView utility
My objective listing all the possible information regarding about the legacy key is:
-Unlocker should be considered
not stealth unlike OpenedFilesView
-Not all application require driver to be installed in order to run. I really feel that -.- making a wrong statement
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Sat Jan 23, 2010 4:38 am
by -.-
i probably made wrong statement yes lol but i dont think the legacy thing is something to worry about :S
but then again, like i said, i only worry about stealth in terms of writing files outside program folder, the registry things don't concern me as much since regfromapp comes up clean
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Sat Jan 23, 2010 8:14 am
by guinness
Unlocker Portable 1.0.0.9 is available.
* threaded splashscreen (doesn't block program execution)
* update to driver key removal on exit
* INI option to disable splash screen
* confirmed compatibility with Unlocker 1.8.8
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Sat Jan 23, 2010 10:33 am
by Ruby
crownixx wrote:-Unlocker should be considered not stealth unlike OpenedFilesView
I don't follow you here crownixx, they both create LEGACY_* keys. (see pic below Tip:)
crownixx wrote:-Not all application require driver to be installed in order to run. I really feel that -.- making a wrong statement
This is true.
-.- wrote:the registry things don't concern me as much since regfromapp comes up clean
The key is written in the registry the first time you run the program, if you delete this key in:
Code: Select all
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00*\Enum\Root
then run RegFromApp, you will see activity.
Tip: If you run a program (without monitoring the registry) and think it may have loaded a driver, you can search
for
'NewlyCreated' without quotes in your Registry Editor.
These are the sub-keys of ...\Enum\Root\LEGACY_*\0000\Control
Note: Wraithdu's AutoIt Script has
setacl to delete this key, the problem in 1.0.0.7 is that it's missing the
-ownr action to change ownership therefore not deleting it.
I see guinness has posted a new version 1.0.0.9 that seems to indicate Wraithdu has addressed this.
* update to driver key removal on exit
Going to download it now and check it out.
Update - It seems Wraithdu has indeed addressed the -ownr action in
setacl.
1.0.0.7
Code: Select all
RunWait($setacl & ' -on "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UNLOCKERDRIVER5" -ot reg -rec yes ' & _
'-actn clear -clr "dacl" ' & _
'-actn ace -ace "n:Everyone;p:full"' _
, "", @SW_HIDE)
RegDelete("HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UNLOCKERDRIVER5")
1.0.0.9
Code: Select all
RunWait($setacl & ' -on "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UNLOCKERDRIVER5" -ot reg -rec yes ' & _
'-actn setowner -ownr "n:Administrators;s:n"' _
, "", @SW_HIDE)
RunWait($setacl & ' -on "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UNLOCKERDRIVER5" -ot reg -rec yes ' & _
'-actn clear -clr "dacl" ' & _
'-actn ace -ace "n:Everyone;p:full"' _
, "", @SW_HIDE)
RegDelete("HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UNLOCKERDRIVER5")
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Sat Jan 23, 2010 8:31 pm
by crownixx
I don't follow you here crownixx, they both create LEGACY_* keys. (see pic below Tip:
Initially, i believe that when nirsoft said OpenedFilesView will unload the driver after application exit, it will remove the LEGACY_* key. I just check it out and guess i am also wrong
Apology from me because normally i confidence with nirsoft apps status are being stealth.
IMO, it is good to flag both software as not stealth and tell the user the keys that are created
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Tue Mar 09, 2010 6:58 am
by I am Baas
@guinness
I noticed you updated the entry for Unlocker to version 1.89... but the portable version is still at 1.88.
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Tue Mar 09, 2010 10:22 am
by joby_toss
And a 64bit version is on the way, hurray!
I'm stuck with LockHunter for now and it fails half the times! (why do I need this kind of tool so much?...)
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Tue Mar 09, 2010 11:02 am
by guinness
@I am Bass: I have updated again. Thanks
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Fri Jul 02, 2010 9:10 am
by joby_toss
I thought I'd never see the day...
Unlocker 1.9.0 beta for x64 - 7/1/2010
Unlocker for x64 with signed drivers is available for public beta test.
Download it
here
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Fri Jul 02, 2010 10:05 am
by guinness
I never thought it would be available! I have been using
LockHunter which is x32/x64 compatible. There are 2 obvious problems with LockHunter, it won't add files to be deleted when windows starts and second it's still BETA.
Re: Unlocker 1.8.8 - might now be portable (has a zip downlo
Posted: Mon Jul 05, 2010 9:22 am
by webfork
Finally got a chance to test. Awesome. Much better than FileAssassin, as it will do folders as well.
Update: there's a comparison of the two products over at
rarst. The jist of it is don't get rid of FileAssassin as, according to them, it performs better on some files.
Re: Unlocker 1.8.8 - might now be portable (has a zip download)
Posted: Tue Jul 06, 2010 12:16 am
by guinness
Unlocker V1.9.0 has been released for x32/x64, but the Portable version is still V1.8.8!
When you install beware of the Bing toolbar, it has a 30 second countdown timer and also there is an check box for installing a shortcut for eBay.
Change Log
- New feature: Complete support for 64 bit operating systems with signed driver.
- New language: Basque thanks to Beñat Antxustegi.
- New language: Galician thanks to Delio Docampo Cordeiro.
- New language: Macedonian thanks to Nikola Trencevski.
- New language: Malaysian thanks to Arjuna Puteraz.
- Improved behavior: No false positives for 32 bit version.
- Improved behavior: Handles are now sorted by process instead of appearing in random order when launching Unlocker.
- Improved UI: Locked DLL show as DLL instead of handle number.
- Improved UI: Fixed same process appearing differently depending on cases.
- Promotional feature: Fully optional eBay shortcuts, Bing or Quickstores toolbar depending on location.
Re: Unlocker 1.8.8 - might now be portable (has a zip downlo
Posted: Tue Oct 26, 2010 6:55 am
by Ennovy
Re: Unlocker 1.8.8 - might now be portable (has a zip downlo
Posted: Tue Oct 26, 2010 8:45 am
by I am Baas
Thanks Ennovy
.
Re: Unlocker 1.8.8 - might now be portable (has a zip downlo
Posted: Sat May 12, 2012 2:45 am
by Focuscar
Code: Select all
1 - HKLM\SYSTEM\CurrentControlSet\Enum\Root (\LEGACY_UNLOCKERDRIVER5)
2 - HKLM\SYSTEM\CurrentControlSet\services (\UnlockerDriver5
From my knowledge,
- Normally the 'ControlSet\Enum\Root' is of no importance, written for driver & used by OS.
- The 'ControlSet\services' is what we should care about - services\DriverName has entry ImagePath & may contain subkey Parameters with entries to use for e.g; during initialization.
ControlSet\services\UnlockerDriver5 has an entry
ImagePath "C:\..\UnlockerDriver5.sys", a path if incorrect will not allow Unlocker to run.
It seems that on Win7 x86, the 'Official Portable Unlocker 1.9.0' :
- creates 'services\UnlockerDriver5' on 1st run
- but then does not remove/correct the ImagePath value when run/closed
=> meaning it will not run anymore when moved to another location