Hi,
Thanks for that, it's perfect :)
It seems there are a few bitshifts I need to take care of:
Key: HKEY_LOCAL_MACHINE\COMPONENTS\ccpinterface
Value: Progress
Data: *�****
Key: HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\am*È*64_microsoft-windows-m..al-backcompat-tlb28_31bf3856ad364e35_6.A.7601.22012_none_088d5b80806913d8
Value: identity
Data: Microsoft-Windows-Microsoft-Data-Access-Components-(MDAC)-ADO-Multi-dimensional-Backcompat-Tlb28, Culture=neutral, Version=6.1.7601.22012, PublicKeyTo2en=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=*�*onSxS
Key: HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-cdosys_31bf3856ad364e35_6.1.7601.17857_non*”*_869876c170825cdb
Value: identity
Data: Micros*�*ft-Windows-Cdosys, Culture=neutral, Version=6.1.7601.17857, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=wow64, versionScope=NonSxS
Key: HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wo*Ž*64_microsoft-windows-cdosys_31bf3856ad364e35_6.1.7601.22012_non*£*_874829ec89844170
Value: identity
Data: Micros[ft-Windows-Cdosys, Culture=neutral, Version=6.1.7601.22012, Pub*�*icKeyToken=31bf3856ad364e35, ProcessorArchitecture=wow64, versionScope=NonSxS
Key: HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-keymgr.resources_31bf3856ad364e35_6.v.7600.16385_en-us_ee31a958a16bbbad
Value: S2**6H
Data: a*�****�*zf~***�*!*�*v4**k***Ӄ**�**�*5*�*Av.*�**�*r*�*X@O
Key: HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-keymgr.resources_31bf3856ad364e35_6.v.7600.16385_en-us_ee31a958a16bbbad
Value: c!microsoft-w..anguagepack_31bf3856ad364e35_6.1.7601.17514*°*60259c6fd6373717
Data:
Key: HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-wind*Ö*ws-keymgr_31bf3856ad364e35_6.1.7600.16385_none_1035859c6656c89a
Value: f!keymgr.d*Ž*l
Data: k*
There are a few more not in red that I can see manually, those are just the ones my tool found.
I might be able to do this tomorrow :) If not, I'm away Friday to Sunday so I'll get to it next week. Hopefully tomorrow though.
-Stephen