Changed value (signature) (Windows)

Module: Registry

Supported Platforms: Windows 2000, Windows 2003, Windows 2008, Windows Vista, Windows XP

This option reports registry values that changed, according to value data signatures (CRC and/or MD5), after the last snapshot update. The Signature option in the associated template record must not be None. This option is difficult for hackers to circumvent, but the Registry module runs faster when this option is disabled.

The following table lists the error messages for the check.

Table: Error messages for Changed value (signature)

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: ESM_VALUE_SIGNATURE_CHANGED

Category: System Information

  • Windows 2000 (106733)

  • Windows 2003 (206733)

  • Windows 2008 (249733)

  • Windows Vista (229733)

  • Windows XP (201733)

Title: Registry value signature has changed

Description:The registry value's signature changed after the last snapshot update. If the change is authorized, update the snapshot. If the change is not authorized, restore the registry key to its previous state.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Signature: %s; expected: %s; comment: %s]

String ID: ESM_VALUE_TYPE_CHANGED

Category: System Information

  • Windows 2000 (106732)

  • Windows 2003 (206732)

  • Windows 2008 (249732)

  • Windows Vista (229732)

  • Windows XP (201732)

Title: Registry value type has changed

Description:The registry value's type changed after the last snapshot update. If the change is authorized, update the snapshot. If the change is not authorized, restore the registry value to its previous type.

Severity: yellow-1

Correctable: false

Snapshot Updatable: true

Template Updatable: false

Information Field Format: [Type: %s; expected: %s; comment: %s]