https://bugs.winehq.org/show_bug.cgi?id=26621
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |focht@gmx.net Summary|KidStarter: Fails to |KidStarter Shell installer |install |needs | |'HKLM\SOFTWARE\Microsoft\ | |\Windows | |NT\CurrentVersion\Winlogo | |n' registry key present
--- Comment #6 from Anastasius Focht focht@gmx.net --- Hello folks,
likely abandonware (no download) but well.
Austin's log shows this:
--- snip --- ... 003a:trace:msi:ACTION_CustomAction Handling custom action L"KidStarterInstallShell" (c01 L"KSCustomD" L"KidStarterInstallShell") ... 003a:trace:msi:msi_get_property returning L"austin,C:\Program Files\Brilliant Software\KidStarter\KidStarter.Shell.exe" for property L"KidStarterInstallShell" 003a:trace:msi:msi_set_property 0x14ab38 L"CustomActionData" L"austin,C:\Program Files\Brilliant Software\KidStarter\KidStarter.Shell.exe" ... 003a:trace:msi:HANDLE_CustomType1 Calling function L"KidStarterInstallShell" from L"C:\users\austin\Temp\msiaa4e.tmp" ... 0042:trace:msi:ACTION_CallDllFunction calling L"KidStarterInstallShell" ... 0042:Call msi.MsiRecordSetStringW(00000003,00000000,0e0b0f88 L"Shell path is C:\Program Files\Brilliant Software\KidStarter\KidStarter.Shell.exe") ret=057b53ea ... 0042:Call advapi32.RegOpenKeyExW(80000002,057cf130 L"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",00000000,0002001f,0553e628) ret=057b23e0 0042:Ret advapi32.RegOpenKeyExW() retval=00000002 ret=057b23e0 ... 0042:Call msi.MsiRecordSetStringW(00000003,00000000,0e0b0f88 L"Failed to open registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (2)") ret=057b53ea ... 0042:trace:msi:DllThread custom action (42) returned 1603 ... 003a:err:msi:ITERATE_Actions Execution halted, action L"KidStarterInstallShell" returned 1603 --- snip ---
Which suggests it wants to register a replacement shell. Frequently used by simple minded malware/trojans.
Regards