Need some help

(imported topic written by Boomer91)

I am having problems getting my relevance to work that looks for the value of a DWORD String (GinaDLL). This is what I have, I keep getting Singular expression refers to nonexistent object.

exists value “pssogina.dll” of key “Software\microsoft\windows nt\CurrentVersion\winlogon\GinaDLL” of key “HKEY_LOCAL_MACHINE” of registry

Where am I going wrong?

(imported comment written by jeremylam)

From your first sentence, it sounds like GinaDLL is the name of the value, not the key.

Does

exists value “GinaDLL” of key “Software\microsoft\windows nt\CurrentVersion\winlogon” of key “HKEY_LOCAL_MACHINE” of registry

return true?

If so, the correct way to check if the value of GinaDLL is pssogina.dll would be

exists value “GinaDLL” whose (it as string = “pssogina.dll”) of key “HKLM\Software\microsoft\windows nt\CurrentVersion\winlogon” of registry

There’s also the chance that you’re on a 64-bit system, and need to inspect the x64 registry instead of just “registry”.

(imported comment written by Boomer91)

It returns false when I run the QNA tool

(imported comment written by Boomer91)

The name of the Key is GinaDLL, the type is REG_SZ and the data is pssogina.dll. Does that help?

Chris

(imported comment written by Bill.Ehardt)

Try native registry, and possibly the as lowercase:

exists value “GinaDLL” whose (it as string as lowercase = “pssogina.dll”) of key “HKLM\Software\microsoft\windows nt\CurrentVersion\winlogon” of native registry

(imported comment written by Boomer91)

That resolved it. Thank you for the help.