pbatard
commented
5 years ago Sorry, but it's not clear at all what you are asking and you also didn't bother to follow the check list, which makes it very difficult to try to help you. For instance, you don't mention the Windows 7 ISO you used to create the USB, and there are quite a few of them. Can you at least provide its SHA-1 so that we can validate that it is an official retail version?
You also seem to claim that 2 completely different and independent applications are somehow behaving in the same fashion and responsible for the same issue, which is a much extraordinary claim (I have ZERO relation with the developers of Universal USB Installer, and I certainly did not look at their source code, let alone reuse it for anything that Rufus does). Logically then, even if you may not want to hear it, the problem is most likely linked to your environment.
Especially, Rufus does not access the USB drive after it has copied files over it (though, in the case of Windows To Go, it may initiate some of the BCD operations from that drive, but since you didn't provide a log from Rufus, I have no idea if that might apply). Especially, there is exactly NOTHING in the code (which anybody can verify) that will access a registry hive residing on the USB (since this is what I am interpreting from your above report). Therefore, whatever access you see there is coming from a different application, which you will need to identify.
On the other hand, so that it can temporarily disable AutoPlay as well as read its users settings, Rufus does access the local registry hive on the system drive (i.e. NOT the USB drive, and unless Windows itself has a major bug, even a bug in the Rufus source would not result in the application erroneously accessing the USB registry hive instead of the local one), but it does so in as safe a manner as possible (especially AutoPlay is toggled through Local Group Policy settings, which is designed by Microsoft to be resilient and not leave the system in limbo in case of an issue), and none of the registry keys you list are even remotely susceptible to be accessed directly from our code. If anything, since they are certificate related, they might be invoked during digital signature verification (which is first performed by Windows when it launches Rufus, and which may also be requested by Rufus when it downloads an update), but you need to understand that, when that happens, it is Windows itself that is carrying out the process, not the application, and we can exert no control on how Windows chooses to leverage the registry during that process.
Finally you are talking about "Windows 7 sp1 retail usb created with the Rufus", but you don't indicate whether you created an installation media or a Windows To Go media (bearing in mind that Windows To Go for Windows 7 is provides "as is" as it was only formally introduced by Microsoft for Windows 8, and the option is only being provided in Rufus as a courtesy because there doesn't seem to be anything in the Windows 7 ISOs preventing its usage, but that certainly does not mean that Microsoft did design Windows 7 to work in Windows To Go mode, and we offer no warranty whatsoever with regards to the ability of a Windows 7 Windows To Go drive of running as expected).
Now the question is from which version did you made some extreme changes making the rufus to be erroneous.
I think the better question is what exactly makes you assert this, and declare that Rufus must be the culprit. Be very mindful that "innocent until proven guilty" is not a paradigm that applies only to individuals, but it also applies to applications, and, unless you can produce conclusive proof that Rufus is responsible for your registry issue (especially considering that you report certainly does not mention Rufus by name but instead states other applications or services, which can literally mean any of the dozens of applications and services that run on Windows at any one time), I will have no choice but to dismiss your report as baseless accusation, especially as you also provide no indication of where exactly the message about registry use originates from.
If you want to be taken seriously, and especially if you are inclined to point the finger at a specific application or say that is is "broken", please provide more comprehensive details to corroborate your claims.
loa11
lock[bot]
Rufus and universal usb installer both broke windows 7 its unusable anymore there are too much leftovers and errors for normal operations.
First thing that's broke is that there is broken performance and registry hive both problems pointing to the usb stick which is carrying Windows 7 sp1 retail usb created with the Rufus.
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL - 15 user registry handles leaked from \Registry\User\S-1-5-21-3838845324-2666958239-4212638696-1001: Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001 Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001 Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001 Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001 Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Microsoft\SystemCertificates\SmartCardRoot Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Microsoft\SystemCertificates\Root Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Microsoft\SystemCertificates\My Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Microsoft\SystemCertificates\CA Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Microsoft\SystemCertificates\trust Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Microsoft\SystemCertificates\TrustedPeople Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Microsoft\SystemCertificates\Disallowed Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Policies\Microsoft\SystemCertificates Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Policies\Microsoft\SystemCertificates Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Policies\Microsoft\SystemCertificates Process 460 (\Device\HarddiskVolume5\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3838845324-2666958239-4212638696-1001\Software\Policies\Microsoft\SystemCertificates
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
WMI performance issue is somehow correctable but question is what else is broken and not so obvious like above two problems.
Now the question is from which version did you made some extreme changes making the rufus to be erroneous. Seems windows is now thinking that some parts of usb installer is a root for windows. Device\HarddiskVolume5 is usb stick.