Recently discovered that the server program running under WIN2008R2 x64, its registry read path is:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\SZDOMAIN\ITVC1]
However, the registry, which is automatically modified by the program, is automatically redirected to:
[HKEY_CURRENT_USER\SOFTWARE\CLASSES\VIRTUALSTORE\MACHINE\SOFTWARE\WOW6432NODE\SZDOMAIN\ITVC1]
And
[hkey_users\s-1-5-21-3071037507-3784486840-4086376621-1017\software\classes\virtualstore\machine\software\ WOW6432NODE\SZDOMAIN\ITVC1]
The above two locations should be mapping relationships.
Baidu Virtualstore, found that this is UAC virtualization, starting from the Vista system, to Win7 Win8 win10 have this technology.
Write your own program again with this is a bit annoying, for the rogue software, is very good, equivalent to running in the sandbox Sandboxie.
----TODO continue to write
Canceling the Virtualstore registry [canceling UAC virtualization]