Your Friend and Mine

The Windows Registry

 What is the Registry?

► Think of as a giant 411 switchboard

► Simple idea of centralized one-stop shopping for
all of Windows’ needs
► Everything else is a GUI for it:
 Windows Control Panel
 File Associations
 Startup Folder
► Information about WHAT and WHERE things are
but not specifics on HOW to run them
 Why Edit the Registry?
► Registry is the ULTIMATE authority
► Editing it directly allows greater control over
what windows does
► Allows control over some features that don’t
have a GUI
► When things go bad…
 Editing the Registry:
The Choice is Simple
► Regedit.exe ► Regedt32.exe
 Designed for single  Designed primarily for
user registries. networked registries
 Cleaner interface  Available in Windows
 Available in all 2000, and NT
supported versions of  Merged with
Windows regedit.exe in Windows
XP
 Registry Basics
► Keysand Subkeys(Folders)
► Reg_Dword (Numbers)
 Hexadecimal (decimal)
►0x0000001 (1)
 True =1 False =0
► Reg_SZ (String)
 Stores strings (paths to files, etc.)
 Can be encrypted
 Backup First!!
► The registry stores everything that windows
knows about the computer…let that sink in.
► Backup first!
► File =>Export or File =>Backup
► “Scanreg /backup” and System Restore
► MISTAKE=FORMAT!
Organization of the Registry

Local
Machine

Current Current
Config User
Registry
(Hkey)

Classes
Users
Root
 The forgotten one-
HKey_Current_Config\
► Stores temporary information about
computer’s settings
► Barely implemented
► \Microsoft\Windows\CurrentVersion\InternetSettings (proxy enable)
 The User Database
► Personalized Settings
for Windows
 Themes
All Users
 Accessibility HKey_Users
(2k/Me/XP)
 Preferences
► The Cycle- DB
► Saved on Exit
► Edit only Current_User Current User
 Important Stuff in HKCU
► AppEvents= Themes (Event Sounds)
► ControlPanel = duh!
►ScreenSaver
►Desktop

► Software=User Preferences
►\Microsoft\Office\x.y\ (office prefs)
► These keys are usually system safe to
delete
 Important Stuff in HKCU
► AppEvents= Themes (Event Sounds)
► ControlPanel = duh!
►ScreenSaver
►Desktop

► Software=User Preferences
►\Microsoft\Office\x.y\ (office prefs)
► These keys are usually system safe to
delete
 Hkey_Classes_Root:
What should I do with that?
► Handles file
extensions/
.mp3 associations and
links to methods
(Default) ContentType OpenWithList ► Choose what
opens with what
MMJB.mp3 Icon Command (remove old apps)
 Who wins with
Icon
multiple apps
 .mp3 =>
MMJB.mp3 and
Command
mp3file
► .EXE’s + Viruses
 Hkey_Classes_Root:
What should I do with that?
► Handles file
extensions/
.mp3 associations and
links to methods
(Default) ContentType OpenWithList ► Choose what
opens with what
MMJB.mp3 Icon Command (remove old apps)
 Who wins with
Icon
multiple apps
 .mp3 =>
MMJB.mp3 and
Command
mp3file
► .EXE’s + Viruses
 Hkey_Classes_Root:
What should I do with that?
► Handles file
extensions/
.mp3 associations and
links to methods
(Default) ContentType OpenWithList ► Choose what
opens with what
MMJB.mp3 Icon Command (remove old apps)
 Who wins with
Icon
multiple apps
 .mp3 =>
MMJB.mp3 and
Command
mp3file
► .EXE’s + Viruses
 Hkey_Local_Machine

HKey_Local_Machine

Software System Hardware

\Microsoft\Windows Applications Control Sets/HW Profiles

► Software-Application Settinsg
► System- Control Sets
 Control Sets = Windows HW Profiles
► Otherwise leave it alone!
 Hkey_Local_Machine

HKey_Local_Machine

Software System Hardware

\Microsoft\Windows Applications Control Sets/HW Profiles

► Software-Application Settings
► System- Control Sets
 Control Sets = Windows HW Profiles
► Otherwise leave it alone!
 \CurrentControlSet
► \Enum\ – same as Device Mgr
► \Control\Class- Driver Database
► HKLM\System\CurrentControlSet\Services
 This is the source of a lot of errors
► \Services\VxD
 Those pesky VxD’s are stored here
\Software\Microsoft\Windows\Current Version

► /AppPath – points to registered apps

► /Run/ vs /Run-/
► /Setup/
 Change install path
 Finding CD keys (shhh!)
 Registry Tricks
► Backup first!
► If you can’t find it – Search!
► Copy to regedit.com if you’re infected by
virus.
► www.regedit.com for more info