 sj |
||
|
||
Tech: Windows Registry
|
|
|
Subject: Tech: Windows Registry From: michaelr Date: 17 Jan 04 - 04:43 PM Recently, when upgrading to Norton SystemWorks 2004, I experienced a corrupt installation and had to manually delete files from the Windows registry. I have reason to believe that I deleted more files than I should have. Norton directed me to make a backup of the registry before deleting files, which I did. My question is: How do I restore the backed-up registry, so that I can go back and delete just the right files? Thanks for the help, Michael |
|
Subject: RE: Tech: Windows Registry From: Stilly River Sage Date: 17 Jan 04 - 05:14 PM I would use Windows Explorer, click on the saved good file and drag and drop a copy that over the top of the corrupt one in it's Windows location. If it looks like the whole good file is moving and not just a copy of it, right click on it and select "copy" then move your mouse over the corrupt file and right click then choose "paste." Or do Control-C and Control-V if you are comfortable with them. Try your editing again, but keep that clean copy in elsewhere until you're sure you've got it right. SRS |
|
Subject: RE: Tech: Windows Registry From: Dreadnought Date: 17 Jan 04 - 05:34 PM Assuming you know the name of the file the registry was backed up too - it'll be something like backup.reg I think you right click on it and select the Merge option from the pop-up menu. I say I think that's the way to do it because whilst I know this works if you want to add a registry key but I'm not 100% sure that it will replace any changed entries. In any event it shouldn't do any harm to your system to try. To be honest your best bet might be to just re-install Norton and see if it sorts itself out. Hope that helps. |
|
Subject: RE: Tech: Windows Registry From: Stilly River Sage Date: 17 Jan 04 - 05:50 PM I can't see merging files as an answer in this instance. By dragging and dropping the extra copy of the file over the corrupt file you're replacing the ruined file, allowing yourself to start from scratch. You don't need to speculate about what may have been replaced. It has been my recent experience that you should uninstall the old Norton program before installing or upgrading the new one. Parts of the program won't install properly otherwise. So fix your corrupt registry back to the way it was, then uninstall the old Norton program, then install the new version. I think you'll find it works just fine. SRS |
|
Subject: RE: Tech: Windows Registry From: Amergin Date: 17 Jan 04 - 06:14 PM you go back to the registry editor and click on the registry button (in 98 it is called registry...i think in xp it is actually called file)... then you select import registry... if you have xp...or me then you can just restore your pc to earlier time using the system restore utility.... |
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 17 Jan 04 - 07:11 PM If you have used the "export" from regedit or from regedt32 to make the backup, per normal procedure, the backup file is an executable. If you find the backup, which should have a .reg extension, and double-click it, all information in the backup will be restored to the registry. You do NOT have to right click, import, open regedit, or anything else. Just execute the back up by double-clicking it. You do have the option, in either of the regedit programs, of backing up "partial" branches of the registry, and the import functions can sometimes be useful if you've done something like this; but for restoring a "whole registry" backup, all you need to do is double click the file in WinExplorer. The "import" function in the registry editors allows you to bring a "foreign" registry into regedit (or regedt32) where you can manipulate it, extract parts of it to "export" to separate .reg files, and such; but it does not make the import part of YOUR registry until, and unless, you do a save to registry. The caution should be noted that the only safe way to "look at" a file with .reg extension is to open it (import) into regedit. If you double-click on the file, its contents will become part of your registry. Because of the hazard associated with inadvertent restores, it is advisable that you make a separate folder for any manual backups, and put NOTHING except manual backups in it. When you make a manual backup, you should always include the current date in the filename (040117_backup.reg would be a good name today). Put them away, and leave them alone unless you actually need them. When you restore from a .reg file, it will put all "keys" that exist in the backup back to the backed up values. It will NOT remove any new keys that may have been created after the backup was made, and of course, it won't change the "values" stored in any new keys. It's thus a sort of "imperfect" recovery, a little better than nothing at all. It's often better, if you think you've messed something up, to go back to the script you used to make changes, and step back through what you did, to make sure it's right, before attempting to restore from backup. Doing a restore before you check your work can confuse the issue, since it mixes your mistake(s) in with restored stuff. It's a lot easier to track what you did to find where you went wrong if you have a "clean" record of your own steps. The most common "error" when working in regedit is ignoring the critical fact that all keys are case sensitive. If you put a lower case "a" where the script calls for an upper case "A" you broke it. Look also for inadvertent spaces, "." "," etc. (Side note: if you don't know exactly what you're doing, you should never make changes using regedit unless you have a trusted script in front of you that shows exactly what you should do. Get the script back out and recheck your work before you attempt a restore.) John |
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 17 Jan 04 - 07:25 PM Stilly - Unfortunately, drag and drop doesn't work, because the registry isn't a single file - so there's no place to "drop" the backup. The registry consists of some 30 or more files splattered all over the system. Regedit (or regedt32) assembles the "keys" from all over the place, and puts them in the appropriate places when you save to system, but finding the right place manually would be a very taxing process. The advice about uninstalling an older Norton before installing the new one is good. The "uninstall" utility should, of course be used. Just deleting files won't work. It's not always necessary; but unfortunately they don't tell you when you should and when it's okay to overlay a new one. michaelr - Executing the .reg backup file you made should put all the keys back in. You'll then probably need to go back and do your deletions again, since the ones you meant to delete will be restored along with any you took out by accident. Follow the script, and never click the mouse until you've had a deep breath and counted at least to 3, while you check each step. There are hazards there, but nothing that should bite you if you're careful. John |
|
Subject: RE: Tech: Windows Registry From: Stilly River Sage Date: 17 Jan 04 - 09:50 PM John, it goes without saying these days that the uninstall function should be used. Deleting a program doesn't remove all of the extra stuff written to the registry and such. The trouble with Win's uninstall program is that it isn't complete either. I had good luck with a Norton utility for installing and uninstalling, but I haven't put the new version on this computer. I understand about executing the registry backup, but it isn't a perfect solution if by saving it you save the mistakes in with the original registry. I have successfully edited my registry, and done it in just one place. I can't speak to all of the places it might occur, as you say, except to note that I've had difficulty with an email program that has bits and pieces stored all over. I tried updating, errors got into the mix, and uninstalling and starting over again doesn't work because there is too much left behind in all of those registry places. It's a pain in the backside. SRS |
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 17 Jan 04 - 11:49 PM Stilly - Quite a few programs have their own uninstall utility, and most versions of Norton that I've seen do put an uninstall script in the Norton/Symantec folder somewhere. If you use the uninstall that you find in the folder for the program, you frequently get better results than just going into Windows uninstall. It varies with the program, and disk cleanup can, sometimes, delete uninstall scripts to save space. It is generally true that most uninstall software doesn't really do a good job of getting all the registry entries backed out, whether use the program's own uninstall, the Windows program manager, or another utility. The system is just too big, and there are too many interrelated/crossbred functions for any convenient process to handle. It doesn't usually hurt anything to have "dead entries" in the registry, but it is something of a concern. I know that (most) experienced users don't need to be reminded that you don't just delete, but you never know who's looking in that would get in trouble if we don't remind them. Didn't mean to pick on ya' - just wanted to avoid giving the innocent bystanders incomplete info. I don't know what you're referring to when you say you've edited your registry ... in one place. When you open regedit, it collects information from all over the system. You can do it all in regedit, but when you save back to the system and exit, it splatters individual data bits back all over the place. There is no file properly called "the registry" in Windows, so there's no place to drag to. There are a couple of files that might look like that's what they are, ... but they ain't really. I don't doubt that you know what you're doing, it's just that my old brain doesn't "understand" it. Some identifiable individual files do contain "registry information," and are separately "editable," but I wouldn't call fixing one of them a "registry" operation. Executing the .reg file should put back all the keys that were present when you exported it. If you did the backup before you made the mistake, then it should put you back to where you started. You obviously don't want to restore mistakes. The whole idea of doing a registry backup before messing with the registry is to be able to go back to the precise point at which you started that procedure where you screwed up. You can use regedit to import a backup .reg, (without saving it to system) and then re-export individual branches of the registry tree to smaller, separated, .reg files. Then you can either import only the "branch" or just execute it, to change a particular isolated function. This can sometimes be useful if you're "developing" an entry, but it's not very useful for routine maintenance. (A few people have been known to advocate things like exporting a couple of different "printer registry trees" or "display monitor trees" so that you can "swap" setups by just executing the selected tree .reg. It doesn't work, though, because of the inability of the .reg execute to delete the unwanted version. You just end up with multiple keys or multiple values for a key. Windows tolerates this surprisingly well, and some people really believe they've accomplished something. We won't disillusion them?) Some programmers/operators feel its sufficient to export only the branch(s) you intend to work on as a back up, but for the typical user a "whole registry" backup is usually more appropriate. Half the mistakes probably happen while you're looking for the branch you want to change. A somewhat common problem with newer versions is also using the wrong regedit. Regedit.exe, the older version, is what you usually use to "survey" and look for the problem. You can do quite a lot there, but you cannot create a "DOUBLE" class key in regedit.exe, and some of the Win2K and WinXP keys require key properties that regedit.exe can't manipulate. Regedt32.exe (note the missing "i") is the newer editor designed to manipulate the new keys, but some genius left out the ability to search the structure in this program, so you have to know where a key is in order to get to it. (You probably do, if you should be using this program, but...) The result is that you use regedit to find it, then reopen in regedt32 to change it, for anything complex. To some extent in regedit, and absolutely in regedt32, you don't just type in an entry. You must use the "edit," "create," and other buttons on the toolbar or you won't be assured of getting a fully functional operator. That's one of the reasons that most support instructions are limited to removing problem keys - delete usually works okay, although there's a button for it that should be used - and inserting new correct keys is usually left up to program control when you re-install the problem software. If the key existed when the backup was made, it will be recreated if necessary when you execute a .reg, and the value(s) it had when you made the backup will be inserted. If you have added a new key since the backup, or have inserted a new value for an existing one, the new key and the new value will usually remain after the .reg execute. Some keys are "single value," in which case the one you edited-in will be replaced with the restored one, but many keys can have as many "value" arguments as happen to loose in the woods. By design, Windows doesn't usually get too bothered by extra ones, as long as at least one good one is present (but there's always the exception.) For the email program that scattered bits, you might try using regedit's Edit-Find to search for the program name, or a fragment of it, to find where it's pieces are. Backup first, of course, but it's usually safe to delete a key that's obviously not wanted, so you can possibly do some worthwhile cleanup. If it does get "broke," restoring back to the pre-edit "imperfect" is better than being dead, which is the purpose of the pre-edit backup. John |
|
Subject: RE: Tech: Windows Registry From: Stilly River Sage Date: 18 Jan 04 - 12:15 AM Lots of things going on there. I hope michaelr can make something of it. I feel somewhat guilty for having continued the discussion to such an extent that you had to type in so much information as followup! I was using regedit when I worked on my registry--it has been a number of years and most likely an operating system or two back. I think I was trying to get a program to install properly that we used to connect to the computer system at the library where I work. An early version of Citrix. It has been a long time, but I have looked at snippits of the registry stuff since then for various reasons. I didn't have the grasp of where all it comes from, apparently. My email problem will eventually work itself out--meanwhile, I use an older version of the same program and it works just fine. The new version has created an extra "identity" that is orphaned right now. I've searched on a unique term in the program (put there for that reason) and found strands of the program everywhere. SRS |
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 18 Jan 04 - 01:16 AM If michaelr got a good backup, executing it should put him back to where he started. Then, of course, he can start over on the edit he was trying to do. It's a fascinating subject, and so deep it's hard to know when to stop. I think my best point probably would have been about 16 paragraphs ago. John |
|
Subject: RE: Tech: Windows Registry From: michaelr Date: 18 Jan 04 - 03:42 PM Thanks John and everyone else who had advice. I should have mentioned that I use Win98 SE... does that change anything as far as procedure? Thanks again, Michael |
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 18 Jan 04 - 04:54 PM michaelr - No change for Win98SE. Just double click your backup .reg and then start your original fix over. Of course - it goes without saying(?) - whenever you make a significant change, always reboot before you proceed. That goes double (literally) for any changes to the registry. (If there's anything at all strange about the first reboot, do it again even.) The only difference of significance, for discussion and thread drift purposes, is that you don't have to worry about any of that stuff about regedt32 because Win98SE doesn't include it, and doesn't need it. John |
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 19 Jan 04 - 12:24 AM I thought we'd about beat this thing to death, but it has been brought to my attention that Microsoft has a Knowledge Base article that tells you to use "the other way" of backing up the registry. The article is a rather old one, written for Win98SE, but users might be referred to it by a support org. The autorepair function writes a backup registry at boot (or maybe it writes it at shutdown, but it uses it at boot), and you can run scanreg.exe to "force" a manual backup. Running scanreg puts a new .cab file in the same place where autorepair does its normal stuff. Every time you re-boot, the registry is scanned, and if Windows finds something "wrong," it goes to the "last good" .cab and "fixes" it. It also, then or at next shutdown, writes a new .cab file, replacing the oldest of 5 (Win98SE) that it keeps. The advantage of this method is, perhaps, that the autorepair system has a "fresh" pre-edit .cab to work with. The difficulty is that the user has no control over when a "restore" is going to happen. It will happen at the next boot if Windows thinks it's sick. If you've used scanreg for your backup, you have nothing to restore. This is not a problem, if you trust Windows to know when, whether, if, and how to do it for you. If you've rebooted a couple of times, there's also no real way to know which .cab file is the one you created - unless you knew you needed to keep track of when you made it (or made a copy somewhere that Windows can't overwrite it). Most of the comments above seem to have assumed the normal export from regedit as the backup method. I see no harm in doing both, and for anything very complex I think I'd feel better with a .reg tucked away somewhere. You will do both if you follow the normal good practices for regedit: 1. Close all files. 2. Reboot to make sure the machine is clean (which makes a new scanreg .cab) 3. Open regedit and export a new, dated .reg. 4. Make your edits 5. Save to system and exit. 6. Reboot (which lets the .cab be "mined for fixes" - which you can't prevent) I guess I was aware of, but had forgotten about, the scanreg backup. When it first came out, many people didn't have a lot of faith in the autorepair function, so it was never much used (When Win98SE was a baby). It may also have been less appropriate when you had more complex fixes to make fairly routinely. I'll have to poke around a bit to see if people have developed more faith in it now, and if there have been new backup procedure recommendations for the newer versions, that I might have missed. John |
|
Subject: RE: Tech: Windows Registry From: ard mhacha Date: 19 Jan 04 - 04:43 PM John, You are a mine of information, don`t ever leave this Site. |
|
Subject: RE: Tech: Windows Registry From: michaelr Date: 19 Jan 04 - 05:43 PM Yes, I did use "the other way" as instructed by Microsoft Knowledge Base Article 256419 "How to Back up the Registry in Win98 and WinME", which Norton referred me to. It appears there's no way to retrieve that backup, as it's been overwritten every time I've started the computer since (if I understand John correctly; it's probably plain by now that I know very little about how Windows works). The reason I know that I deleted too many registry keys, because I remember at the time clicking on a key I was supposed to delete, whereupon another took its place which looked almost exactly like it, so I thought it had not been deleted and clicked again. I did this twice during the process, and distinctly remember the "uh-oh" feeling that came over me! If, as John explains, the registry "fixes itself" at re-boot, I suppose those keys were restored. (I have no idea what they were, only that they were next to some of the ten or so keys that Norton told me to delete.) I suspect now that this may be completely unrelated to the problem I have, which is that immediately after I did those registry edits, Norton SystemWorks' One Button Checkup showed a disk integrity problem and directed me to run Disk Doctor, which showed "lost clusters in chains" or something like that. Could there be a connection, or am I barking up the wrong tree? Cheers, Michael |
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 19 Jan 04 - 07:12 PM michaelr Assuming that the autorepair function worked as intended, the backup that was made has already been applied. Even if you could recover it, doing it again wouldn't change anything. It's been taken care of for you. The "lost clusters in chains" has worried people for as long as we've had a way to put things in clusters. Back in the old days, when disks (floppy or hard, glass, metal, plastic, or any other kind) were barely reliable enough to be useful, it was fairly common to actually "lose" something. "Lost clusters" could sometimes be recovered to piece together something useful. Of course the files these clusters escaped from, and the clusters themselves, were small enough that you could spend a few hours and maybe make sense of them. When you write a file to the "root" of your drive, the name of the file goes in the File Allocation Table, and the location of the first cluster goes there with it. When you write a file in a folder, the same info goes into the folder file. Newer systems put more information in both places, but in the old days the computer had to go to the first cluster of a file in order to find the location of the second ... and so on through all the clusters in the file. Each cluster passed it on to the next cluster, until it finished reading the file. It wasn't until about DOS 3.x(?) that each cluster was given the location of the preceding one so that you could backtrack (sometimes) to the top of the file. Obviously, if even one cluster got messed up, you couldn't find the next one, so you couldn't finish reading the file. IF you stumbled across a "good" cluster, you could follow the "rest of the string" and you'd have the tail end of your file, which, maybe, you could use for some useful purpose. That tail end could be a "lost cluster" or "lost cluster string." With modern drives, in normal condition, you don't often lose a "good" file, but sometimes when a file gets moved around, some clusters in the old location don't get "marked" as being emptied. You are extremely unlikely to find lost clusters on a modern drive, with any "current" operating system, for any other reason. Generally, a new version is written, then verified, before it's location is written into the FAT (or folder). It's essentially a lost cluster until that is done. When the cluster location for start of file is written in the FAT/folder, the old version becomes a lost cluster until each cluster it uses is marked as "empty." If the new write isn't finished, then the old file is still good. There is never a time when one or the other of the versions isn't good, but there are times when either version could be, essentiall, a string of lost clusters. There's a setting on your disk check program where you can tell it to "automatically fix errors" that will avoid ever seeing these lost clusters. You might as well use it. There's very little the ordinary user could do with them, and in all but the rarest of cases there's no reason to worry about them. Throw them away. The "disk integrity" problem can result from any ABEND (ABnormal END of program), as might result if you turned the switch off before the machine finished a shutdown. One notorious cause of lost clusters occurs on a few laptops, where moving the mouse while the "sleep mode" is being entered can scramble something. With a couple of very specific versions of Windows (and a couple of other op systems), leaving programs open when you reboot can cause it. The machine shuts down before there's time to save all the open files, close all the applications, and finish writing everything to disk. There are a few other fairly well known causes, but in most cases the clusters you'll recover now are from all those thousands of "state" files that Windows uses to keep track of it's current run. Windows tries to save lots of them when you shut down, but creates new ones anyway on the next startup, making them mostly superfluous. You will NOT lose anything that's already on the disk, even with the most radical ABEND. At most, you might lose some current task that's still partially in memory waiting to be written, and for something extremely valuable you might recover some of it from the lost clusters. Only the FBI can afford to do it. You can't, by any practical means, recover anything from those lost strings. Discard them, pull your britches up, and just get back at it, and don't worry about them. The autorepair function in Windows works during boot. If you did make an error in your registry edit, the shut down after your edit may have been "abnormal." An abnormal shutdown is the condition that causes the system, or your disk monitoring program, to demand a disk integrity check during the next startup. Once you rebooted, and disk autorepair did it's thing, you shouldn't have another abnormal shutdown, and shouldn't see the message on the next boot. If you didn't see that message repeatedly, that's another indication that the autofix worked. John |
|
Subject: RE: Tech: Windows Registry From: michaelr Date: 19 Jan 04 - 07:21 PM Ah, thanks again John! You are a scholar and a gentleman. Now I can sleep again! Cheers, Michael |
|
Subject: RE: Tech: Windows Registry From: GUEST,.gargoyle Date: 19 Jan 04 - 09:48 PM Norton and MS do not "play-well-together."
|
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 20 Jan 04 - 12:52 AM Gargoyle - It's not quite certain that 98-support has retired. Microsoft withdrew "free support" for Win98 about two years ago, and announced that they would not make upgrades or patches for it "except in emergencies" then. They recently announced a "no support" policy, but have withdrawn that position, largely due to the very large number of non-US users of Win98 (and even older systems). It is uncertain how long they will continue to support Win98, but they're sort of stuck for the present. As with a lot of such things, Microsoft gets the blame, but it's really pretty much political. Import-Export regulations prohibit shipping some parts of the newer systems to some areas, so the latest systems are unavailable to large numbers of users. Fear of pirating of the software in some countries that will not support copyright also limits their enthusiasm about exporting. (Some of these places have draconian copyright laws, but no enforcement; and mass commercial piracy has been well documented.) As to the "recent Browser-Wars Settlement," there has been no "settlement" that I've heard of. An low level appeals court did order Microsoft to make some minimal payments based on a lower court jury award, but the patent on which the award was based is still being questioned by many, is under review by a couple of standards organizations, and by W3. It is quite likely that there will be additional appeals, and it is far from certain that the original award will be upheld. Microsoft has already planned changes to their browsers, in case they do not get a favorable ruling; but every browser will have to make similar changes, and/or pay royalties if Microsoft is not successful in court. The html spec is being rewritten by the standards committee to be available if needed, but will likely take on a severely crippled form if the patent is upheld. The war is still very much on, and Microsoft is not the only one who could lose. John |
|
Subject: RE: Tech: Windows Registry From: HuwG Date: 20 Jan 04 - 02:59 AM If I might nitpick for a moment ... The backed up registry file is not an executable program, strictly speaking. On initial setup, Windows (of all flavours from Win 95 onwards, and NT) should associate the ".reg" file suffix with regedit.exe. (Regedit, if given a file name as an argument on execution, will attempt to import the file and merge it into the registry). Ironically, the association is itself held in the registry. It is possible to delete this association, either with regedit, or in the "Folder Options" pull-down menu from the "My Computer" icon or Windows Explorer. It requires considerable determination to thus cripple your own system, but I have seen it done. (It is also possible to change this association so as to replace regedit as the standard registry editor with a program of your own. At your own risk, of course.) All this does not change the effect; if you double-click on a ".reg" file, regedit will try and merge it into the registry. It ought to ask you for confirmation of course. When a file is merged into the registry, any keys in the file which are not in the registry will be added; the values of any keys in the registry which are also in the file will be changed to the values in the file. No keys will be deleted by a merge. This may lead to "widows" and "orphans" in the registry i.e. keys which reference other non-existent keys, or keys which are not referenced anywhere else in the registry or the operating system. However, this should not be a problem. However, keys which were created as the result of the installation of a program should be removed if the program is uninstalled. |
|
Subject: RE: Tech: Windows Registry From: JohnInKansas Date: 20 Jan 04 - 06:54 AM Quite true. The program that does the "execution" is regedit, by association with the file type .reg. If you run regedit and open (import) a .reg file, the file remains open and is not saved until you tell it to do so. In most cases, when you double-click an associated file type, the file merely opens, using the registered program. In the special case of double clicking the .reg and using the .reg association with regedit, the file opens, imports, saves, and exits, without you're ever seeing that regedit is involved, so the behaviour is a little bit "special," when compared to the "ordinary" file association function. It's a little like the distinction that, strictly speaking, a batch file (.bat) is not an executable. It's just a script for running DOS (command.com). Command.com is the executable file that runs when you "run" a .bat. (And isn't the "association" internal to command.com in this case as well?) The distinction is worth noting, and is critical if you're speaking "programmer;" but in the context of a "user maintenance" discussion it seems acceptable to say that a .reg "executes" rather than the more cumbersome "double clicking will allow regedit to run an unattended restore operation." A sometimes similar situation applies to the uninstall "programs" saved when you use a "wizard" installation of a program. They "act like" executables, and may contain "program" elements; but they are often just scripts to be run by the Windows program management utilities. The difficulty in uninstall is that a key originally added to the registry might be used by another program installed later; and "possibly shared" keys are a great excuse for leaving bits and pieces when a program is uninstalled, so "dead" keys can grow on a system. By design (they say), Windows tolerates them pretty well, but they can slow things down and cleaning, manually if you know how or with a "regclean" type of utility, can be beneficial if done appropriately. John |
|
Subject: RE: Tech: Windows Registry From: Stilly River Sage Date: 20 Jan 04 - 10:19 AM This discussion has certainly gone full-circle. Now John will discuss how to delete keys from the registry (the act that got michaelr into trouble in the first place!) :) SRS |
| Share Thread: |