What to Scan

The Windows Registry is not one complete file and thus may also be scanned in part.  This topic explains what the Windows Registry is, what problems are caused by errors and incongruences in the Windows Registry, and how the Windows Registry is structured.  The topic also lists the sections as scanned by Registry Booster.

 

• The Windows Registry

• Windows Registry Problems

• Windows Registry Structure

• What to Scan

• The Registry Sections Scanned by Windows Registry

 

The Windows Registry

The registry is a centralised hierarchical database used by Windows (9x, ME, NT, 2000, 2003, and XP) to store computer configuration information. This information is necessary for Windows to run your computer system including all your installed applications and hardware devices. Not only does the registry save the path and location of these items, it also retains other details which help the processor to locate applications and hardware devices quickly and efficiently thereby reduce decreasing processing time. Records are kept of each and every item present

 

Registry entries include details on:

• User profiles, settings, options and preferences

• Applications installed on the computer

• Property settings for folders and applications

• Hardware devices installed on the system

• Ports being used

• System Policies

• File Associations

 

Whenever you make any changes in your preferences or settings, installed software or hardware, these changes are stored in the Windows registry.

 

Windows Registry Problems

If your system is new, usually you will not notice the need to effect any changes to your registry. However, over time, your registry will grow as you add and remove software and hardware on your computer. These additions and deletions will cause your Windows registry to become fragmented, corrupted or full of errors.

 

 

Common errors include:

• Missing, orphaned, broken or bad application/Windows paths, shortcuts and links,

• Unwanted browser objects,

• Unused, obsolete Start Menu items,

• Missing or corrupt application IDs,

• Corrupt Active X/COM Objects,

• Residual and unused file and drivers,

• Unnecessary recent files list.

 

When you remove software from your system, for example, it is highly probable that residuals are still littering your hard drive and your registry. The result? Frequent error messages, slow start-ups, sluggishness, declining performance, system stalls, severe degradation in operating speed, unstable and frequent application errors and crashes, and, at times, even an inability to start Windows.

 

More often than not, these problems happen because:

• You install or uninstall applications including trial downloads.

• Some programmes are never really completely uninstalled leaving hard-to-find traces in your Windows registry.

• You have embedded spyware, adware or other components (such as DLLs or programmes that revive themselves on every start up.

• You have unused but undeleted drivers within your system.

• It is critical to have a healthy and clean Registry for optimum system performance and system stability. Registry entries should not be left to stagnate in your system where they may eventually cause problems.

• Keeping track of all this information is gruelling and bewildering – it’s not an easy job.

 

Windows Registry Structure

The registry database is stored in a hierarchical structure as may be seen from the screen shot below.  It may be best to conceive the registry as a tree divided into a number of areas or branches. Depending on your Windows version, the Registry comprises four to six sub-trees of keys called hives (also referred to as discrete files).

 

Each hive contains a Registry sub-tree, which has a key that serves as the root (i.e., starting point) of the tree. A registry hive is a group of keys, subkeys, and values in the registry that has a set of supporting files containing backups of its data. Subkeys and their values reside beneath the root. The values contain the actual information stored in the Registry.

 

The majority of the information in the Registry is placed there automatically by Windows when the operating system is installed. The rest comes from applications and hardware via installation routines.

 

It is also possible to edit Registry data manually, allowing you to tweak, enable or fix certain settings.  

 

 

The following screen-shots are taken from the Windows Registry Editor (type 'regedit.exe' at the Start Menu->Run prompt).

 

 

Folders represent keys in the registry (files represent hives) and are shown in the navigation area on the left side of the Registry Editor window. In the topic area on the right, the entries in a key are displayed. When you double-click a entry, it opens an editing dialog box.

 

 

As such, what you need to remember is that there are six root keys, each of which contains specific registry information:

• HKEY_CLASSES_ROOT contains file associations and OLE information necessary to launch applications. Associations define what program runs when you double-click on a file name, what Context menu items appear when you right-click on the file. For example the root stores information about Active X controls, the names of all drivers, icons used for applications and documents, information supporting the drag-and-drop feature, all the extensions and the associations between applications and documents, shortcuts, COM sections and crucial features of the Windows user interface. The root key controls all the data files.

• HKEY_CURRENT_USER contains the configuration information for the user who is currently logged on the machine. This portion of the registry links to the relevant area in the HKEY_USERS branch and cannot be edited.

• The HKEY_USERS branch contains the profiles (including all the specific data) of all the users of the particular computer. This includes such items as screen savers, start menu settings and desktop preferences, fonts, event sounds, the recent start/run entries and folder view preferences for each user including default settings for new users.

• HKEY_LOCAL_MACHINE has computer-specific configuration information used for all users who log onto computer. This key contains five-sub keys namely

• Hardware (including the system hardware database generated during boot-up, all device drivers to be loaded, IRQ hooks and DMA settings and all resource allocations for each driver)

• Security Accounts Manager (SAM) containing the user and group account database.

• Security containing security policy information.

• Software containing all configuration definitions and data for all software installed on the computer including the operating system. You will see sub-keys for each software title installed on the system.

• System information.

• HKEY_CURRENT_CONFIG contains all the relevant information relating to the hardware installed on the particular computer. This information is used by the computer at system start-up.

• HKEY_DYN_DATA stores all plug and play information on the computer. Since this configuration information requires fast modification and retrieval by Windows, it is sent to RAM since the system cannot wait for the registry to send it to the hard drive. The information in this key is created afresh every time Windows is started and is thus dynamic also changing as devices are added and removed from the system.

 

Each registry value is stored as one of six main data types:

• REG_BINARY: The data is in raw binary. Most of the information relating to hardware components is stored in this format and may be displayed by the Windows Registry Editor in hexadecimal format.

• REG_DWORD this indicates that the data type is stored in a double word, always displayed as a four-byte number. Device drivers and services parameters are often of this type and can be viewed in binary, hexadecimal, or decimal using the Registry editor.

• REG_EXPAND_SZ relates to a data string of variable length. This data type includes variables that are resolved when a program or service uses the data.

• REG_MULTI_SZ is a multiple string. Values of this type of data usually contain list or multiple values that users are able to read.

• REG_SZ relates to a fixed length text string.

• REG_FULL_RESOURCE_DESCRIPTOR are used in hardware registry keys.

 

Other data types exist however these are not available through the standard registry editors.

 

 

 

What to Scan

Several problems may occur within your registry and are generally related to registry fragmentation, and corrupt, unused, missing, orphaned or obsolete entries.

 

Fragmentation may be a serious problem and usually occurs because certain processes continually and incrementally modify the same values within the registry. This fragmentation, in certain cases, be excessive and eventually registry file sizes may exceed the Registry Size Limits imposed by Windows. This will cause any subsequent modifications to the registry to fail.

 

Other registry errors include such corrupt, unused, missing, orphaned or obsolete entries as:

• Registry integrity and shell folder entries including My Documents, profiles and favourites.

• Software locations including missing, orphaned, broken or bad application/Windows paths, and links.

• Unwanted browser objects.

• Corrupt Active X/COM Objects.

• Unused, obsolete Start Menu items.

• Redundant Startup applications and uninstalled application schedulers.

• Orphaned shortcuts, temporary (.tmp) files and Scandisk or Checkdisk fragment (.chk) files.

• Missing or corrupt application IDs.

• Obsolete shared DLLs and folders.

• Unused help file references and resources.

• Residual and unused files.

• Uninstalled software remnants.

• Unused and unwanted drivers.

• File extensions and associations.

• Unnecessary fonts and recent files list.

 

 

The Registry Sections Scanned by Registry Booster

Registry Booster scans the following sections for the above errors:

• ActiveX, OLE and COM

• User Software Settings

• System Software Settings

• Shared DLLs Section

• System Drivers

• File Extensions

• Application Paths

• Fonts Section

• Invalid File Associations

• Startup Sections

• Sound and AppEvents

• Uninstall Sections

• Help Section

 

This can be seen from the screen shot below:

 

 

 

 

What's Next?

Complete Registry Scans