Registry Drill

by Easy Desk Software
http://www.easydesksoftware.com

If any of the Help buttons fail to open the help file, or you wish to use a different browser add the value name "Help" to the Registry key HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Registry Drill\Content and set the value to point to your browser.
Example: Help=C:\Program Files\Internet Explorer\Iexplore.exe

Note: The term NT_Platform applies to Windows NT, 2000,2003, 2008, XP, Vista, Windows 7.
NTFS means New Technology File System (NT_Platform)

CONTENTS
Ordering
Other Software
Getting Started Please read this section completely before using the Drill
Auto Clean the Registry
Compacting
Damaged Keys
Deep Scan
Find CLSID Pointers
How To Make a Repair File
More Help For the Registry Drill
Possible Invalid CLSID
Resetting Permissions
Restoring - Backing up a Registry Key
Registering Files
Search Services
Special Notes
Special Notes for Vista & Newer Versions
Selecting a different Browser to view the Help file
Understanding the Registry
Using the Search & Replace Tool
Using the Find CLSID Pointers Tool
What is a Key or Value
Additional help information is made available at our site's "More Help for Registry Drill".

Deep Drill Tasks and Errors:
Using the Deep Drill
File or Path does not exist
Illegal Characters
Invalid Entries
Invalid Class Keys
Shared DLLs

Quick Drill Tasks:
A Common Error - Read This
Search Root Keys for Bad Pointers
Search CLSID\TypeLib
View Uninstall Keys
Search Shell\Open\Command Keys
Search Interface Keys
Search for missing CLSID Keys
View Software Keys
Search TypeLib Keys
Search Shell Extensions
Sound Events
Search Drivers

 


Getting Started

Registry Drill is such a in-depth Registry tool that the only limitations to repairing or working with the registry is your imagination.

The Registry Drill's Deep Drill examines every Key in the Registry in order to determine if all the correct format requirements are met.

In this way, the Registry Drill is able to dig deeper than conventional Registry cleaners, and it offers the convenience of both a Quick Drill and a more thorough Deep Drill. The Deep Drill can take several hours to go through the Registry, so it is recommended that you start with the Quick Drill and "Search Root Keys".

Because the Registry is very complex, and because software vendors do not always write to the Registry in the intended format, a conventional Registry cleaner cannot readily determine if a given CLSID Key is really needed in your Registry.

For example, some vendors store program information at Keys not intended for this purpose. A good example of this is Norton's NIS program, which stores a string value for its trial version in a CLSID Key. A CLSID Key should only store pointers to a file, such as its default icon, the TypeLib Key needed to create an interface object, and so on. Conventional cleaners bypass such instances by weakening their formal requirements, creating numerous exceptions, and as a consequence they also fail to clean the Registry with the rigor that is due.

The Quick Drill does not have any such exceptions written into its source code; and this ensures that any and all illegitimate Keys are found. The Deep Drill takes this process even further, and identifies every invalid fragment of the Registry, whether it be a file name, path, URL, email address, pointer to another Key, improper character, invalid binary data, extended string, or any other invalid entries.

The Registry Drill does not remove any Key or Key value automatically, nor does it delete any files. It displays the invalid Keys that are found, and allows you to view and correct or delete them. You may make a decision as to whether a Key is valid or not by reading the associated help file section, below. In 90% of cases, the Keys that the Registry Drill will find are safe to delete. Any exceptions to the rule are determined by viewing the information at the Key, using RegEdit, reading the help file, and applying common sense. If you are in the Deep Drill use the "back" feature and Export the Registry. Many of the tools will automatically backup each key before it is deleted; you should always make a complete backup before working with the Registry. Many tools will also create logs for edits and deletions.

Before deleting a Key you should review the Key and its value, by calling up RegEdit from within the Drill. This will allow you to determine if the Key merely contains a correctable error or is wholly invalid. For example, sometimes, as with Photo Shop 5, an entry in the Registry Data contains an empty space. It will look like this "{6DECC242-87EF-11CF-86B4-4445535540000} " (notice the blank space at the end ) instead of "{6DECC242-87EF-11CF-86B4-4445535540000}". Use the Go To Key option, and when you are finished viewing the Key in RegEdit close RegEdit. If you leave RegEdit open, the Registry Drill may not be able to locate the next Key that you wish to view.

Fix the entry if possible, and rerun the function. If the Key remains unfixed it is likely to be an invalid Key, and will require deletion.

If you are not sure about deleting a specific Key, then backup the individual Key, in addition to any precautionary backup of the whole Registry. The Key may then easily be restored at a later date, if necessary.

After deleting a Key it is suggested that you open the associated software (if the Key pointed to a piece of software you know) before going on, so that you can ensure that the Key was not needed. Do one function of the Drill at a time, reboot and test the system. If all is well make a new backup of the Registry. After completing all the Quick Drill functions repeat the process, since in deleting some Keys, new invalid Keys may have been uncovered.

When registering files you may get a message from Regsrv32: "Load Library ("c:\program") failed. GetLastError returns 0x00000485.", this means that the file cannot be registered using Regsrv32.exe and that the program that installed it, or that uses it, must register the file.

Certain preliminary precautions will ensure that the best use is made of the Registry Drill.

1) It is highly recommended that you use the Auto Clean to clean out the Registry first. Following this procedure can save you lots of time when you start using the Registry Drill. The Auto Cleaner works on the principle of checking file references made in the Registry, and deleting any Key found with an invalid file reference. Other Registry cleaners use broadly similar methods.

2) You should also cleanup the System folder of any unnecessary DLL files. You can use a free program like Clean System Directory to accomplish this.

3) You may also wish to cleanup your hard drive of all the programs and files you no longer want.

These measures will ensure that the Registry will be as correct as possible when you finish using the Registry Drill.

 4) Always make a precautionary backup of the Registry first, before starting to use the Registry Drill.

Please note that the Registry Drill is designed for users that already have some basic knowledge of the operating system. Easy Desk Software is therefore not able to offer any further technical support on issues of Key deletion, file registration, software associations, or the like.

After deleting a Key it is suggested that you open the software (if the Key pointed to a piece of software you know) before going on so that you can ensure that the Key was not needed. Do one function at a time, reboot and test the system. If all is well make a new backup of the Registry. After completing all the Quick Drills functions repeat the process, since you may have deleted some Keys, some new invalid Keys may be uncovered.

When registering files you may get a message from Regsrv32: "Load Library ("c:\program") failed. GetLastError returns 0x00000485.". This means that the file cannot be registered using Regsrv32.exe and the program that installed it or that uses it must register the file. And in some cases the file may be corrupt, in which case you can try replacing the file and registering it.

Additional help information is made available at our site's "More Help for Registry Drill".

Back to Table of Contents


Special Notes

Sometimes you will see an error with the path to a file uses %, as in %systemroot%. If the Key is not a Reg_Expand or REG_MULTI then the key information is incorrect. The information in the Key should read as C:\Windows\???????? instead of %systemroot%\????

Entries found that have a question mark instead of a colon in the Drive path (C?\Windows) need to be repaired.

1) There maybe some Keys in your Registry that store information about some shareware that maybe on your system. Information like the date to shut down, etc. Many of these Keys the Registry Drill will find as invalid and may suggest deleting the Key. In some cases deleting the Key will cause the shareware not to operate. It is wise that you create a full backup of the Registry using the Registry Drill and save it. You should also backup each Key before deleting it.

2) When you select the Help file from the Registry Drill interface it will open to the section that applies to the last function you used that is covered in this help file.

2A) To select a different browser for viewing help files other then your default browser add a string value to the key HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Registry Drill\Content, "Help" and set the Data value to the path and file name you wish to use. Example; C:\Program Files\Internet Explorer\Iexplore.exe

3) If you use the Go to Key in Drill and the Key name contains a space as in "Internet Explorer", RegEdit may not bring you to the exact Key. It may bring you to the first Key with "Internet". This is caused by RegEdit not recognizing the space.

4) The Registry Drill refers to Hives, Keys, Value Names, and Value Data. If you do not already know what these are, open the Registry with RegEdit and read the descriptions below while viewing the Registry.

Back to Table of Contents


 

Special Notes for Users of Windows Vista & Newer Versions

You may not like reading boring help files; but as a user of Vista or a newer version of Windows this section can save you a lot of frustration. If you have any questions about the fore coming information, please contact us at techsupp@easydesksoftware.com

Many tools in the Drill will not work correctly unless you are in Trusted Administartor mode. The other two modes are strickly for diagnosing software problems.

Users of Vista & newer versions of Windows must reset permissions as explained below; in both the file system and Registry before using Registry Drill. You should also disable the User Account Control (UAC). This can be done in the control panel using the User Accounts applet.

As an opening note; Regedit runs at a higher permissions level than Windows allows The Administrator(The Administrator is not a member of the Administrators group).  In Vista and newer versions, Administrators and The Administrator are just users unless they give themselves permission to make changes. Keys and data displayed in Regedit may not be able to be read by normal software running as The Administrator or User/Administrators.

Before deleting any Registry Keys you should make a backup of the Registry using the Export Registry button found in the More Tools button. You MUST be in Trusted Administrator mode, the User / Administrator and The Administrator mode do not have enough permissions to read all the Keys to make a full backup. Although Registry Drill will automatically make a backup of the Keys it deletes, it will not be able to read all the Keys it is deleting unless it is running in Trusted mode. So a full backup using the Export Registry tool is required.

If you must delete a Key while NOT in Trusted Administrator mode, use the Damage Key tool and place a check mark in the NO_READ NO_WRITE box, do the search and reset the Keys permissions first so that Registry Drill can make a backup of that Key when you delete it.

In order to use Registry Drill

Registry Drill will startup and offer to run in one of three permission modes.

Back to Table of Contents


Resetting Permissions

Resetting Registry Key permissions can only be done on the NT_Platform. Keys that the Auto Clean tool complains about have been incorrectly set by some piece of software. A known case has been Flash, which sets some Keys to Deny the user "Everyone" but it allows users and administrators. Everyone over rides all other permissions for the other users in the list; hence, no one has permissions.

Registry Drill has a Reset Permissions tool under the "And More Tools" button. It will change the permissions on the Key requested and its' SubKeys. But it will not change permissions on the SubKeys' Subkey.If you attempt to reset a Key and it fails, try using Reset Ownership and then Reset Permissions again.

To manually change permissions:

Close RegEdit and continue cleaning the Registry.

If you use the the Permissions tool in Registry Drill it will reset permissions to a Default setting. It will change the permissions on the Key requested and its' SubKeys. But it will not change permissions on the SubKeys' Subkey. If you find that the Drill is unable to delete a Key, the problem maybe that SubKeys' of the Key you want to delete has Subkeys with permissions stopping you from deleting the Key. In this case you would need to have the drill reset it's permissions or do this manually and using the Advanced button, select "Replace permission entries on all child objects ......".

Registry Drill will attempt to reset permissions on all Keys it deletes.

Back to Table of Contents


Auto Cleaning

This function is a standard Registry Cleaner with some added features. When used on the Windows Platform the software can repair permissions get permissions of any Key by right clicking the Key. The Right click also offers an option to never delete a Key or do not delete once.

The cleaner will find Keys that point to non-existing files, and other Keys pointing to the Keys it posts. As well as other Keys with bad pointer. Items found in this tools are generally total safe to delete if you have used the Find damaged Keys tool first and repaired them. Keys found in the Damaged Key tool that must be repaired before cleaning are all the Keys in HKLM\Software\Classes\??????. If you have a large amount of this Keys you may need to reset the Hive HKEY_CLASSES_ROOT.

Some path/file names found may contain a switch that is none standard and the Drill cannot verify the correct path. You should review all the information displayed. If the file name contains a switch be sure to remove it from the list. You should also view each Key in RegEdit before having the Drill delete the Key.

It will not remove MRU Keys that point to non-existing files. MRU Keys are cleaned in the Deep Scan tool, found in the More Tools button.

What is a MRU Key? They contains the list of items you entered into the Start > Run box and other common windows such as the Open and Save dialog windows, files you open in a dialog box, the Search Window list or URLs visited in your browser. As well as many software last opened files lists.

Back to Table of Contents


Damaged Keys

You must be an Administrator to use this tool
(Users of Vista and newer versions of Windows can use this tool in User mode for diagnosing problems. Repairs can be done in User mode if needed. However, it is recommended that you Save the report in User mode and restart the Drill in Trusted mode > Load the report and make repairs.)

This Tool searches the entire Registry for Keys that are damaged and will be marked as ERROR_BADKEY. Keys with NO_PERMISSIONS , and ERROR_KEYNAME.

Additional Search for Keys with NO_READ or NO_WRITE can be perform, and reset to Full Control.

To repair or rest a Key double click on the Key and select Repair Key. If the repair is unsuccessful use the Go to Key function, and give yourself permissions to view and edit the Key. The Key should have at least Administrators, Users, System permissions. To check permissions, on the menu bar (File, Edit, View) select Edit > Permissions. NOTE: If the Read Control is set only under Special Permissions, software cannot read it. For more on this click the button About Permissions.

Once you have checked permissions, rerun the Damaged Key tool. If the Key is still marked as ERROR_BADKEY then use the Drills Repair Key function and rerun the tool

If the Key is still damaged then try exporting the Key manually. If you can Export the Key and the Export is not a zero byte file then you can delete the Key or rename the Key. Now Import the file by double clicking on it or using RegEdit to import the file.

If you are unable to export the Key but you can read the Key, try renaming the Key and manually create a new Key with the original name and build the Key yourself.

ERROR_BADNAME keys are Keys that have a leading space or a trailing backslash ( \ ). These keys are most likely errors in the program that created them. In most cases you will find a second key that matches the bad named key without the spaces or backslash. Back a backup of the key and try deleting it. If the key returns later on there is nothing you can do with it. It there is no other key with the same name but without leading spaces, do not delete the key.

NO_READ or NO_WRITE key should be reset to allow Administrators and the current user full control with the exception of the following list . See Resetting Permissions

HKCU\Software\Microsoft\Protected Storage System Provider\S-1-5-21-???????????
HKCU\Software\Microsoft\SystemCertificates\Root\ProtectedRoots
HKLM\SAM
HKLM\Security
HKLM\SOFTWARE\Microsoft\Remote Desktop\Pending Help Session
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Credentials
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties
HKLM\SYSTEM\CurrentControlSet\Control\ServiceCurrent
HKLM\SYSTEM\CurrentControlSet\Enum
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\DS
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\LSA
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\NetDDE Object
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\SC Manager
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Security Account Manager
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security\Spooler
HKLM\SYSTEM\CurrentControlSet\Services\MRxDAV\EncryptedDirectories

If you use the Repair All Keys tool, all keys under then following will not be repaired. You will need to use the the Repair Key tool for those Keys.
HKLM\SYSTEM\CurrentControlSet\Enum
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security
HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E9
HKLM\SYSTEM\CurrentControlSet\Services\MRxDAV
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security
Any key that is not NO_READ_NOWRITE or NOPERMISSIONS will not be repaired with the Repair All Keys tool

Back to Table of Contents


Search Services

A Common Error - Read This

This Tool searches the System\CurrentControlSet\Services Key on the NT_Platform . It does not appear on the Windows 9x Platform.

This tool looks for services that point to none existing files. In several cases you may find that a ImagePath points to a file with no file extension. These entries should be corrected to point to the file with an extension, rather than delete the Key. A good reason for this is that some Malware (spies, worms, etc) will install a file such as svchost.dll and the key point to svchost with no extension, the OS will look for the first file with the name svchost and may find svchost.dll first instead of svchost.exe.

If you delete a Service Key be must manually delete its associated Key if one is displayed in the Drills information Window. Check the associated Key first to ensure that the Key points back to the Service you are deleting. It may point back (reference) to a different service, in which case do not delete the associated Key.

Back to Table of Contents


Possible Invalid CLSID

CLSID Keys found in this tool are displayed because they have an improper structure (missing information) or are not a valid GUID ( "{+ 36 characters + }" ) or do not contain 4 "-". Some programs will create a Key that is improperly structured for storing their own software information. Trojans and worm wills also create them for the same reason.

The AppID Keys that are listed did not have a Service or a permissions that they point to.

A search the internet option is available by double clicking on the key, when in doubt, use the search option to help make a decision on what to do with the Key. On a brand new Windows installation the list will consist of only about 2 CLSID Keys and no AppID Keys, all which Windows creates.

Back to Table of Contents


Deep Scan

The Deep Scan tool search the entire current Registry for file names and Directories. When one is found it verifies that the file or directory exists, if not it is added to the list. The Auto Scan tool should be used before using this tool, in order to cut down the number of entries you will need to verify.

You may find many entries that point to a file that is not on your hard drive, such as Keyboard layout files. These Keyboard file entries should not be removed if they are reported in the list. The entire list should be reviewed before deleting all entries.

Reviewing each Key by using the Go To Key function will ensure that you make a good decision on what to do with the Key. Since almost all auto lean Registry Scanners use this type of scan, it is not 100% safe to delete all entries. This type of scan should turn up quit a few errors. But not all are safe to delete and leaving these entries will not effect your system. They only add bulk to the Registry.

Back to Table of Contents


Registering Files

If you need to manually register a file and your system is not already setup to do this, double click on the file you wish to register. If it is a DLL file, in the Open With dialog box select Windows\System\Regsrv32.exe and check the box "Always open with". If it is an OCX file select Regocx32.exe.

Back to Table of Contents


Restoring - Backing up a Registry Key

If you have the Registry Drill backup a Key for you and you get a message that it "could not backup the Key" then either the Key is damaged, it may have already been delete, or it may be too long a Registry Key name for RegEdit to read as a passed parameter (a command the Registry Drill sends to RegEdit). Attempt to manually export the Key.

To create a Registry backup use the button on the Registry Drill's main interface labeled "Export Registry". The Export method is used because it allows you to restore the Registry without removing any newly added information. When you save the Registry files System.dat and User.dat files and then restore them you are removing any newly added information in the Registry.

It is always wise to create a backup of each Key you are about to delete, the Drill with automatically backup Keys in most tools, even though you have used the Registry Drill to create a full backup. This way in the event you find a single Key that needs to be restored you do not need to add back all the other information you have removed that you no longer want in the Registry.

To make a backup of the Key, open RegEdit, click on the Key you wish to backup so to highlight it. Then select the Menu Item "Registry" on the Menu Bar on top of RegEdit. Next select "Export Registry File" and save the file with a name that is in 8.3 format (12345678.reg, max 8 characters and a file extension). You do not need to add the extension ".reg" as RegEdit will do that for you.

To restore a Registry Key while you are in Windows, copy the Reg file to your Desktop. Then double click on it. Or you may use the Registry Drill to restore a saved Key.

If you are in DOS copy the Reg file to the Windows folder, type the following: RegEdit ?????. (where ????? is the name of the file) then press the enter button.

Back to Table of Contents


Compacting

This feature is disabled on the NT_Platform, the NT_Platform does not have DOS .

Read this entire section before Cleaning and Compacting the Registry. Be sure to make a current backup of the Registry before compacting. You should also make a startup disk if you do not already have a current one. It is recommended that this section be printed out!

You should also check your memory; you will need to have a minimum of 569,000 bytes of memory available in DOS. If you use buffer, stacks, or files in the Config.sys, rename the Config.sys before rebooting. This will increase your available memory. If you do not have enough available memory in DOS then this process will stop before it is completed.

Use this feature after you have made all repairs to the Registry. You will find that after all the repairs have been made and the Registry has been compacted, Windows will boot quicker and operate smoother.

If you have Windows Millennium you will need your startup diskette. You need to reboot with your startup diskette in drive A. When you get to an A prompt type C:\autoexec and the compacting will start. You do not have the option of Command prompt only, so you will select "start without CD-ROM support"

This feature should not be used if the Registry is corrupted, as the operation is highly likely to fail during the Compacting stage. If RegRepair tells you that the Registry is corrupted while attempting to "Clean and Compact the Registry" you should visit our site and read the page "How to repair the Registry". You MUST use Scandisk before Compacting. If you do not, you may have an error on your hard drive and your system will hang up during the building (Cleaning and Compacting) of the new Registry. If this happens, reboot and try a second time. Your machine may (in rare cases) not continue to boot to Windows after finishing Compacting and may reboot and try to Clean and Compact over again. If the second time hangs, then reboot and press the F8 key to display the bootup menu and select command prompt only from the bootup menu. Then at the C prompt type the word Clean and reboot. If you are unable to get to the Boot menu use your startup disk to reboot your computer to the A prompt than type:
C: (press enter)
Clean (press enter)

If you need to replace the Registry continue:
cd\windows (press enter)
Attrib -h -r -s System.dat (press enter)
Attrib -h -r -s User.dat (press enter)
copy System.sav System.dat (press enter)
copy User.sav User.dat (press enter)
Press Ctl-Alt-Del to reboot

If your Registry is corrupted (you get an error in the boot log or a notice on bootup to Windows) the Compacting process will stop. If you system hangs during the compacting stage you have a disk power saver on, check the Bios. If the process fails to complete, the registry is too large. If you have Windows 95 no letter or A you will need to update your RegEdit file with a newer version from Windows 98 or Windows 95 B

The entire process on cleaning and rebuilding the Registry can take as long as one hour for a small Registry and 3 for a large Registry. This process may be less depending on the condition of your Registry and the speed of your computer. During this process you will view a percentage of completion, at times this percentage will move rapidly and at other times it may stay at a percentage (example 57%) for about five minutes. You will be able to tell if your system hangs by viewing the hard drive active light on your computer or if a percentage stays longer than 10 - 15 minutes.

If you do have the file Smartdrv.exe installed to the Windows folder the process will be much quicker.

Should a problem occur there is a backup of the Registry named System.sav and User.sav in the Windows Folder, and you may also find backups with the file extension da0 ( da and zero). The da0 extension will have the h r s attributes, you will not need to remove the attributes (Attrib command) and there is also a Backup of the Autoexec.bat file in the root directory named C:\Autoexec.wos. Be sure you replace the Autoexec.bat file with the autoexec.wos file before rebooting back to Windows.

If you elect to use Compact with minimal information a new Registry will be constructed with just the required Keys for rebooting when you compact. You can then import the complete Registry once you are back in Windows by double clicking on the file Complete.reg on your desktop.

If you elect to compact using original Registry you may need to reinstall some of your software and hardware, depending on how long ago it was since you last installed Windows. This option should be your last resort.

Back to Table of Contents


Search Root Keys for Bad Pointers

A Common Error - Read This

This function will search the Classes Root main Keys for pointers to other Registry Keys. If any are found that point to non-existing Keys they will be displayed in the list. If a file extension (.txt) is found that points to no other Key it will be displayed. Many file extensions are installed when Windows is first installed for future use.

When the Drill has finished searching this group of Keys you may click on any Key in the list. If the text in the lower right portion of the Drill turns green then this Key is safe to delete without question because it points to no other Key and/or the information is obsolete.

Deleting file extensions is relatively safe. Let's say you delete the extension .txt. This extension normally points to Notepad.exe. So if it is deleted the next time you click on a txt file Windows will prompt you with the "Open With" dialog window to re-associate it with a program. If you find a file extension in the list like .latex or .fif with only a value for the "Content Type" you may safely delete it, as this Key is not being used. If the Content Type does exist under the Key Mime\DataBase\Content Type you may choose to leave the Key if you wish; the Key is valid, it is just not being used. The Default value for a file extension Key points to another HKEY_CLASSES_ROOT Key, if not the Key has no function in the Registry. In the case of a .txt Key it will point to txtfile, if Notepad.exe is what you view txt files in. So with this in mind if the Registry Drill say "No Key: HKEY_CLASSES_ROOT\???????" (where as ?????? represents a Key name) then the file extension is invalid and can be deleted safely. PerceivedType values, if no other values are present, then they serve no real purpose, you can either delete them or leave them for future use.

File extensions that have an underscore such as ".dl_" can be safely deleted. These extension are for compressed files and will never be used.

Entries in the list that are not file extensions such as "Overview.Document" are added to the list if the CLSID Key is invalid. These Keys are generally safe to delete, but there are always exceptions to the rule. After you view the Key and decide to delete it, open the software it is associated with and try it, if you know the associated software. Reboot and try it again. You can always restore the Registry if the software fails.

If you are having problems with certain file types opening  (example wmf, picture file) it is wise to delete the associated Keys, This will allow you to fix the association the next time you need to open that file type.

Back to Table of Contents


Search CLSID\TypeLib

A Common Error - Read This

This function will search HKEY_CLASSES_ROOT\CLSID\TypeLib Keys for pointers to non-existing TypeLib Keys and ProgID Keys. Click on an entry in the list, and then "Check File" if the server exists. If the file does not exist then deleting the Key is safe. If it does exist try registering the file if it is a DLL or OCX file extension. If it is an EXE file extension run the program. Then rerun this function to see it is still in the list.

If the ProgID value states (Key does not exist) and there is no server file or (missing file)listed and there is no TypeLib Key, the Key is safe to delete after making a backup of the Key and verifying that this Key does not have other information pointing to an existing CLSID Key.

If the server file exists and the ProgID and or TypeLib Key do not, use the "Check File" (if not an "exe" file) and register the file, then delete the Key. A new button will appear that will allow you to register the file again. Register the file and rerun this function to see if the Key returns. The button will only appear if you use the "Check File" to Register it and then delete the file without selecting another Key.

If the Key does reappear then the function of the Key has not been used by you or a program yet and is a valid Key. View the Key and verify that there are no trailing or leading spaces as described in the Getting Started section of the help file.

With the Keys that are left you can attempt to manually associate the ProgID or TypeLib Key to a valid Key. Example If the Key points to a ProgID of Msdaer and you do not have one but you do have a HKEY_CLASSES_ROOT\Msdaer.1 Key you can point the ProgID value to Msdaer.1. Or you may create the Key using the same information in the Msdaer.1 Key but use the correct CLSID Key.

The rest of the Keys will be up to you whether to delete or not. If the Key is deleted, re-registering the file associated to the Key may not rebuild the Key, if so then the Key is obsolete. Meaning they were created from an earlier version of the file. If you elect to delete them, export the CLSID Key and save it for a little while, just to play it safe. If registering the server file does not rebuild the Key than either the TypeLib Key needs to have the software it comes from reinstalled or that TypeLib Key may not be needed by the software that is using it. Suggested method: Backup the Key, delete the Key, then double click on the server file, when Windows starts the  "Open With" dialog window select the file windows\system\regsvr32.exe if it is a DLL file or windows\system\regocx32.exe if it is an OCX file. Be sure to check the box "Always open with"

Note: When using this function it is common to have many entries in the list that have bad pointers to TypeLib and or ProgID Keys that cannot be corrected and are still valid. If you remove one that is required you can always restore the Key with the Restore A Key function in the More Tools button.

Back to Table of Contents


View Uninstall Keys

A Common Error - Read This

This function will display all the Keys that are displayed as well as the hidden ones (those not displayed) in the Control Panel under the Add/Remove Software applet. Deleting any of these Keys is perfectly safe, in that no damage will be done to the functionality of the Registry or the associated program. However the Uninstall, will be disabled. If you delete a Key you will not be able to uninstall the software using the Add/Remove applet. If you have no plans to uninstall the software, the Key is just taking up room. If you do not know what the Key is for, than the odds are you will never uninstall it or you already did.

Keys in the non-display list should be viewed. Some Keys may contain no information and may be deleted safely.

Back to Table of Contents


Search Shell\Open\Command Keys

A Common Error - Read This

This function will search the HKEY_CLASSES_ROOT Key for any program that does not exist and is supposed to open a file type. Generally you can just delete the Key. If you moved the program, use the "Go To Key" feature and correct the path.

It is highly recommend that the Key be reviewed. You may notice that there is an entry in the list "ChannelFiles" and the shell\open\command value is displayed as "explorer"; when you view the Key it will look different; this Key is valid. It appears in the list because there is no such a file as "explorer", however there is a file "explorer.exe". Changing the entry to explorer.exe will stop the entry from appearing and will not effect Windows in anyway. Changing this value is not necessary because Windows sees the entry "explorer" and the executable file "explorer.exe"

Back to Table of Contents


Search Interface Keys

A Common Error - Read This

This function searches the Interface Key for pointers to CLSID Keys and TypeLib Keys that do not exist. If the CLSID Key is not valid, delete the Key.

It is recommended that if the CLSID Key is valid but the TypeLib Key is not, attempt to register the server file listed at the CLSID Key, after deleting the Interface Key. Registering the file should rebuild the Key correctly. If not, then the Key was probably obsolete or the program that installed it will rebuild the Key when it is run.

Generally any Key found can be safely deleted.

Back to Table of Contents


Search for missing CLSID Keys

A Common Error - Read This

This function searches all main Keys in the HKEY_CLASSES_ROOT hive for pointers to a CLSID and Program ID (ProgID) Keys that have invalid pointers; they will be displayed in the list. It is wise to view the Key before deleting it, check for leading or trailing spaces as described in the Getting Started section. If no error is found in the Data entry you can do a search in RegEdit for the entry. If the item is OverView.Document do a search for OverView.Document in the CLSID Key.  If it is found you can try re-associating the Key OverView.Document to the CLSID Key that you found.

A CLSID key must contain "{" and "}", without the quotes.

The ProgID Key is read using the CurVer Key. OverView.Document is a ProgID Key.

If the fault lies with the ProgID Key then view the Key and see if repairs can be made. A good example of this is the VSHelpServices Key (if you have one). It points to VsHelpServices.VsHelpServices.1 when it should be pointing to VsHelpServices.1 (the Key just below itself). Another example is ITSProtocol, which has a CurVer Key that points to ITSProtocol1.0. There are two ways to repair this Key assuming the server file exists. One way is to create the ITSProtocol1.0 Key, which can be done by duplicating the ITSProtocol Key without the CurVer Key. The second way is to delete the CurVer Key, as it does not point to anything valid. Deleting the CurVer Key would be my choice in this case because if the ITSProtocol1.0 Key is ever created it will point to the same CLSID Key anyway.

If both the CLSID Key and the ProgID Key are invalid after viewing the Key, delete it. If one is valid but the other is not, try running the program associated with the Key if you know it and rerun this function. If it is still in the list, backup the key and delete it. Generally the Key is obsolete. Here again you can re-register the file after deleting it and rerun the function to see if the Key returns. You must first use "Check File", then delete the Key and then use the "re-register file" button that will appear. If the Key reappears then it is a valid Key and the function of the Key has yet to be used

Back to Table of Contents


View Software Keys

A Common Error - Read This

This function will display Keys that third party (other than Microsoft's) software creates. There is no way for a utility to accurately tell you which Keys are safe to delete. You will need to view them to see if you recognize them. If you are sure the software has been deleted from your system you may delete the Key. If you delete a Key and the software is still on your system the odds are that the software will recreate the Key. But it will not remember the information that was saved in the Key.

Back to Table of Contents


Search TypeLib Keys

A Common Error - Read This

This function searches the TypeLib Key for obsolete information. When you install an updated file it has different version numbers. If the file uses a TypeLib Key it creates a new SubKey, if the version number and call is different, making the Registry larger than necessary because the original SubKey is obsolete. This error will be displayed in the right Window. You may use the "Fix TypeLib Key" function to repair these Keys.

You will notice that the "Fix TypeLib Key" function is now available to you. This function will create a backup of the Key in the Registry Drills sub folder "SavedKeys". It will then delete the Key and Register the file associated to the Key. You will notice that when you use the "Fix TypeLib Key" function the backup information appears at the lower right of the Drill's interface.

If a TypeLib Key is in the list to be repaired and upon viewing it you see only one version number, the Key is damaged. Export the Key then delete the Key, and then import the Key. This should repair the Key. This issue seems to be mostly in Windows 2000 and Windows Millennium.

NOTE FOR DEVELOPERS: There are exceptions to the rule. If you are a software developer and write programs in both VB 5 and VB 6 (as example) on the same machine ,some files are common, such as comdlg32.ocx. This file will be version 6.0 on your machine and will register as 6.0. When you attempt to write a VB 5 program in the editor, the editor will complain that it cannot register Comdlg32.ocx because the 5.0 references are missing from the TypeLib Key. You may use the Save??.reg file or create the Key manually at the correct TypeLib Key. This does not apply to software users, only developers with multi versions of the same language editors.

Back to Table of Contents


Search Shell Extensions

A Common Error - Read This

This function searches the Explorers Shell Extension Key for invalid/obsolete pointers to the CLSID Key.  Any Keys displayed here are safe to delete without question.

Back to Table of Contents


Sound Events

A Common Error - Read This

When you click on this label the window will enlarge to display 4 buttons at the bottom. To save you time, start with the first button to the left. If you start somewhere else you may be deleting many entries that can be deleted in a single click.

Schemes For Application: Displayed are the main Keys for applications that have made entries in the Control Panel's sound applet. You may delete any Key in the list that you no longer want. All corresponding Keys will be deleted. It will not delete the associated files.

Schemes Names: Displayed are the sound schemes that are installed on your machine. If you created your own scheme it will appear here as well as the ones Windows has installed. You may delete any Key in the list that you no longer want. All corresponding Keys will be deleted. It will not delete the associated files.

Event Labels: Displayed are all the events displayed in the sound applet in the Control Panel. Many of these labels are the standard Windows labels and some maybe what other software has added to the list.  You may delete any Key in the list that you no longer want. It will not delete the associated files.

Sound Files: Displayed are all the sound files that are associated to the events that are not on your system or the path is incorrect. It is recommend that you correct the path using the Control Panel's sound applet or edit the Registry. After viewing the Key you may delete it if it is an obsolete Key.

Back to Table of Contents


Search Drivers

A Common Error - Read This

This function searches the VXD Key for deleted or missing VXDs. It is wise to do a search of your hard drive as well as view the Key before deleting it. While searching, also use the search pattern with the extension "drv" in place of the "vxd" extension. If you find a drv file then create a backup of the Key before deleting it.

Back to Table of Contents


DEEP DRILL

Using the Deep Drill

After you have cleaned up as much as you can using the Quick Drill then it is time to start the Deep Drill. Be sure you have rebooted and checked all your other software for any problems. Once you're sure that all is well you may use the "Remove All Backups" feature located on the main interface to get more free space on your hard drive if you wish. The Deep Drill is going to need several Megs of space. If you have the available space, 15 to 30 Megs depending on how large your Registry is, make a complete backup using the "Export Registry" button before continuing into the Deep Drill.

To help you understand how the Deep Drill works, it exports the entire Registry to the file Verify.reg in the Windows folder. It then reads each line, character by character looking for any invalid characters. It is also looking for other characters like a period (“.”) which should (but may not) indicate to the Drill that this line contains a file name. If a colon (“:”) is found the Drill looks for a path in the line. A "*" which could be a VXD file or a Key referring to the Bios in the Registry, or a wildcard file extension, and so on with each character it reads. Then it looks for the file, path, Registry Key or what ever it is looking for to see if it exists. If a line contains the characters “.” and “:” and “{” it will search for Class, TypeLib,Filter, Interface Keys and more. It will also search for Catroot, files, paths, URLs, version numbers, and time. It then searches it's database for known entries and then goes through a process of determining whether or not the entry was valid or not. The line may take a few seconds to read.

If the character “#” is found it will display the entry as an error. Normally this character is used as a URL, however, it may be used elsewhere but may not be a valid character elsewhere.

It is possible that an entry fails more than one criteria and a URL address is displayed as a file not found, such as "FileList"="http://www.microsoft.com/hashes.asp" and the file hashes.asp was not found on your hard drive. Normally the FileList Value Name points to a file on the hard drive.

Once it finds a possible error in the line it stops and displays the line. Once you click Continue it goes to the next line. So if the line contains an error in it but the Drill points to a valid entry it will not reread the line to display another error in the same line.

The Deep Drill contains three windows that need to be reviewed. The top window will display the Key being read. In the second window, just below the top window, it will tell you in the top part of the window what it found and why the entry contains an error. Below this, the line (value name and value data) being read is displayed. You should review the entire line displayed here for other possible errors.

The third window is located at the bottom of the screen. It is displayed in 3 colors, Red means do not delete the Key or Value Name, Yellow means the Key is a required Key for Windows but not the value name, Green means the Key and Value Name are not required for Windows. A traffic light will appear whenever an error is found. It too changes colors. A Green light or label means that this Key is not a Key that Windows creates on a normal install; so it is advised that you use some caution before deleting the Key or value.

The Deep Drill does not have a "Delete Key" option. This is done to ensure that the Key is viewed before deleting it.

Each time you restart the Deep Drill you will be prompted to create a new export of the Registry. If you just started using the Deep Drill and have not deleted or changed a lot of Keys it is not necessary to do so. If you have, you should create a new file.

You can restart from the beginning or the line number the Drill displays if you wish to restart from where you left off. The line the Drill displays may be several lines less then the actual line number you stopped at. This is so the Drill knows what Key it is working on.

The current line being read will be displayed on the Deep Drill interface on the right side in the middle of the Interface. If you choose to start at a different line number be sure to start about 20 lines earlier than what was displayed when you stopped. If you do not, the Key being read may not be known because the Drill may have stopped to display an error in a Value Name line.

It is recommended that you use the Deep Drill once without saving any characters as legal characters, or adding any Keys to the Do not display list. This will ensure that no real errors are bypassed. The second time you use the Deep Drill you may add characters as legal characters. This way if a line had more than one error in it, it will be displayed the next time you run the Deep Drill. On the third pass you can add Keys to the Do not display list.

If you are unsure about whether to delete a Key or not, don't. If you choose to, then be sure you backup the Key.

Back to Table of Contents


Invalid Class Keys

There are several reasons why a CLSID, TypeLib, Filter, etc. Class Keys or GUID Key (an entry like {84D50DE0-C867-11CF-B1AE-00AA00A3F2C3}) are not or may not be valid. In most cases when a Class Key points nowhere it is safe to delete, but if it contains only a single entry or SubKey it may be storing information for a program that should have been stored at a software Key. Norton Utilities does this a lot.

 

Back to Table of Contents


File or Path does not exist

When the Deep Drill finds what looks like a file it may not always be a file. The file it is searching for may be displayed in the top line of the center window. For example, "UninstallDir"="C:\Uninstall.000" (displayed as C:\Uninstall.000) is really a folder (directory). In this case the folder was created when you installed Windows and has been deleted by the Windows Setup program. Since this Key is in the setup Key you can leave it. If you decide to delete it, it will have no affect on Windows because this Key is now obsolete. Errors found at the "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup" Key are OK to leave, as these errors are quite normal. However the Value data for the following Value Names SourcePath, MediaPath, SysDir, and WinBootDir must be correct.

In some cases, you will find that a file name is listed without a path but the Key is a Software Key. A file at a Key like HKEY_LOCAL_MACHINE\Software\Intel\Available does not need a path. The program knows where the file already is. It may look like "DllName"="system.dll"

In other cases, you will find a path and file that does not exist. These Keys are obsolete and can be deleted. In the event a file is found with a path in 8.3 format (C:\Progra~1\Common~1\filename.txt) and the file really does exist; then the path is wrong. The correct path may be C:\Progra~2\Common~2\filename.txt. To fix this error, modify the entry to read long file names or to the correct DOS name.

There is one error in the Windows Registry that is not an error. "C:\Windows\Temporary Internet files\Cache1" (cache2, cache3, cache4). The Cache folder changes all the time, so you need not change this entry in the Registry.

When an error is displayed it is always best to fix the error rather then to delete it. Unless of course you know that the Key and or Value Name is obsolete.

If you use the Find File in the Registry Drill to search for a file, be sure to close the Explorer when you have finished searching. If you do not then you will have multiple Explorer windows open.

If you use the Go to Key in Drill and the Key name contains a space as in "Internet Explorer", RegEdit may not bring you to the exact Key. It may bring you to the first Key with "Internet". This is caused by RegEdit not recognizing the space.

Back to Table of Contents


Illegal Characters

When an error is displayed about a character not being legal you may add it to the "Save as Legal Character" list. By saving the character however, as a legal character, it means that if the character is used someplace that it should be, it will not be displayed again as an error,even if the character is "®" and it is used as part of a Class Key, which is illegal.

The characters "[" and "]" are not allowed to be saved as legal characters in the Drill. The brackets are reserved for Key donation. Any value having these brackets will be displayed as invalid, although many Value Data's may contain a bracket. The same holds true for "$" and "#". Just because they are displayed as an error, they may be valid entries.

An entry like "Config.sys" = "Device=%WINBOOTDIR%\Himem.Sys" will set a flag in the Drill. It sees this as two files but it also sees this as a double Value Name. Although the variable %WinBootDir% is not a standard variable in the Registry it is one in MSDOS for the Windows folder. Windows uses %SystemRoot% for the name of the Windows folder.

The Registry Drill is programmed with basic characters of the English language. If you use additional characters please add them as they are found. Some English characters such as the + are omitted intentionally and may be added if you so choose to. This will not stop the Drill from checking the entry the next time for other errors, it only stops the Drill from thinking that the character is illegal.

If at the start of using the Deep Drill you get the message "The Registry contains one or more characters that will cause it to Prematurely end verifying the Registry". The Drill need to find the line in the Verify.reg file and delete it. Or you can use the FindLine utility in the Registry Drill Folder to find the bad character if you wish to see them..

Back to Table of Contents


Invalid Entries

The Registry Drill will display any entry that does not meet the requirements or cannot be deciphered as a valid entry. As you use the Drill you will be able to see why the Drill does not program exceptions. Below are some examples that may be displayed as invalid but the entry is valid. If an entry contains to many switches as in @="Dr.Watson Log File (*.WLG)|*.WLG|" the Drill will display the entry. Although this is a valid entry it did not see a file by the name Dr.Watson Log File (*.WLG)|*.WLG| nor is "DR." a valid file name and the "|" switch appears invalid for a VXD. Yet the Drill knows that "*.wlg" is a wildcard the character "|" is an invalid file name as in "*.wlg|"

Back to Table of Contents


Shared DLLs

Files in the SharedDLLs list are added when a program is installed and the software vendor does not want his files deleted by either a program that cleans up the hard drive (if the cleaner checks the list) or during uninstalling the program. Files in the list are supposed to be a DLL, OCX, TLB, or some other file that is truly a shared file. One that other programs use as well.

The file Comdlg32.ocx is a shared file. Almost all programs written in either Visual Basic 5 and 6 use it. If a program installs this file and it is deleted all your other programs written in VB will not work. This is a shared DLL. However some programs share help files (.hlp,.htm,.cnt. and chm). This files should be found in the Help Key. Some exe files like "Artgalry.exe" are shared as with Microsoft's Office 95,97, and 2000. Many program use them for their own needs. On the other hand, the file FPuninst.exe is used only to uninstall Front Page so why is it a shared file?

Deleting a file from the list will have no effect on how your software works, unless the program wants to check the Registry and see that its' file is in the list, and if it is not the vendor may have included some code to cause the software to work.

This list was meant for Windows to use in the Add/Remove Software applet so that it knows what files it should not uninstall.

Back to Table of Contents


Understanding the Registry and more Help

You will find more help for the Registry Drill on our site. We will be posting additional information on our More Help For the Registry Drill page as we get requests.

You can also learn more about the Registry and how it works by visiting our page How the Registry Works. This page should help you determine if an entry is valid or not. Please do not email us with an entry asking us if it is valid. We have no way of knowing as each system is different. We do not know what drivers are required for your hardware or what version your software is. We cannot tell what protocols you use for what type of networking, and so on.

Back to Table of Contents


Using the Find CLSID Pointer Tool

This tool allows you to search for all pointers to a CLSID Key. There are two examples programmed into Registry Drill, the Browser Help Keys and the Shell Execute Keys. Click on New Search then select either the Browser Help or Shell Execute, then click on Find Pointers. If any Keys are found they will be displayed in the Window. Click on any Key in the window and you will see that the CLSID option is now selected and a CLSID Key name is in the lower window. Click on Find Pointers again and all Keys will be displayed that have pointers to that CLSID Key.

You can enter you own CLSID Key by typing one in the lower window after you select New Search.

Each new search will create a printed report You can use this report to search for more pointers in the search tool. Each New Search will overwrite the existing report

 

Back to Table of Contents


Using the Search Tool

This screen will search the current Windows\Verify.reg file for any file name, word or phrase you enter. It is NOT searching the current Registry. It does however reference the Registry to see if a Key exists. You may create a customize Verify.reg file by exporting any Key from the HKEY_USERS Hive and/or HKEY_LOCAL_MACHINE Hive. If you use a different Hive you will not be able to Delete, Edit or Go to Key. The Remove Line Key will only remove the line from the screen, it will not delete it from the Registry.

The Search Tool is NOT case sensitive for the actual string entered.

When searching with "Use Exact Phase" the Search Tool is case sensitive.It will only search for the exact string in the window, and its binary equivalent. EXAMPLE : Search phase = C:\File ; Binary equivalent = 43,3A,5C,46,69,6C,65. The tool will only return the exact phase entered. In the above example, it will not return any keys with C:\\File or c:\File.

When the "Use Exact Phase" box is not checked. The Search Tool will search for the search phase in and combination of upper or lower case characters. However, the binary value is case sensitive. It will search for the binary equivalent, the binary equivalent of all lower case characters as well as the binary equivalent of all upper case characters. It will also search for the Binary Null Character space. EXAMPLE : Search phase = C:\File (any combination of upper or lower case characters); Binary equivalent(C:\File) = 43,3A,5C,46,69,6C,65 ; lower case Binary equivalent(c:\file) = 63,3A,5C,66,69,6C,65 ; upper case Binary equivalent(C:\FILE) = 43,3A,5C,46,49,4C,45 ; Binary Null Character space equivalent (C:\File)= 43,00,3A,00,5C,00,46,00,69,00,6C,00,65

It is advised that you view the Key using the Go To Key button before deleting any Key. To delete a value from the Registry you may use the Delete Value button or press the "V" button on your keyboard after highlighting the value to delete. An additional feature - Delete all Value Names at once that contain the search phase you used can be done by pressing the F12 button on your keyboard.

As a example of when to use the F12 button: If you had moved a program from C:\Program Files\MyProgram to C:\MyProgram, you would do a search for C:\Program Files\MyProgram and have the Drill replace this with C:\MyProgram. However, when you import the replacements and a Value Name has changed a new Value Name is created; the old Value name is not altered. Value Data is changed. Since the Value Name is new, a new Value Name is created. Example of this is "C:\Program Files\MyProgram"=0001 and the replacement is "C:\MyProgram"=0001 - both are in the Registry after the replacement is done. After the replacement you would need to Create a new search file and repeat the search for C:\Program Files\MyProgram, then use the F12 button to delete and Value Names that contained the search phase. The F12 function will not delete any Keys, only the Value Names and its' data.

Key that need to be rename must be done manually using the Goto Key button.

You can rename the saved Search Report.txt file to Verify.reg and save in the Windows folder, then run it through the Deep Drill.

You can use this function to find any Keys that may point to another Key. Example: You do a search for the word Twaintec, and only one key comes back :
HKEY_LOCAL_MACHINE\ Software\ Classes\ CLSID\{00020424-0000-0000-c000-000000000046}. Do not delete this Key yet. Use the Display Key button and view the entire Key making notes of the ProgID and TypeLib Key as well as all other information.Then do a search for {00020424-0000-0000-c000-000000000046}. Then do a search for the ProgID key value, and the Interface Key value. This will help you delete information in the Registry from a program or file that you have uninstalled but left remnants.

You may also replace the term you have searched for with a new term. For example, you want to replace all C:\Progra~1 with C:\Program Files. Create a New Search File, enter the phrase \Progra~1 in the window. Click on Find Entries and remove any entries that you do not want to change, then select Replace and enter \Program Files in that window. You will be given a chance to view the changes before they are made. You may cancel the changes at this point also.

You can use this feature to find all pointers to a Key. An example is posted at More Help For the Registry Drill

Back to Table of Contents


How To Make a Repair File

Along with the information in this section you should read the web page http://www.easydesksoftware.com/news/news32.htm

You can make a repair file for this machine or another machine. The first step is to Export the Key, but this MUST be done on the Load Registry window. This window will only Export the Loaded_Hive Key. Once you have made the Export you can work with it in the Search Registry or Deep Drill. The Quick Drill will not read this Key. If you are loading a Registry file from another machine use caution when using the Deep Drill as it is checking to see if files are on your machine and if the CLSID etc. Keys exists on your machine. If you are using a text editor on this file you should make the changes in the Registry not the file.

When you click on Make a Repair File you must select the file name that you loaded. If you rename the file that you loaded you must select the correct original name. The Drill will convert the file that was made from the Export the Key file to be a repair file that can be imported. After creating the repair file open it in notepad and verify that the Hive name and starting key is correct.

Once you have completed the changes in the Registry, click on Export Key to make a current image of the Key. Then click on Make Repair File. Once the repair file has been made, you can Import the file.

NT_Platform: If you are get a message when Importing (merging) the repair file - that "not all information was imported successfully"or similar statement, this is normal as there are some protected keys in the Registry that Windows will not let you write to. All other Keys have been imported.

Back to Table of Contents


Find CLSID Pointers

This tool is can be used to find out what file any GUID points to. On this window you will find 3 choices that the tool will search and display GUIDs. These three are common hiding places for malware. However, you can copy any GUID into the window at the top by selecting the CLSID option, enter or paste a GUID into it, then click Show CLSID Key.

To get started, select Clear Screen, then select any option other than CLSID > click Find Pointers > click on any GUID that is in the right window. The GUID will be inserted into the blue window and the window will turn white (allowing you to edit). The CLSID option will be selected, click on Show CLSID Key.

Back to Table of Contents


ORDERING

For updates and other software visit us at:
http://www.easydesksoftware.com

If you email or mail your order in, you will need to include your 7 digit product ID #. It can be found in the upper right hand corner of the Splash Screen (the first screen you see when you open Registry Drill)


This is a shareware release. Please register it within 10 days.
The cost of registering is $39.95, $9.50 additional for CD.

All software is at our web site
http://www.easydesksoftware.com
You may order by credit card, money order or check directly at our site
http://www.easydesksoftware.com/order.htm

Or to order by mail this or any other software from
EASY DESK SOFTWARE
Ship to:

YOUR NAME_______________________________

EMAIL ADDRESS_____________________________

ADDRESS_________________________________

TOWN____________________________________

STATE______________

ZIP________________

PHONE______________

OPERATING SYSTEM_____________
SOFTWARE TITLE(S)_________________________
PRODUCT ID ______________________
AMOUNT ENCLOSED___________________


Make checks and money orders payable to Easy Desk Software
Send TO:
Easy Desk Software
2264 6th Ave SE
Vero Beach, FL
36962

USA
(772) 978-1938

You may visit our web to learn how to send us a check via e-mail
at our Order page
Or: EMAIL to: EASYDESK@EASYDESKSOFTWARE.COM
Visit our web for other free demos:
http://www.easydesksoftware.com


Disclaimer-
Users of Easy Desk software must accept this disclaimer of warranty. Easy Desk software is supplied as is. The author disclaims all warranties expressed or implied, including, without limitation, the warranties of merchantability and of fitness for any purpose. The author assumes no liability for damages, direct or consequential, which may result from the use of any Easy Desk software.

Registry Drill is a "shareware program" and is provided at no charge to the user for evaluation. Feel free to share it with your friends, but you may not give it away altered or as part of another system without written permission from the Easy Desk Software. The essence of "user-supported" software is to provide
personal computer users with quality software without high prices, yet to provide incentive for programmers to continue to develop new products. If you find this program useful and find that you are using Easy Desk software and continue to use Easy Desk software, you must register the software. You must also make payment of $39.95 to the Easy Desk Software. The registration fee will license one copy for use on any one computer at any one time. Commercial users of any Easy Desk software must register and make payment for their copies of Registry Drill within the trial period. License arrangements may be made by contacting the Easy Desk Software.

Anyone distributing Registry Drill for any kind of remuneration must first contact the Easy Desk Software at the address below for authorization.

All registered users will receive the latest registered version on diskettes via US Mail ($5.00 additional). You may also request e-mail versions, which will be shipped date of funds. Support will be offered for an unlimited time with registration so long as the Easy Desk Software is selling the software.

Back to Table of Contents


OTHER SOFTWARE

Special Agent PC Secure:
Your Total Internet Security System. It can protect you and your personal information, from Phishers, Hijackers, Trojans, Spyware, Adware, key loggers and even other users of your PC. Protects you from: Internet Intruders with its' configureable Firewall. Spyware, Adware, Hijackers, and Trojans, being downloaded to your machine Phishing and back door sites, with its' Phishing Detector, Tells you when you are on a site that is known to download malware onto your computer. PC Secure has a fool proof Phishing Browser, verifies the IP address, IP owner, URL Aliases Tells you who owns the Domain, the IP address, andthe country the site you're currently visiting is in. Hackers, Spies, and Key loggers stealing your passwords, with its encryption tools. Protects your private files by hiding them and encrypting them. Even you will not  be able to find them until PC Secure unencrypts and unhides them for you. Protects your privacy by shredding files instead of putting them in the Recycle Bin. Protects private messages such as email through encryption, so only you and the individual you give the key to can read them. Tells you if a program is trying to send home information without your knowledge. Windows 98/ ME/NT_Platform $49.95 US Funds

RegRepair 2000: This is the utility that you have heard about and read about for Windows 95/98and Millennium. RegRepair 2000 will fix IOS errors without having to refomat your hard drive. It will find and remove or replaced corrupted fonts. It will find and repair DRV's DLL's and VXD's that are missing, corrupted or causing FailToLoad or Initiate. It will find these problems and repair them before you get locked out of Windows and are forced to reformat. RegRepair 2000 fixes what reinstalling Windows without reformatting cannot. RegRepair 2000 is so simple to use it does it all for you, prompts you every step of the way and tells you what it is doing, why the file has an error and then fixeds it.
Note: RegRepair 2000 will work in Windows or Safe Mode, but does not work from the DOS prompt, the Fix VXD (Windows Protection Error) feature does not work from DOS. Windows 95/98/ME $29.95 US Funds

RegMedic: You will never need to reinstall Windows again because of a corrupt registry. RegMedic can rebuild your registry from scratch in minutes, without deleting it or removing any of your other software. RegMedic is like reinstalling windows.Windows 95/98 $39.95 US Funds.

Registry Watch: A utility that monitors changes made to the registry while installing new software or at anytime you want to see what changes are being made.Undo the changes you desire using the undo feature. Also, makes a great uninstaller. Now updated with an auto registry backup and restore utility tool. A great feature for users of 2000 and XP. Windows 95/98 /ME /NT_Platform $29.95 US Funds.

Easy Recovery: The only utility that is designed for computer owners that have a recovery CDand do not have a Microsoft Windows CD. It restores your Windows operating system in less than 10 minutes , without formatting or reinstalling . And as an added bonus, it will create a Windows CD, one you can install Windows from without having to format or use your recovery CD.  A great tool for users of Win 9x and ME.  Windows 95/ 98/ME $15.00 US Funds

Set Point : Automatically create system restore points in Windows XP and ME. Select any time of day & any number of days apart, you'll never be without a current restore again. Simple to use! Windows ME/XP $15.00 US Funds.

Save-It: is an automatic file backup tool. It's designed to save your user files, you know, the ones you modify every day or every week. Simply select the files you want backed up, how often or what time, and forget about it. Your files will be backed up when you want. You can even have it backup your Registry and other system files like System.ini. If you like you can have Save-It do a backup after you leave work and have the computer shut down when the backup is complete. No need to do a complete drive backup every week any more, Save-It will keep all your backup files up to date. Windows 95/98/ME/ NT_Platform$15.00 US Funds

System Sentry: . A multifaceted indepth file tool that allows you to optimize your operating system and keep it running as smoothly as possible. It's powerful, thorough, and easy to use.. It maintains a Valuebase of all your system files, and compares those files to those from your original Windows installation or the last saved file list it creates. If subsequent programs create conflicts (ie General Protection Errors, screen freezes, program hang ups, and other errors) System Sentry provides an easy means of locating and curing the problem. It also allows you to find duplicate system files, and provides a means of eliminating duplicates that you don't need. It allows you to align 32-bit programs and .dll files so that they load more quickly (this feature for Win 98-only). Other features include 16-bit CRC checks, easy-to-use file association tools, and support for protecting selected system files that you don't want overwritten.Windows 95/98/ME/NT 4.0/ 2000/XP/2003 $29.95 US funds


Winsafe: A fail-safe utility for restarting Windows in case of corruption of vital files or crash. Nothing stops WinSafe 2001, and WinSafe XP except a power failure.With WinSafe on your computer, you will never get locked out of Windows again!
It's the fastest and easiest way to recover from Safe Mode, a lockout, or vital file and Registry corruption. The most advanced recovery utility available. It has all the tools needed to correct Windows problems, hardware or software. Nothing could be faster or easier, just a click of a button or type the word WINSAFE at the DOS prompt or Repair Console and you can reboot to Windows. It will even backup your VMM32vxd file and other files that Windows requires to reboot, no other utility does this. It also monitors your system files on startup, shutdown, backup and restore. It quietly watches for some nasty trojans some of which like to play with the registry and alter registry keys, like the open/command exefile key. WinSafe tells you about these changes before you shutdown to prevent you from having to format.Windows 95/98/ME/XP $29.95 US funds

Instant Check: An easy to use check writing utility for receiving or sending a check over the phone, via fax or e-mail. Ideal for small business or the individual who wants to print their own checks. Windows 3X/95/98/ME/NT_Platform
$49.95 US Funds

QikFix: The Swiss Army knife of utilities. Comprised of 10 different tools: 1)A file Verifyer, this stops screen freeze ups and General Page Faults 2)A file shredder, this makes deleted files unrecoverable 3)A memory manager and diagnostic utility 4)A wizard to close all programs before installing new software (everyone has asked for this) 5)An expand/compress file wizard, making file replacement easy 6)A system optimization wizard to speed up your computer -7)A cache utility for fine tuning performance 8)A rapid system information screen
. 9)A preference utility that allows you to control who can access what on your computer and 10)A folder comparison utility Windows 95/98/ME $29.95 US Funds

FATMon: The only File Allocation Table monitor available today. Never before was there an utility that could help stop you from losing everything on your hard drive because of a FAT problem. The dreaded FAT loss was the only problem software companies could not solve. Now we have! You can now spot a FAT loss before your files disappear or become corrupted. For any Windows platform using FATor FAT32 $12.95 US Funds



Freeware Available:
Rename the Recycle Bin: Renames and changes the icons for the Recycle Bin and My Computer without having to edit the registry. FREE

Toilèt.zip : 4 Icons, 2 sound waves and instructions to change the Recycle Bin to a Toilèt or a garbagè pail. FREE

Exit Windows: The fastest way to reboot to windows. It will not even log you off of the network. FREE

Repellent: Stop Script and Java viruses before they can start. No need to run virus scanners in the background or worry about out dated dat files. It even has a Cookie Cruncher. And best of all it's free! For all Windows

Open RegEdit: A neat little utility that will open RegEdit (Registry Editor)at the Key you want. Open RegEdit also will read a Registry Key for you. You can manually read most Keys but Binary Keys need to be interpreted. Open RegEdit will display the value both as numeric and as a string. Not all Binary Keys are numeric so it interprets them both ways. FREE

Back to Table of Contents