Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{00021400-0000-0000-C000-000000000046}\shellex\ExtShellFolderViews\{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
"PersistMoniker"=hex(2):66,00,69,00,6c,00,65,00,3a,00,2f,00,2f,00,25,00,75,00,\
73,00,65,00,72,00,61,00,70,00,70,00,64,00,61,00,74,00,61,00,25,00,5c,00,4d,\
00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,5c,00,49,00,6e,00,74,00,\
65,00,72,00,6e,00,65,00,74,00,20,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,\
00,72,00,5c,00,44,00,65,00,73,00,6b,00,74,00,6f,00,70,00,2e,00,68,00,74,00,\
74,00,00,00

Windows XP has a vast number of configuration dialogs, but some adjustments can be performed only by directly editing the Registry. Frequently, tips involving Registry tweaks include stern warnings to back up the Registry before making any change. The Windows XP Backup applet can back up the Registry along with other elements of the System State, but the resulting data file can occupy hundreds of megabytes. You're better off saving a system restore point each time you're about to edit the Registry. Better still, you can use Regedit to back up only the Registry keys that will be changed.
Click on Start Run and enter Regedit to launch the Registry editor. To back up an individual key you plan to edit, navigate to the key and right-click on it. Choose Export from the menu, and save the key to a REG file. Open the REG file in Notepad and insert a few comment lines that describe the source and purpose of the tweak. (To create a comment line, simply put a semicolon at the start of the line.)
Now go ahead and make all the changes to Registry keys and values specified by the tip you're applying. Any time you add a new key or value, make a note of it with another comment line in the REG file. When you're done, save the REG file and close Notepad.
If later you want to undo this Registry tweak, just double-click on the REG file and confirm that you want to add it to the Registry. This will restore any deleted keys or values and will restore the original data for any values whose data was changed. Note that this will not remove new keys or values that were added; that's why you need to make comments about such changes.
Right-click on the REG file and choose Edit, which will open it in Notepad. Check for comments about keys or values that were added, and if you find any, use Regedit to delete them. You can delete the REG file itself once you've completed this process

Registry Disassembled

Registry Disassembled a basic tutorial

The registry is a hierarchical database that contains virtually all information about your computer's configuration. Under previous version of Windows, those setting where contained in files like config.sys, autoexec.bat, win.ini, system.ini, control.ini and so on. From this you can understand how important the registry is. The structure of the registry is similar to the ini files structure, but it goes beyond the concept of ini files because it offers a hierarchical structure, similar to the folders and files on hard disk. In fact the procedure to get to the elements of the registry is similar to the way to get to folders and files.
In this section I would be examing the Win95\98 registry only although NT is quite similar.

The Registry Editor
The Registry Editor is a utility by the filename regedit.exe that allows you to see, search, modify and save the registry database of Windows. The Registry Editor doesn't validate the values you are writing: it allows any operation. So you have to pay close attention, because no error message will be shown if you make a wrong operation.
To launch the Registry Editor simply run RegEdit.exe ( under WinNT run RegEdt32.exe with administer privileges).
The registry editor is divided into two sectios in the left one there is a hierarchical structure of the database (the screen looks like Windows Explorer) in the right one there are the values.

The registry is organized into keys and subkeys. Each key contains a value entry , each one has a name, a type or a class and the value itself. The name is a string that identifies the value to the key. The length and the format of the value is dependent on the data type.

As you can see with the Registry Editor, the registry is divided into five principal keys: there is no way to add or delete keys at this level. Only two of these keys are effectively saved on hard disk: HKEY_LOCAL_MACHINE and HKEY_USERS. The others are jusr branches of the main keys or are dynamically created by Windows.

HKEY_LOCAL_MACHINE
This key contains any hardware, applications and services information. Several hardware information is updated automatically while the computer is booting. The data stored in this key is shared with any user. This handle has many subkeys:

Config
Contains configuration data for different hardware configurations.
Enum
This is the device data. For each device in your computer, you can find information such as the device type, the hardware manufacturer, device drivers and the configuration.
Hardware
This key contains a list of serial ports, processors and floating point processors.
Network
Contains network information.
Security
Shows you network security information.
Software
This key contains data about installed software.
System
It contains data that checks which device drivers are used by Windows and how they are configured.

HKEY_CLASSES_ROOT
This key is an alias of the branch HKEY_LOCAL_MACHINE\Software\Classes and contains OLE, drag'n'drop, shortcut and file association information.

HKEY_CURRENT_CONFIG
This key is also an alias. It contains a copy of the branch HKEY_LOCAL_MACHINE\Config, with the current computer configuration.

HKEY_DYN_DATA
Some information stored in the registry changes frequently, so Windows maintains part of the registry in memory instead of on the hard disk. For example it stores PnP information and computer performance. This key has two sub keys

Config Manager
This key contains all hardware information problem codes, with their status. There is also the sub key HKEY_LOCAL_MACHINE\Enum, but written in a different way.
PerfStats
It contains performance data about system and network

HKEY_USERS
This important key contains the sub key .Default and another key for each user that has access to the computer. If there is just one user, only .Default key exists. . Each sub key maintains the preferences of each user, like the desktop colors, the fonts used, and also the settings of many programs. If you open a user subkey you will find five important subkeys:

AppEvent
It contains the path of audio files that Windows plays when some events happen.
Control Panel
Here are the settings defined in the Control Panel. They used to be stored in win.ini and control.ini.
Keyboard Layouts
It contains some advanced code which identifies the actual keyboard disposition how it is set into the Control Panel.
Network
This key stores subkeys that describe current and recent network shortcuts.
RemoteAccess
The settings of Remote Access are stored here.
Software
Contains all software settings. This data was stored in win.ini and private .ini files.

HKEY_CURRENT_USER
It is an alias to current user of HKEY_USERS. If your computer is not configured for multi-users usage, it points to the subkey .Default of HKEY_USERS.

Description of .reg file

Here I am assuming that you already have a .reg file on your hard disk and want to know more about how it is structured.Now do not double click the .reg file or it's content will be added to the registry, of course there will be warning message that pops up. Now to view the properties of the .reg file open it in notepad.
To do so first launch notepad by going to Start>Programs>Accessories>Notepad.
Then through the open menu open the .reg file.
Now the thing that differentiates .reg files from other files is the word REGEDIT4. It is found to be the first word in all .reg files. If this word is not there then the registry editor cannot recognize the file to be a .reg file.
Then follows the key declaration which has to be done within square brackets and with the full path.If the key does not exist then it will be created.
After the key declaration you will see a list of values that have to be set in the particular key in the registry.The values look like this:

"value name"=type:value

Value name is in double commas. Type can be absent for string values, dword: for dword values and hex: for binary values. For all other values you have to use the code hex(#): , where # indicate the API code of the type.
So:

"My string" = "string value" is a string
"My dword" = dword:123456789 is a dword
"My binary" = hex:AA,BB,CC is a standard binary
"My other type" = hex(2):AA,BB,00 is an expand string


Important Note: expand string has API code = 2 and extended string has API code = 7.

As you can see, strings are in double quotes, dword is hexadecimal and binary is a sequence of hexadecimal byte pairs, with a comma between each. If you want to add a back slash into a string remember to repeat it two times, so the value "c:\Windows" will be "c:\\Windows".
Before write a new .reg file, make sure you do this else you will get an error message.

Command Line Registry Arguments

FILENAME.REG to merge a .reg file with the registry
/L:SYSTEM to specify the position of SYSTEM.DAT
/R:USER to specify the position of USER.DAT
/e FILENAME.REG [KEY] to export the registry to a file. If the key is specified, the whole branch will be exported.
/c FILENAME.REG to substitute the entire registry with a .reg file
/s to work silently, without prompt information or Warnings.

That wraps up the Windows Registry.

How To Disable Picture And Fax Viewer

We all know that WinXP likes to keep itself held together, and how it doesnt like you uninstalling certain components. Well The Picture and Fax Viewer, is one of these programs which can cause problems if removed incorrectly. It can be disabled safely as follows:

[Start] [Run] type regedit and click [OK]

Navigate to :

HKEY_CLASSES_ROOT/ SystemFileAssociations/ image/ ShellEx/ ContextMenuHandlers

then delete the Folder ShellImagePreview under ContextMenuHandlers

Note: If you want to restore the Picture and Fax Viewer :

Create the ShellImagePreview folder and create the String Value (Default)
Assign it the value {e84fda7c-1d6a-45f6-b725-cb260c236066}

NOTE: This tweak doesnt uninstall the program. It removes the association and therefore it cannot be run.

Rename recycle Bin To Whatever You Want

1. Start, Run, 'Regedit'.
2. Press 'Ctrl'+'F' to open find box and type 'Recycle Bin' to search.
3. Change any value data with 'Recycle Bin' to whatever name you want to give it ( ie, like 'Trash Can' or 'Dump' etc).
4. Press F3 to continue searching for 'Recycle Bin' and change wherever you come across 'Recycle Bin' to new its new name.
5. Repeat step 4 until you have finished with searching and changed all values to its new name.
6. Close regedit and hit F5 on desktop to see the new name on screen.

Note: As a good practice, always backup your registry before changing anything although changing 'Recycle Bin' name is a simple tweak and doesnt affect anything else.

Is your PC infected by malware / virus?

Caught A Virus?

If you've let your guard down--or even if you haven't--it can be hard to tell if your PC is infected. Here's what to do if you suspect the worst.


Heard this one before? You must run antivirus software and keep it up to date or else your PC will get infected, you'll lose all your data, and you'll incur the wrath of every e-mail buddy you unknowingly infect because of your carelessness.

You know they're right. Yet for one reason or another, you're not running antivirus software, or you are but it's not up to date. Maybe you turned off your virus scanner because it conflicted with another program. Maybe you got tired of upgrading after you bought Norton Antivirus 2001, 2002, and 2003. Or maybe your annual subscription of virus definitions recently expired, and you've put off renewing.

It happens. It's nothing to be ashamed of. But chances are, either you're infected right now, as we speak, or you will be very soon.

For a few days in late January, the Netsky.p worm was infecting about 2,500 PCs a day. Meanwhile the MySQL bot infected approximately 100 systems a minute (albeit not necessarily desktop PCs). As David Perry, global director of education for security software provider Trend Micro, puts it, "an unprotected [Windows] computer will become owned by a bot within 14 minutes."

Today's viruses, worms, and so-called bots--which turn your PC into a zombie that does the hacker's bidding (such as mass-mailing spam)--aren't going to announce their presence. Real viruses aren't like the ones in Hollywood movies that melt down whole networks in seconds and destroy alien spacecraft. They operate in the background, quietly altering data, stealing private operations, or using your PC for their own illegal ends. This makes them hard to spot if you're not well protected.

Is Your PC "Owned?"

I should start by saying that not every system oddity is due to a virus, worm, or bot. Is your system slowing down? Is your hard drive filling up rapidly? Are programs crashing without warning? These symptoms are more likely caused by Windows, or badly written legitimate programs, rather than malware. After all, people who write malware want to hide their program's presence. People who write commercial software put icons all over your desktop. Who's going to work harder to go unnoticed?

Other indicators that may, in fact, indicate that there's nothing that you need to worry about, include:

* An automated e-mail telling you that you're sending out infected mail. E-mail viruses and worms typically come from faked addresses.
* A frantic note from a friend saying they've been infected, and therefore so have you. This is likely a hoax. It's especially suspicious if the note tells you the virus can't be detected but you can get rid of it by deleting one simple file. Don't be fooled--and don't delete that file.

I'm not saying that you should ignore such warnings. Copy the subject line or a snippet from the body of the e-mail and plug it into your favorite search engine to see if other people have received the same note. A security site may have already pegged it as a hoax.

Sniffing Out an Infection

There are signs that indicate that your PC is actually infected. A lot of network activity coming from your system (when you're not actually using Internet) can be a good indicator that something is amiss. A good software firewall, such as ZoneAlarm, will ask your permission before letting anything leave your PC, and will give you enough information to help you judge if the outgoing data is legitimate. By the way, the firewall that comes with Windows, even the improved version in XP Service Pack 2, lacks this capability.

To put a network status light in your system tray, follow these steps: In Windows XP, choose Start, Control Panel, Network Connections, right-click the network connection you want to monitor, choose Properties, check "Show icon in notification area when connected," and click OK.

If you're interested in being a PC detective, you can sniff around further for malware. By hitting Ctrl-Alt-Delete in Windows, you'll bring up the Task Manager, which will show you the various processes your system is running. Most, if not all, are legit, but if you see a file name that looks suspicious, type it into a search engine and find out what it is.

Want another place to look? In Windows XP, click Start, Run, type "services.msc" in the box, and press Enter. You'll see detailed descriptions of the services Windows is running. Something look weird? Check with your search engine.

Finally, you can do more detective work by selecting Start, Run, and typing "msconfig" in the box. With this tool you not only see the services running, but also the programs that your system is launching at startup. Again, check for anything weird.

If any of these tools won't run--or if your security software won't run--that in itself is a good sign your computer is infected. Some viruses intentionally disable such programs as a way to protect themselves.

What to Do Next

Once you're fairly sure your system is infected, don't panic. There are steps you can take to assess the damage, depending on your current level of protection.

* If you don't have any antivirus software on your system (shame on you), or if the software has stopped working, stay online and go for a free scan at one of several Web sites. There's McAfee FreeScan, Symantec Security Check, and Trend Micro's HouseCall. If one doesn't find anything, try two. In fact, running a free online virus scan is a good way to double-check the work of your own local antivirus program. When you're done, buy or download a real antivirus program.
* If you have antivirus software, but it isn't active, get offline, unplug wires-- whatever it takes to stop your computer from communicating via the Internet. Then, promptly perform a scan with the installed software.
* If nothing seems to be working, do more research on the Web. There are several online virus libraries where you can find out about known viruses. These sites often provide instructions for removing viruses--if manual removal is possible--or a free removal tool if it isn't. Check out GriSOFT's Virus Encyclopedia, Eset's Virus Descriptions, McAffee's Virus Glossary, Symantec's Virus Encyclopedia, or Trend Micro's Virus Encyclopedia.

A Microgram of Prevention

Assuming your system is now clean, you need to make sure it stays that way. Preventing a breach of your computer's security is far more effective than cleaning up the mess afterwards. Start with a good security program, such Trend Micro's PC-Cillin, which you can buy for $50.

Don't want to shell out any money? You can cobble together security through free downloads, such as AVG Anti-Virus Free Edition, ZoneAlarm (a personal firewall), and Ad-Aware SE (an antispyware tool).

Just make sure you keep all security software up to date. The bad guys constantly try out new ways to fool security programs. Any security tool without regular, easy (if not automatic) updates isn't worth your money or your time.

Speaking of updating, the same goes for Windows. Use Windows Update (it's right there on your Start Menu) to make sure you're getting all of the high priority updates. If you run Windows XP, make sure to get the Service Pack 2 update. To find out if you already have it, right-click My Computer, and select Properties. Under the General tab, under System, it should say "Service Pack 2."

Here are a few more pointers for a virus-free life:

* Be careful with e-mail. Set your e-mail software security settings to high. Don't open messages with generic-sounding subjects that don't apply specifically to you from people you don't know. Don't open an attachment unless you're expecting it.
* If you have broadband Internet access, such as DSL or cable, get a router, even if you only have one PC. A router adds an extra layer of protection because your PC is not connecting directly with the Internet.
* Check your Internet ports. These doorways between your computer and the Internet can be open, in which case your PC is very vulnerable; closed, but still somewhat vulnerable; or stealthed (or hidden), which is safest. Visit Gibson Research's Web site and run the free ShieldsUP test to see your ports' status. If some ports show up as closed--or worse yet, open--check your router's documentation to find out how to hide them.

Bad ass registry

Ok mates,
any of you that do websites and like to open .html and similar files in notepad to edit scrpits, this is THE coolest windows registry edit ever
you can download the zip file with the .reg in it (run it and it automatically adds itself to your registry) or do it manually
CODE
http://www.geocities.com/ichbindeingott5/winXP-Notepad.zip


Manually: regedit and navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\Shell
add the key "notepad"
it's default value should be "Open with Notepad"
now, under "notepad", add the key "Command"
it's default value should be (with the quotes) "C:\Windows\System32\Notepad.exe" "%1"


ok, exit regedit and go right click on ANY file...
your new option: Open with Notepad

HOW BADASS IS THAT?!?!?!?
I FOUND THIS ONE ON MY OWN!!!!!!

i know this one works on XP and 2000, you can PROBABLY enter it manually on windows 9x, but i have not tested that


okay okay, i know maybe not everyone cares...but this was fun for me because i love tweaking my computer AND it makes some web design stuff eaiser for me :D