The secret behind the Windows registry! ! !

The secret behind the Windows registry! ! ! There are many articles in Windows registry, but more content is still a lot of Windows registry skills. Many users are "knowing that they don't know why," and there are many techniques involved. The keys and key values ​​are not Know it. This does not have an introduction to the registry. The following article is divided into three parts: registry and its use, the structure of the registry, the registry, and fault recovery. I hope that the computer novice has a simple, comprehensive concept and understanding of the registry. About registry usage techniques and many articles have been introduced, will not be described here. In the case of improper translation and mistakes, I hope everyone is correct. Secret (1) The registry and its role are the registry? Registry Because of its complex structure and CLSID keys without any contact, it may look mysterious. Unfortunately, Microsoft did not fully disclose support information about the correct settings of the registry, which makes the registry look more unable to figure out. Processing and editing registry, like "Black Art", which makes the user feel like it feels like the settings in the dark. Thus, because the user's lack of understanding of this makes the registry more failure. The Windows Registry is a set of data files that help Windows control hardware, software, user environments, and Windows interfaces. The registry contains two files in the Windows directory System.dat and User.dat, and their backup system.da0 and User.da0. The registry database can be accessed by the Regedit.exe program under the Windows directory. Before, in Windows's earlier (before WIN95), these features are implemented by WIN.INI, System.ini, and other .ini files are implemented. In the Windows operating system family, System. The two files of INI and Win.ini include all operating systems all control functions and applications, System.ini manages computer hardware and Win.ini manages desktops and applications. All drives, fonts, settings, and parameters are saved in the .ini file, any new program will be recorded in the .ini file. These records are referenced in the program code. Because of the size of Win.ini and System.ini file size, programmers add auxiliary .ini file to control more applications. For example, Microsoft's Excel has an Excel.ini file that contains options, setting, default parameters, and other information about Excel running normal. Only in System.ini and Win.ini need to point out the path and file name of Excel.ini. The most beginning, System.ini and Win.ini control all the features and access methods of Windows and applications, which work well in a minority user and a few applications. As the number and complexity of the application is increasing, you need to add more parameter items in the .ini file. In this way, in a changing environment, each person will change the .ini file after the application is installed into the system. However, no one is deleting the related settings in the .ini file after deleting the application, so the two files whose System.ini and Win.ini will become larger. Each additional content will cause system performance to get slower. And each app upgrade has such a problem: Upgrade will add more parameters but never remove the old settings. And there is also a significant problem, one. The maximum size of the .ini file is 64KB. In order to solve this problem, the software merchant starts support your own .ini file, then point to a specific INI file such as Win.ini and System.ini files. Such a plurality of .INI files affect the normal access level settings of the system.

If an application is conflicted with a conflict, who is the priority of who is priority to the Win.ini file? The registry was originally designed as an application's data file-related reference file, and finally expanded to the 32-bit operating system and application included all the functional stuff. The registration table is a set of control operating system appearance and how to respond to foreign events Working file. These "events" ranges from direct access to how hardware devices go to the interface to respond to how the specific user is running and so on. The registry is designed to work specifically for 32-bit applications because its purpose and nature become more complicated. It is designed to work specifically for 32-bit applications. What are the registry do? The registry is a data file designed for all 32-bit hardware / drivers and 32-bit applications in Windows NT and Windows 95. 16-bit driver does not work under WinNT, so all devices are controlled by registry, generally controlled by BIOS. Under Win95, the 16-bit drive will continue to work in real mode mode, and they are controlled using System.ini. The 16-bit application will work in NT or Win95, and their programs will still be referred to Win.INI and System.ini files to get information and control. In the case where there is no registry, the operating system does not get the necessary information to run and control the attached device and application and the correct entered input. The registry in the system is a database that records 32-bit drive settings and locations. When the operating system needs to access the hardware device, it uses the driver, and even the device is a BIOS supported device. No BIOS support device installation must be driven, this driver is independent of the operating system, but the operating system needs to know where to find them, file name, version number, other settings, and information, no registry records for the device, they Can't be used. When a user is ready to run an application, the registry provides application information to the operating system so that the application can be found, the location of the correct data file is specified, and other settings can also be used. The registry saves the location information, menus, button bars, window status, and other options for default data and secondary files. It also saves installation information (such as date), users, software version numbers, and date, serial numbers, etc. of the installation software. According to the different installation software, the information it includes different information. However, in general, the registry controls all 32-bit applications and drivers, the method of control is based on the user and computer, without relying on the application or driver, the parameter item of each registry controls a user's function or Computer function. User features may include desktop appearance and user directory. Therefore, the computer function and the installed hardware and software are related to the user, the user is public. Some program functions have an impact on the user, sometimes on the computer, not for personal settings, the same, the driver may be user-specified, but in many cases, they are common in the computer. The registry controls the user mode: control panel function; desktop appearance and icon; network parameters; browser functionality and character; some of those functions are independent, some are for users. Computer-related controls are based on computer names and login users. An example of the control type is to install an application, whether it is the user, the availability of the program is constant, however, the running program icon relies on the user who landed on the network. Network protocol availability and priority are based on computers, but current connection and user information are related.

Here is some examples of registry interpretation and computer control entries: access control; login confirmation; file and printer sharing; network card settings and protocols; system performance and virtual memory settings; no registration, Win95 and Winnt are not too That may exist. They are too complicated, so that use past .ini files cannot be controlled, their extension capacity requires almost unlimited installation and uses applications, and the registry implements it. However, the registration table is more complicated, understand how it works, what does it do and how to use it is the key to the valid management system. Registry in the system controls all 32-bit applications and their features and interactions of multiple applications, such as copying and paste, which control all hardware and drivers. Although most of them can be installed and set by control panels, understanding the registry is still a basic common sense of WinNT and Win95 systems. Second, the structural registry of the registry of the registry is a complex information database built by Windows programmers, which is multi-level. The basic structure of the registry on different systems is the same. The complex data of which will be combined in different ways to produce an absolutely unique registry. Computer configuration and default User Settings Registry Data Save in Winnt in the five files below: Default, SAM, Security, Software, System, NTUSER.DAT. All system registration information in Win95 is saved in the system.dat file in the Windows directory. All hardware settings and software information are saved in this file. It is much simpler than the NT registry file because more control is not required. Win95 is designed as a network customer or a separately working system, so user control or security level and NT are different. This makes the WIN95 registry work easier than NT, so this file is also relatively small. The registration data of Win95 users is generally saved in user.dat under the Windows directory. If you create and use more than one user profile in the Control Panel | Password | User Profile, each user will have its own user.dat file under /Windows/profiles/username/user.dat. At startup, the system will log in your login, from the configuration file (user.dat information) in your directory (user.dat information) will be loaded to keep your desktop and icon. The control key is displayed or edited with the control key in the registry editor. The control key makes it easier to find and edit the information item group. Therefore, the registry uses these entries. The following is that the six control keys hkey_local_machine hkey_classes_root hkey_current_config hkey_dyn_data hkey_users hkey_current_user Winnt and Win95 registry are not compatible. You need to reinstall 32-bit applications from Win95, re-create icons on your desktop, and re-establish the user environment. The registry can be easily edited by the control key. Although they display and edit as a stand-alone key, HKEY_CLASSES_ROOT and HKEY_CURRENT_CONFIG are part of HKEY_LOCAL_MACHINE. HKEY_CURRENT_USER is part of HKEY_USERS. HKEY_LOCAL_MACHINE contains all the contents of HKEY_CLASSES_ROOT and HKEY_CURRENT_CONFIG. HKEY_CURRENT_CONFIG and HKEY_CRENT_CONFIG and HKEY_CLASSES_ROOT are mapped and edited when the computer is started.

HKEY_CLASSES_ROOT is actually HKEY_LOCAL_MACHINESOFTWARE / CLASSES, but it is easier and organized relative to HKEY_CLASSES_ROOT window editing. HKEY_USERS holds default user information and current login user information. When a domain member computer is launched and a user login, the domain controller automatically sends information to hkey_current_user, and HKEY_CURRENT_USER information is mapped to system memory. The information of other users does not send to the system, but recorded in the domain controller. The keys and sub-data are split into multi-level keys and sub-keys to establish a hierarchy (like Exploer) The structure is easier to edit. Each key has a group of information and is named according to the data type therein. Each key has a plus sign ( ) flag on its folder icon Description, there is more content below it. When you open it, the plug-in sign of the folder is replaced with a minus (-) flag, then display the subkey of the next level. All software, hardware, and Windows work setting are stored in HKEY_LOCAL_MACHINE. All security policies, user permissions, and sharing information are included in this key. User privileges, security policies, shared information can be set via Windows NT Domain User Manager, Explorer, and Win95. HKEY_CLASS_ROOT HKEY_CLASSES_ROOT contains all the information necessary for all applications: all extensions and associations between files and applications; all driver names; class ID numbers (the name of the option to be replaced by numbers); DDE And OLE information; icon for applications and files; hkey_current_config. HKEY_CURRENT_CONFIG is a mapping of current hardware configuration information in HKEY_LOCAL_MACHINE. If there is only one profile, it is originally configured, and the data will always be in the same place. In Control Panel | System | Hardware Profile | Creating an additional configuration makes additional configuration information into HKEY_LOCAL_MACHINE. When multiple profiles are present in Win95, a prompt will give you a configuration file when the computer is started. In WinNT, when you start, you can press the space bar to select the hardware configuration file when starting properly. Depending on the selection of the hardware configuration file, specific information is mapped to HKEY_CURRENT_CONFIG. HKEY_DYN_DATA HKEY_DYN_DATA and other registry control keys are different because it is not written in the hard drive. One advantage of Win95 is that the HKEY_DYN_DATA is stored in the system startup, and the collected release information is stored and configured. It saves in memory, WIN95 uses it to control hardware. Because it is in memory, it does not read from the hard disk, each time when you start your computer, the configuration may be different. Win95 must calculate more than 1600 possible configurations at startup. Therefore, if the system changes the established settings without reporting to Win95, there is a potential problem. Most of the system work well, but not the same. HKEY_USERS HKEY_USERS contains only the default user settings and login users. Although it contains all independent users' settings, the user setting is not available when the user has not launched the network. These settings tell the system which icons will be used, what group is available, which start menu is available, which colors and fonts are available, and what options and settings on the control panel are available. HKEY_CURRENT_USER is used to save the current user and default user information, and HKEY_CURRENT_USER maps only information of the current login user.

The simple introduction of each primary key hkey_local_machine hkey_local_machine is a process button for display control systems and software. The HKLM key holds the system information of the computer. It includes all software settings on the network and hardware. (, Such as the location of the file, registration, and unregistered status, version number, etc.) These settings are independent of these settings, because these settings are for all users using this system. HKEY_LOCAL_MACHINE / APPEVENTS In order to run applications such as the thin client, the APPEvents key in Win95 / 98 is empty. The application actually resides on the web server, which will save some pointers. HKEY_LOCAL_MACHINE / CONFIG This button holds all different hardware settings on your computer (you can create in the hardware configuration file from the control panel system properties). These configurations are typically copied to HKCC at startup. Each configuration is saved with a key (such as 0001 or 0002, etc.), each is a separate configuration. If you only have a single configuration, only 0001 This key hkey_local_machine / config / 0001 / display This button represents the settings of the display, such as screen font, form size, form position, and resolution, etc. The big resolution that is not supported by the computer causes Windows that cannot be started (black screen), and the resolution can be modified to resolve. Enter the security mode, run regedit.exe, modify the data value to 640, 480 or 800, 600 in the resolution of 640, 480 or 800, 600 in this key value, and then restart the computer. HKEY_LOCAL_MACHINE / CONFIG / 0001 / System This button holds the information in the system hkey_local_machineconfig / 0001 / system / currentControlSet / Control / Print / Printers In this key, there is a key to set up for each printer on the system, through the control panel Adding and deleting printers Adjusting this list hkey_local_machine / enum Enum key Include hardware devices found at startups and information that are plug-in-use cards. Win95 uses a bus to detect hardware information through different .ini files at startup. Those who are installed and detected at startup will appear here. Sub keys include BIOS, ESDI, Flop, Htree, ISAPNP, Monitor, Network, root, SCSI, and Virtual. The sub-key name represents their respective hardware device information. The HKEY_LOCAL_MACHINE / ENUM / BIOS BIOS button holds information about all plug-and-play devices in the system. They are listed in a set of code numbers, including detailed description of each key, for example, * PNP0400 is the key of the parallel port LPT1. If LPT1 does not have a plug and play function, it will not be included in the root key under Enum, the hkey_local_machine / enum / root root root key includes information of all non-plug and playing devices. Here, we can quickly determine which devices are plug-and-play, those not. For example, the SCSI adapter, this device must comply with a hardware setting for a key name forcedconfig in Win95, which will not change. The network function of HKEY_LOCAL_MACHINE / ENUM / Network Win95 has a detailed description, and the subkey includes the main service and protocols that have been installed. The HKEY_LOCAL_MACHINE / HARDWARE HARDWARE child button includes two multi-layer sub-keys: Description keys, which contains information about the central processor and a floating point processor.

There is also a device mapping button, which lists the serial keys below list all your COM ports. This hardware button only saves the information of the Hyper Terminal program, and the mathematical processor and serial port. HKEY_LOCAL_MACHINE / NETWORK This button only saves network login information. All network service details are saved in the HKEY_LOCAL_MACHINE / ENUM / NETWORK button. This button has a subkey, Logon, including the value of LMLOGON (local machine login? 0 = false 1 = true), logonvalidated, policy processing, main login mode (Windows login, Microsoft network customer style, etc.) , User name and user configuration. HKEY_LOCAL_MACHINE / Security Security has two sub-keys, the first is to access (it eventually causing a remote key to list network security resources, access permissions, etc.) and provide (including listing network addresses and address servers), this button is retained Use advanced security features and NT compatibility with advanced security features and NT compatibility to list all installed 32-bit software and programs .ini files. It includes changes, relying on software installation. The control functions of those programs are listed in the sub-keys here. Most sub-keys list the version number of the installation software. We found some interesting settings under / Microsoft / Windows / Current Version, which has the next subkey: 1.app Paths: The location of all 32-bit software you have installed. 2.Applets, Compression, Controls Folder: Includes an attachment that the underlying control panel is displayed. 3.Detect, Explorer: Many interesting children such as Namespace Keys of Desktop and My Computer - They point out the CLSID row of the recycle bin and dial-up network --- and prompt keys allow you to build your own tips. 4.Extensions: A list of extensions, currently associated extensions, and more suitable target types than specific execution files. 5.FONTS, FONTSIZE, FS Templates: System Attributes Selected File System Templates, Server, Desktop Computers, or Laptop Information. 6.ms-dos emulation: Includes an application compatibility subkey set for a large amount of program binary keys. 7.ms-dos options: Settings in DOS mode, such as Himem.sys, CD-ROMS, etc. 8.Network: Network driver configuration. 9.nls, Policies: System administrators think that you should not do things. 10.ProfileList: All list of usernames that can log in to your computer. 11. The mystery of programs running during Windows is that they are not in the startup folder of the start menu. They are executed in the hkey_local_machine / microsoft / windows / currentversion / subkey. Run: The program runs Runonce when starting: Windows initialization When the program is started once, this is often used when the system needs to restart the system after installing the software. RunServices: It is like Run, but contains "service", it is not like a general program, which is more important or "system" program. But they are not VXDs, just like McAfee or Regserve.

RunServicesONCE: It only runs once, but is the "system itself" installation (a large number of Windows installation parameters: Typical key values ​​include system directory locations, and Win95 updates, options to install components, and loop start directory sub-keys. Note: Note: Note: In many hacking Trojans software, often add key values ​​here (generally in run), which makes the Trojan software started and hidden with Windows startup. Here you can view the abnormal startup items and remove useless operations Procedure (for example, I don't like the super-unsatisfaction automatic server, you can remove it here). 12.SharedDlls: Share a list of DLLs, each gives a digital level in one unknown system. 13. Shell Extensions: Lists "recognized" OLE registry, and the corresponding CLSID connection. 14.Shellscrap: This contains a child key of prioritycacheformats, which includes a limited value, it is more like a smartdrive command line Parameter derived. 15.Time Zones: Primary key value is your current time zone; subkey defines the possible time zone. 16.unInstall: This saves the program in the Add / Remove Program dialog box; subkey contains points The path of the reverse installation process. And the installation wizard is similar .......) Winlogon (text sentence containing legal login) hkey_local_machine / system / currentControlSet This subkey includes device drivers and other services describe and control. Unlike Windows NT, Win95 includes only restricted drive control settings information. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / Control This subkey includes information in the Win95 Control Panel. Do not edit this information, because some small programs change in many places, a lost item will make this system change unstable hkey_local_machine / system / currentcontrolset / services This key includes all Win95 standard services. All added services and devices, each standard service key includes its settings and identification settings. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SYSTEM / CURRENTCONTROLSET / Services / Arbitrators Arbitrators key includes information that needs to be resolved when two devices share the same settings. Four sub-keys include memory addresses, conflicts, DMA, I / O port conflicts, and IRQ conflicts. The HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SYSTEM / CURRENTCONTROLSET / Services / Class Class key includes all Win95 supported device Classes control, which is similar to the hardware group you add new hardware, and how these devices are installed. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SYSINTACCS This button includes the availability of IE attachments for this system, which only appears only if you have installed IE2.0 or higher. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEMSMSNP32 MSNP32 describes how clients implements functions in the Microsoft network, which includes information about authentication processes and certificates. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SYSTEM / CURRENTCONTROLSET / SERVICESNWP32 NENP32 key describes how Windows customers work in the NetWare network that includes information about authentication processes and provenors.

HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEMOTEACCESS In this key include information that needs to be remotely operated on the Win95 system, with authentication parameters, host information, and protocol information for a dial-up connection. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / ServicesNMP This key includes the parameters of SNMP (Simple Network Management Protocol). It includes allowed management, configuring traps, and valid groups. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SYSTEM / CURRENTCONTROLSET / ServicesVXD VXD key includes all 32-bit virtual device driver information in Win95, and Win95 automatically manages them, so it is not necessary to edit them with the Registry Editor, so static VXDS subrogably lists. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEM / CURRENTWTROLSET / ServicesWebPost WebPost key includes all loaded Internet post offices settings, if you connect an ISP, and it lists this, you should give yourself a server. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SYSTEM / CURRENTCONTROLSET / SYSTEM / CURRENTCONTROLSET / ServicesWinsock This key lists information when connecting to the WinNsock file on the Internet, and if an incorrect file is listed, you will not connect to the Internet. HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / ServicesWINTRUST WINTRUST feature is to check if there is a virus from the file downloaded from the Internet, which makes it clean and secure files. HKEY_CLASSES_ROOT in the registry hkey_classes_root is an item that controls all data files in the system. This is in communication in Win95 and Winnt. The HKEY_CLASSES_ROOT control button includes all file extensions and all and execute files related files. It also determines the related applications that respond when a file is double-tible. HKEY_CLASSES_ROOT is used as a programmer to send information when installing the software, in Win95 and Winnt, HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE / SOFTWARE / CLASSES are the same. The programmer does not need to worry about the actual location when running their launcher. On the contrary, they only need to join the data in HKEY-CLASSES_ROOT. Under the Windows user graphical interface, everything ---- Each file, each directory, each applet, each connection, each driver - it is seen to be an object; each object has a certain Attributes and it contacts it. HKCR includes a list of object types and their properties. The main function of HKCR is set to: an object type and a file extension Associate an object type and an icon associated with an object type and a command line action associated definition object Type Related menu option and define each object type attribute option In Win95, the relevant menu is the menu that is popped up when you right-click on an object; the property is the dialog box after you select the properties. As a brief term is to change the setting of the HKCR to change the association of a given file extension default. Changing a default icon of a file type, and add or delete a pop-up menu content (or all object types) HKCR includes three basic types of sub-keys / ??? or file extension name key file extensions The name key is connected to the object type and related operations, attribute items, and related operations on the pop-up menu.

The / Object Type Sub Keys Object Type sub-key defines an object type in its default icon, its pop-up menu and properties item, its related operation, and its CLSID connection. / CLSID subkey is treated with a number to replace its name with a number under Windows. As people often use the name to handle things. CLSID is a number that identifies all listed icons, applications, directories, file types, and so on. It is Microsoft to be allocated by the manufacturer, each must be unique. The manufacturer places the CLSID in the installer file so you can update the registry when installing. The registry is a database that needs to do when the application is processed. For example, suppose you have a Microsoft Excel 7 electronic data table Word 7 document, when you double-click this electronic data table in Word, the application menu will become an Excel menu and the electronic data table enters the editing state, just as if You are in Excel. How did it know what to do? The files created by each Excel 7 have an Excel's CLSID connection. After Word reads this CLSID, look for instructions in the registry, depend on the data running the .dll file or application under CLSID. The CLSID subkey provides OLE and DDE information and icons for the object type. Related menus, or attribute items included in the sub-keys. This may be a key that most people feel "horror". Each CLSID number must be unique. In fact, for this destination Microsoft already produced a CLSID-generating program - this result caused you to get 32-bit 16-binding digital strings, unless you are a programmer, otherwise most of the part keys It looks very boring. They include memory management mode, client / server configuration, and OLE processing .dll connections. A little annotation about the child 1) Shell: shell button has a "action" subkey, like "Open", there is a Command subkey here; the Command subkey has a default sentence, which contains running the program Command Line. Place a "open" subkey in the shell sub key of an object type, a "open" option on this object type pop-up menu, give this Open key a Command (Default command line "C: / Windows /NotePad.exe% 1 ") The subkey will use the notebook as the default application when this object type is opened. Other operational options include View, Print, Copy, Virus, Scan, and so on. 2) SHELLEX: SHELLEX button has a subkey. Each of them contains a CLSID item that performs OLE and DDE functions for an object type (such as quick view, a menu processing subkey, pointing to a sentenceful CLSID key listing the file browsing function. DLL file) 3) Shellnew: shellnew contains a "command" sentence that contains a command line of open object type "new" file. 4) The Default "default" sentence contains a "default" sentence, which includes a command line of the icon (for example, "c: / windows / system /shell32.dll, 2" 2 is the third icon from 0 Remember, in the shell32.dll) In addition to the extension of the associated extension and file type, they have many items in HKEY_CLASSES_ROOT. All their items are also applicable to NT, such as interfaces and applications. Usually you will edit just a small part of this item. In addition to pop-up menus, all items included here will only be installed in the installation application, which is changed during the program or creates associations. You can't start the system without hkey_classes_root; you are really difficult to edit it.

HKEY_CLASSES_ROOT is a very important reason you need to register: the application control and operation of this system. Seeing its size and the complexity of this processing key, System.ini and Win.ini are no longer enough to use it. HKEY_CURRENT_CONFIG WIN95 typically only uses a hardware configuration file. If there are multiple hardware profiles. A key is added in HKEY_LOCAL_MACHINE / Config. HKEY_LOCAL_MACHINE / CONFIG contains the same data in HKEY_LOCAL_MACHINE, and you can choose the configuration file you are willing to use. If there is multiple installations, each time the system restarts, you must choose .hKey_current_config is starting to control the current hardware configuration when the system is started, and the changes in any place will automatically affect it. Programmers often use HKEY_CURRENT_CONFIG to easily access configuration information. HKEY_CURRENT_CONFIG includes details of existing configuration files in the system. Your hardware configuration file affects it is now. For example, if the configuration 0002 is selected, all 0002 configuration information is mapped to these keys HKEY_CURRENT_CONFIG to allow software and device driver to easily update the registry without involving multiple profile information. HKEY_LOCAL_MACHINE The same data and any registry change will change at the same time. HKEY_DYN_DATA is written when the hkey_dyn_data keys are started. It reproduces the dynamic data used by WIN95 to control hardware in the system. It only has three keys. They retain the very simple information required for system current monitoring in HKEY_DYN_DATA in addition to temporary files, without any data is written to the hard disk. All data is rewritten at the system each time you restart. In addition, some data may be written when the device changes states when the device changes. (For example, insert a network card in a PCMCIA slot) Config Manager configuration management includes information when each installation device is started in WIN95. When starting, it gets its list from HKEY_CURRENT_CONFIG and checks each item. If you find a device listed in the list, it reports this information to the system to install. If one of the devices in the list is not in the system, it will display this in this key value. The boot state of each device installed in the Enum system is listed in this button. If a device is not ready, it is displayed here. If it is ready, it will also be displayed. Each device pointer is also listed which registration This device is used to make its control of all devices in the Perfstats system Save in this key. It is very difficult to read, but it is very easy to understand through the system monitor to see which proves from the landing user on this machine and the network will be valid. HKEY_USERS HKEY_USERS will default users and currently The user's information is input to the registry editor, in Win95, it is only used by the landing user activated by the configuration file, which is also the case. Win95 acquires their information from User.dat, WinNT acquires information from NTUSER.DAT. The .dat file contains all the users based on the user-based registry and allows you to configure these users. If you change the settings of the default user, all new users will inherit the same settings. Moreover, those that have become variables that have been established. HKEY_USERS / .DEFAULT This button is used for all new users, and users' configuration files are created from this configuration file. It includes all environments, screens, sounds, and other users related functions.

HKEY_USERS / .DEFAULT / APPEVENTS This key lists the event response, description, and sound hkey_users / .default / APPEVENTS / Schemes default and current sound scenarios in this key and its sub-keys. In the time of the event, the system is broadcast. HKEY_USERS / .DEFAULT / Console This button saves the option, layout, screen color and font settings of the MS-DOS window. HKEY_USERS / .DEFAULT / Control Panel All information in Configure settings in the Control Panel is saved in this key and its sub-key HKEY_USERS / .DEFAULT / Control Panel / Accessibility This button holds all the auxiliary functions in the Control Panel. HKEY_USERS / .DEFAULT / Control Panel / Appearance This button saves all settings HKEY_USERS / .DEFAULT / Control Panel / Appearance / Schemes in the Control Panel to list the default, and each program is included. Color and font. HKEY_USERS / .DEFAULT / Control Panel / Colors This button saves the settings for each default color of Windows. Each value (color name) is like a RGB (red, green, blue) value. For example, black is 0 0 0, meaning that the red value is 0, the green value is 0, the blue value is also 0. The opposite white is 255 255 255. The other colors are all combined with RGB. HKEY_USERS / .DEFAULT / Control Panel / Sound This button determines if the system is in the error hkey_users / .default / environment This button saves the environment settings, the location of the specific temporary file hkey_users / .default / keyboard Layout keyboard layout settings Set to standard US British standard traditional keyboard layout. If you choose another layout, the digital list will be different, the installation settings of HKEY_USERS / .DEFAULT / SOFTWARE software are saved in this key, the default user only has the setting of the Microsoft program HKEY_USERS / .DEFAULT / SOFTWARE / Microsoft Microsoft app Related settings are placed in this key. If other Microsoft programs are installed, they update the Microsoft key of this user. In the following item, the default control HKEY_USERS / .DEFAULT / SOFTWARE / Microsoft / Windows Save only contact with Windows, and the Windows NT does not have a relationship, these settings are the same in Win95, using the same driver And function hkey_users / .default / software / microsoft / Windows NT based on NT function settings in this key.

Windows NT does not have these settings, it is unable to run, it builds the environment and network processes, user permissions, printers, fonts, etc. HKEY_USERS / .DEFAULT / SOFTWARE / Microsoft / Windows NTCurrentVersion / Winlogon This setting controls Windows NT login function HKEY_USERS /.Default/unicode program Groups Default Unicode program group is just used when using the program manager, Explorer does not use them S-1-5-21-1658001358-1336221227-1912232085-500 (SID) HKEY_USERS / S-1 -5-21-1658001358-1336221227-1912232085-500 This is currently the SID of the user, and users on each network are allocated by the domain user manager. Each SID is unique, so it relies on and landing Users, this information changes. It is called from the NTUSER.DAT file from the user profile. In general, it has a lot of sub-keys, which is the software of the base, the selected and final setup HKEY_USERS / SID / NETWORK this button, shows all the mappings connected to other systems. For example, if you map drive H: to // server1 / docs, it will display it as a subkey HKEY_USERS / SID / Printers This button shows all installed, shared and connected printers HKEY_USERS / SID / SOFTWARE The keys are separate user extensions based on other software installed for users or by users. HKEY_USERS saves all current login users and default users. The change of the login user is like using this system with different users, and the SID is the performance of user information. Use programs to retrieve any user's NTUSER.DAT file and view him to the registry to watch and edit. HKEY_CURRENT_USER HKEY_CURRENT_USER contains the same information listed in HKEY_USERS security discrimination. Any changes in HKEY_CURRENT_USER will also change immediately. This is also the case. HKEY_CURRENT_USER allows programmers and developers to easily access the settings of current login users. By establishing this button, Microsoft is easily changed, added, and settings without the SID of the user. That is, all current operation changes only for the current user, and does not affect other users. The secret (III) of the registry (3) Damage and Solutions of the registry three, the corruption of the registry and the problem that the registry may have problems. Access hardware and software may be greatly limited if the registry is seriously damaged, and even the system cannot start. Maybe a small problem, an application will not run normally, or unstable operation. When the registry is protected at runtime, it cannot be copied, deleted, or changing the content unless a "verified" program (such as the installer, registry editing tool, and domain user manager change security) Strategies and browsers, etc.). Because of these protection, the registry is very safe, but it is not fully prevented. The problem will still happen, you need to do prepare for them to cope with these issues.

When you have a problem with your registration, most of us will hear or feel the following symptoms to understand the problem, the characteristics of the registry problem are: Yesterday computer (or software program) work, but today it doesn't work; I still work before installing the software / hardware, but now I can't use it; my system is not working as before; when I try to turn off the computer, the hard disk is not stopped without stopping; my computer can't start The day! It is blue screen, crash; the registration form is abnormal, there are three reasons: 1. Application and driver is added to the system 1) Finding a large number of errors in the registry is related to the addition and delete programs. Most users add or update drivers, applications, and more. And it is multiple times to add and delete. 2) The program itself has problems. There is no BUG or error without any application. The best situation is wrong with minimal, and the complex problem, you may never have seen it. These errors are placed regardless of time and funding when designing the program. As a programmer, there is an error in the program may be secondary, but it makes the system crash it into a big problem. 3) The driver is not compatible. The open structure system of the personal computer world has caused a certain risk because any type of component is all possible. But testing all combinations and ensuring that the compatibility of all devices is unlikely. So when used in Win95 is used in WinNT, some issues will be generated. 4) Add incorrect items to the registry during the application installation. At the time of installation, most applications use files called setup.inf Details, for example, what disk is needed, which directory will be established, where to copy files, enable the application to establish registry items established normally need to be established, etc. Detailed information . If there is an error in Setup.inf, this change will still appear, and there will be serious problems. 5) An application leads to another application and its default file association error. When an application is installed, the default file type is recorded in the registry. The user can then start the application and load files by double-click. Many times, other applications will also use the same extension. For example, when a TIF graph is activated in the registration setting, the last loaded program will become an actuator. Sometimes, a completely different and incompatible procedure will use the same file extension in their own document files, and the shortcut to start the document will not work. In the user operation, if an incorrect program is selected in the file open mode, a certain issue will cause a certain issue. 6) An error occurred during the reverse installation. When you add / delete a program in the Control Panel, you may cause damage to the registry by the application itself, or through a third-party software. In addition, delete programs, secondary files, data files, and anti-installation programs may try to remove the parameters of the registry. Because the system is impossible to know the relevant parameter items you want to access in the registry, this will remove the parameter items of other applications. 7) The font error. When the font ID in the registry error, you will see a different font in the application. This makes people feel annoying and may need you to remove some or all fonts and replace them. This often occurs when users are frequently installed and deleted fonts. 2, hardware settings change or hardware failure 1) If there is a problem with your computer system itself, the registry will damage. Generally, these errors can be avoided in the correct system maintenance and management. 2) Virus problem. The virus is very hidden to change the normal documents and some content in the registry to affect our system.

3) Computer electricity will affect the computer system if it is not normal, can be avoided with UPS. 4) Disk problem. Many times you will change your hard drive because you can't make your hardware failure. If the entire hard disk fails, of course, you will have to recover your registry from your backup. Other, the disk independent sector or a cluster is faulty. Although these situations are impossible in today's systems, the failure of disk surface media will make disk sections are not readable, including those registry file locations. 3. User changes the registry 1) Manually change the registry. When people manually edit the registry, due to the complexity of the data, it is inevitable that they can easily make mistakes, and this error may be seriously caused by system work. 2) Copying other registration tables is a serious mistake of many users. Because the registry files from other machines are not meant to work properly on this machine. The registry is special for a separate system. Even the same computer hardware device, the copy of the registry will work in another system. If you use another system registry, most hardware devices will not work, users and security issues may cause data and application information that cannot be used. Protecting the Windows Registry Protection Registry is important, there are many different tools to achieve this. When there is no security setting, the user may have more errors. Fortunately, they can have a few ways to protect the Windows registry, they can use additional copies to resume the registry with additional copies. The following is some of the methods: 1. Use the Windows Backup Software Note: Win95 and Win98 backup program have some differences, here only WIN98 backup program. A backup program is included in Win98. If you choose WIN98 if you choose Custom Installation, or you can install it in the Add / Remove program in the Control Panel. When you install this backup program, from the Start Menu | Program | Accessories | System Tools | Backups can run it. When startup, this program prompts you to create a new backup, open an existing backup job, or restore the backup file. If you choose to create a new backup, there will be a backup wizard prompting how you go to back up. If you choose to cancel the wizard, you can manually set the content you want to back up. The files for the network and the local drive can be backed up in the backup content. You can play backup work on the selection box you want to back up the disk or file. Then fill in the destination position of your backup in the backup. If you want to back up with the Windows registry, you can play the right in the Job | Options | Advanced, select the box to play the Windows Registry. Recovery is the backup process, which is not detailed here. 2. Copy the Registry File in Safety Mode When Win95 is running, the registry file is locked and can only be used by the registry editor or the system itself, which cannot be copied to other places. If you start Win95 in security mode, the registry will not load the same method, so system.dat and user.dat can be copied. In fact, the system files are protected in safe mode. At startup, press the F8 key to enter the security mode when the computer displays Starting Windows 95 .... Change System.dat and User.dat hidden and read-only properties can be seen and copied. When copying the registry file, don't forget to change them to read and hide properties. 3. Use Microsoft Configuration Backup to back up your registry file cfgBack.exe is the backup software included with the Win95 (there is no software in Win98). It is on the / Other / Misc / CFGBack on Win95CD-ROM. Copy all files on the system to any directory, then create a shortcut for cfgBack.exe on the desktop. To make a backup of a registry, start cfgback and enter a name at the selected backup name and then click backup.

Note: Determine all running programs before using CFGBACK. If there are programs running, cfgBack may make the system crash, data loss, and save an incomplete backup. 4, export registry in my opinion, if you don't have a tape drive or other things. Guide the option in regedit.exe has an export to text file. Usually use a compression tool, exporting tool options can also be used to use methods for saving and protecting registry. To export any key in the registry, select this button and select Register | Export the registry file. This will copy this button and prompt you to store this key and its name, then save this data with a file that extension .reg. When we export the registry with a text format. We can save space with PKZIP or other compression tools (can run in normal DOS mode). To back up we can create a folder for your backup in a Windows directory. At least one month we should perform a regular backup. Because many computer users subscribe or purchase a computer magazine with a gift CD. There are a lot of time-limited shared software on these CDs. Many users are installed in one or more programs. When the software expires these programs, these programs have left some traces in the registry. Frequent addition / delete programs affect the registry, but there is a relatively safe backup. We must restart your computer to DOS mode to import, assume you to export your registry as mar99.reg. Now playing the regedit / c mar99.reg registry editor to import your registry in the command prompt. To import your registration in Mar99.Reg Table and save. However, only the entire imported work is more reliable under the command prompt. Tip: If your registry constantly changed, then export it first, import it one by one. Unnecessary items in the registry during this import export will be cleared. If you use Win98, then you can use the ScanReg.exe program. Match ScanReg / Fix under the Windows Directory command prompt to execute the command. Warning: When you want to see an exported registry content (extension is a .reg file), don't double-click it, extension .reg file, and regedit.exe are associated, this will not have any prompts Automatically import this file into the registry. If there is incorrect data in this file, it will destroy the registry. To edit this file, select it, then right-click it and select Edit. Remember, prevent more than repair. No matter what kind of method you choose to back up the registry, do it. The registration form is too easy to change. When you have a sudden event, a backup of a few registry on your hand is the best way to solve the problem. Recovering from the Registry Failure This Four different levels of methods can restore the Restart Redetect RESTORE Reinstall from the Windows Registry Failure Let's see every method to determine how it is best for time, and how to solve what type of problem . RESTART (Restart) WIN95 Registry Most of the content is saved in the RAM. If which information is damaged, it must reread correct information. When you restart the system, the registry can use the data from the hard disk to the RAM. Take the font ID problem. Each font is used in the system with one ID number. This font is saved by this digital when a font is used in a document and is identified by a name. When the font ID is damaged, the font display and print will be replaced by other fonts. Restart the system from the hard disk to refresh the data, will generate a fixed font ID, so the font display and printing will change. This is why the Windows system fault often returns to normal reasons after restarting. Redetect The Devices If a device is not working properly, the settings of the control device in the registry may be damaged.