From an InCtrl report to a .reg file

  • Thread starter Thread starter Sinus Logarithme
  • Start date Start date
S

Sinus Logarithme

I need to undo changes made to the registry. I have an
InCtrl report. A number of values like the ones below have
been deleted or changed. The problem is that I don't know
how to write these info in a .reg file, I need help with the
syntax.

HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec\Application
"(Default)"
Type: REG_SZ
Data: Firefox

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
"View"
Type: REG_BINARY
Old data: 2C, 00, 00, 00, 00, 00, 00, 00, 01, 00,
00, 00,
FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF,
FF, FC, FF, FF, FF, 58, 01, 00, 00, 02, 04, 00, 00, DD, 02,
00, 00, 71, 01, 00, 00, 70, 02, 00, 00, 61, 00, 00, 00, 92,
01, 00, 00, 01, 00, 00, 00
 
If you use Outlook Express to view the newsgroup then you can save the
attachment attached to this reply. Alternatively, follow my instructions:

1) Create a new Text File (Notepad)
2) Paste in the following: Exactly as shown below (make sure that you use
Windows Registry Editor Version 5 as the top line in the file):

--------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec\Application]
@="Firefox"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
]
"View"=hex:2C,00,00,00,00,00,00,00,01,00,00,00,FF,FF,FF,FF,FF,FF,\
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FC,FF,FF,FF,58,01,00,00,02,04,00,\
00,DD,02,00,00,71,01,00,00,70,02,00,00,61,00,00,00,92,01,00,00,\
01,00,00,00

-------------------------------------------------

Do not include the line above, just the data

3) From the FILE menu of Notepad click SAVE AS

4) Choose a directory to save the file, but before clicking save do this:

In the FILENAME box type "Backup Registry File.reg" (with quotes) & click
SAVE

This will create a registry file called 'Backup registry file'. All you need
to do now is double-click the newly created registry file & it will ask if
you want to add the data into the registry. Click YES or OK & you will be
notified that the information has been sucessfully entered into the registry
IF you have the permission to add info to the registry.

I hope this helps

Crouchie1998
BA (HONS) MCP MCSE
 
Try exporting the keys (or similar keys) to see what the structure needs to
look like.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I need to undo changes made to the registry. I have an
| InCtrl report. A number of values like the ones below have
| been deleted or changed. The problem is that I don't know
| how to write these info in a .reg file, I need help with the
| syntax.
|
| HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec\Application
| "(Default)"
| Type: REG_SZ
| Data: Firefox
|
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
| "View"
| Type: REG_BINARY
| Old data: 2C, 00, 00, 00, 00, 00, 00, 00, 01, 00,
| 00, 00,
| FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF, FF,
| FF, FC, FF, FF, FF, 58, 01, 00, 00, 02, 04, 00, 00, DD, 02,
| 00, 00, 71, 01, 00, 00, 70, 02, 00, 00, 61, 00, 00, 00, 92,
| 01, 00, 00, 01, 00, 00, 00
 
I have alread created the file for the user, Dave. You are around 1 hour too
late with your reply.

Why on earth do you always continue to add useless information or a post
after the questions has been answered? It seems poinless to me.

Are you getting points from the MVP program for the number of posts you
reply to? It can be the only reason

Crouchie1998
BA (HONS) MCP MCSE
 
Thank you for your file, Crouchie1998. I used the same
syntax to add the other deleted values reported by InCtrl,
but I still have a difficulty:
I tried to translate this:

HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec "(Default)"
Type: REG_SZ
Data: "%1",,0,0,,,,

into:
[HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec]
@="%1",,0,0,,,,

but I think that's wrong. Although I get 'Info in xxx.reg
has been successfully entered...', it doesn't show in the
registry. Please give me the right syntax.

If this doesn't work, I don't know what I should do. When I
try to use Firefox, it still doesn't work properly, AND the
new values (like in the file you sent me) get deleted.

I have backups of hklm and hk_users that I made 5 hours
before the problems with Inf-tool. I could enter them in the
registry, but what about hkcr ? I could also try to make a
clean install of Firefox, but I'd have to go through the
config, add my extensions, configure them, add my search
engines, etc. I'd appreciate having an opinion.

But maybe the keys with "%1" will straighten up
everything...
Thanks
 
In said:
I have alread created the file for the user, Dave. You are
around 1 hour too late with your reply.

Why on earth do you always continue to add useless information
or a post after the questions has been answered? It seems
poinless to me.

To *you*. Why are you always so rude?
 
In said:
Thank you for your file, Crouchie1998. I used the same
syntax to add the other deleted values reported by InCtrl,
but I still have a difficulty:
I tried to translate this:

HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec "(Default)"
Type: REG_SZ
Data: "%1",,0,0,,,,

into:
[HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec]
@="%1",,0,0,,,,

but I think that's wrong. Although I get 'Info in xxx.reg
has been successfully entered...', it doesn't show in the
registry. Please give me the right syntax.

String (REG_SZ) *data" is always surrounded by dbl-quotes (in .REG
files), so (assuming no other problems) you (probably) want
=""%1",,0,0,,,,"
(I do not have Mozilla/FF here)
If this doesn't work, I don't know what I should do. When I
try to use Firefox, it still doesn't work properly, AND the
new values (like in the file you sent me) get deleted.

I have backups of hklm and hk_users that I made 5 hours
before the problems with Inf-tool. I could enter them in the
registry, but what about hkcr ? I could also try to make a
clean install of Firefox, but I'd have to go through the
config, add my extensions, configure them, add my search
engines, etc. I'd appreciate having an opinion.

My opinion (FWIW) is to re-install. Probably takes less time
anyway. And once installed and working correctly you can then
Export such keys for study and comparison.
 
files), so (assuming no other problems) you (probably) want
=""%1",,0,0,,,,"

I used double-quotes and the data was written in the
registry. But again, when I opened Firefox and then closed
it, the new data was erased.
My opinion (FWIW) is to re-install. Probably takes less time

Thank you for your opinion. I must say I lean towards using
the reg backups. That's one against one. Before deciding one
way or another, I need one more info:
Before the accident, there were 2 control sets:
ControlSet001 and 002. Now, I have 001, 003 and 004 (I
assume that's because I booted twice using the Last known
config). Supposing that I feed the hklm and hku backups into
the registry, what happens with ControlSet003 and 004 ?
Should I delete them ?


Mark said:
Thank you for your file, Crouchie1998. I used the same
syntax to add the other deleted values reported by InCtrl,
but I still have a difficulty:
I tried to translate this:

HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec "(Default)"
Type: REG_SZ
Data: "%1",,0,0,,,,

into:
[HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec]
@="%1",,0,0,,,,

but I think that's wrong. Although I get 'Info in xxx.reg
has been successfully entered...', it doesn't show in the
registry. Please give me the right syntax.

String (REG_SZ) *data" is always surrounded by dbl-quotes (in .REG
files), so (assuming no other problems) you (probably) want
=""%1",,0,0,,,,"
(I do not have Mozilla/FF here)
If this doesn't work, I don't know what I should do. When I
try to use Firefox, it still doesn't work properly, AND the
new values (like in the file you sent me) get deleted.

I have backups of hklm and hk_users that I made 5 hours
before the problems with Inf-tool. I could enter them in the
registry, but what about hkcr ? I could also try to make a
clean install of Firefox, but I'd have to go through the
config, add my extensions, configure them, add my search
engines, etc. I'd appreciate having an opinion.

My opinion (FWIW) is to re-install. Probably takes less time
anyway. And once installed and working correctly you can then
Export such keys for study and comparison.
But maybe the keys with "%1" will straighten up
everything...
Thanks
 
In said:
I used double-quotes and the data was written in the
registry. But again, when I opened Firefox and then closed
it, the new data was erased.


Thank you for your opinion. I must say I lean towards using
the reg backups. That's one against one. Before deciding one

Except, you don't actually have any kind of backup really, other
than massaging the InCtrl report data as I understand it. If you
really have a backed-up copy of the system SOFTWARE hive, then
another technique might be used/useful. Details on your (other
post), "I have backups of hklm and hk_users that I made 5 hours
before the problems with Inf-tool." may be helpful.
way or another, I need one more info:
Before the accident, there were 2 control sets:
ControlSet001 and 002. Now, I have 001, 003 and 004 (I
assume that's because I booted twice using the Last known
config).
Yes.

Supposing that I feed the hklm and hku backups into

I don't quite take your meaning on the above.
the registry, what happens with ControlSet003 and 004 ?
Should I delete them ?

No. Ignore all that and if working in a ControlSet area stick with
the CurrentControlSet.

See:
HKEY_LOCAL_MACHINE\SYSTEM\Select\
for reference if you are not already familiar with that key and
contents.
Mark said:
Thank you for your file, Crouchie1998. I used the same
syntax to add the other deleted values reported by InCtrl,
but I still have a difficulty:
I tried to translate this:

HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec "(Default)"
Type: REG_SZ
Data: "%1",,0,0,,,,

into:
[HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec]
@="%1",,0,0,,,,

but I think that's wrong. Although I get 'Info in xxx.reg
has been successfully entered...', it doesn't show in the
registry. Please give me the right syntax.

String (REG_SZ) *data" is always surrounded by dbl-quotes (in ..REG
files), so (assuming no other problems) you (probably) want
=""%1",,0,0,,,,"
(I do not have Mozilla/FF here)
If this doesn't work, I don't know what I should do. When I
try to use Firefox, it still doesn't work properly, AND the
new values (like in the file you sent me) get deleted.

I have backups of hklm and hk_users that I made 5 hours
before the problems with Inf-tool. I could enter them in the
registry, but what about hkcr ? I could also try to make a
clean install of Firefox, but I'd have to go through the
config, add my extensions, configure them, add my search
engines, etc. I'd appreciate having an opinion.

My opinion (FWIW) is to re-install. Probably takes less time
anyway. And once installed and working correctly you can then
Export such keys for study and comparison.
But maybe the keys with "%1" will straighten up
everything...
Thanks
 
than massaging the InCtrl report data as I understand it. If you

I am afraid I created some confusion because I mixed up my
first post here with a more general question I had submitted
elsewhere, a couple of days before. To straighten things up:
- I carried out the installation of a util called inf-tool
using inCtrl.
- Many modifs reported by inCtrl related to firefox.
- I didn't do a thing related to firefox, in inf-tool.
- The screen in firefox became practically empty.
- I uninstalled inf-tool.
- I installed firefox over its previous installation.
- I booted twice using the Last known config.
- I started massaging the registry, as you put it.
- The situation of firefox didn't change a bit.
post), "I have backups of hklm and hk_users that I made 5 hours
before the problems with Inf-tool." may be helpful.

I have several recent registry exports on my disk:
- regLocal.reg (7 megs) : hklm\software, dated 5 hours BA
(Before Accident),
- regUsers.reg (1 meg) : the whole of hku, dated 5 hrs BA,
- reg004.reg (13 meg) : the whole of hklm and hku, dated 11
hrs BA,
- hkcu.reg (2 meg) : the whole of hkcu, dated 25 hrs BA,
- hklm.reg (25 meg) : the whole of hklm, dated 25 hrs BA.
(The only one made by me is reg004.reg, the others were made
by utils - The differing formats explain the discrepancies
in the sizes)
I don't quite take your meaning on the above.

I meant merging regLocal.reg and regUsers.reg into the
registry.
See:
HKEY_LOCAL_MACHINE\SYSTEM\Select\
for reference if you are not already familiar with that key and
contents.

Now I understand !
another technique might be used/useful. Details on your (other

What, what, what ?


Mark said:
I used double-quotes and the data was written in the
registry. But again, when I opened Firefox and then closed
it, the new data was erased.


Thank you for your opinion. I must say I lean towards using
the reg backups. That's one against one. Before deciding one

Except, you don't actually have any kind of backup really, other
than massaging the InCtrl report data as I understand it. If you
really have a backed-up copy of the system SOFTWARE hive, then
another technique might be used/useful. Details on your (other
post), "I have backups of hklm and hk_users that I made 5 hours
before the problems with Inf-tool." may be helpful.
way or another, I need one more info:
Before the accident, there were 2 control sets:
ControlSet001 and 002. Now, I have 001, 003 and 004 (I
assume that's because I booted twice using the Last known
config).
Yes.

Supposing that I feed the hklm and hku backups into

I don't quite take your meaning on the above.
the registry, what happens with ControlSet003 and 004 ?
Should I delete them ?

No. Ignore all that and if working in a ControlSet area stick with
the CurrentControlSet.

See:
HKEY_LOCAL_MACHINE\SYSTEM\Select\
for reference if you are not already familiar with that key and
contents.
Mark said:
In microsoft.public.win2000.registry Sinus Logarithme wrote:

Thank you for your file, Crouchie1998. I used the same
syntax to add the other deleted values reported by InCtrl,
but I still have a difficulty:
I tried to translate this:

HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec "(Default)"
Type: REG_SZ
Data: "%1",,0,0,,,,

into:
[HKEY_CLASSES_ROOT\CHROME\shell\open\ddeexec]
@="%1",,0,0,,,,

but I think that's wrong. Although I get 'Info in xxx.reg
has been successfully entered...', it doesn't show in the
registry. Please give me the right syntax.

String (REG_SZ) *data" is always surrounded by dbl-quotes (in .REG
files), so (assuming no other problems) you (probably) want
=""%1",,0,0,,,,"
(I do not have Mozilla/FF here)


If this doesn't work, I don't know what I should do. When I
try to use Firefox, it still doesn't work properly, AND the
new values (like in the file you sent me) get deleted.

I have backups of hklm and hk_users that I made 5 hours
before the problems with Inf-tool. I could enter them in the
registry, but what about hkcr ? I could also try to make a
clean install of Firefox, but I'd have to go through the
config, add my extensions, configure them, add my search
engines, etc. I'd appreciate having an opinion.

My opinion (FWIW) is to re-install. Probably takes less time
anyway. And once installed and working correctly you can then
Export such keys for study and comparison.

But maybe the keys with "%1" will straighten up
everything...
Thanks
 
Back
Top