Registry backup

[Phil Rabichow]

I'm not sure what you're trying to do. Your first question was how to back up the registry & R2 has now posted complete instructions on backup & restore. This is the first you've mentioned McAfee. If your trying to uninstall it, what happens if you use Add/Remove Software from the Control Panel?

[R2]

It looks like they are telling him to uninstall using the MS Installer -- and via the Class ID number -- which is a little strange. The /x switch is for uninstall. and the parameters are Package|ProductCode. I guess the ProductCode could be the CLSID, but is the line missing the "Package"???

Info on msiexec.exe:
http://www.swynk.com/trent/Articles/msiexeccom.asp

[bigaldoc]

Can you tell us some more about this McAfee story, please? McAfee has always been "fussy" about un-installation, but one should always first do the "normal" uninstall via Windows. Usually after that, one needs to erase the McAfee (NAI) folder or folders from the hard drive and then use REGEDIT to delete the McAfee/NAI keys in the registry. I'm hesitant to suggest you do that, unless you're "comfortable" with modifying the registry, even IF you've made a backup! We need more info.....

[rabee]

OK, the McAfee story:
It came with the Dell computer in 2000, along with Win98SE. The problem started when I could never get a connection
to update McAfee.....tried many times - it just never would connect. So, I THOUGHT I had uninstalled it, and got a new and
different AntiVirus program.
Things were "normal" for the next year or so, then out of the blue, McAfee screens started popping up when I downloaded
something (pictures, small programs, etc.). It was at this point I wrote to McAfee to find out why I couldn't get rid of the
remnants of McAfee. They sent me the instructions, and when they wouldn't do what they said.............several tries.........
I wrote to you guys.
In the meantime, I have used FIND, then deleted whatever McAfee stuff showed up, including a vshwin.exe file.
What bothers me is, I think I did all this same stuff (except for the DOS attempt- with the registry) before......then, it came back
like a ghost. It's gone for a year, then, out of nowhere, it's back. That's where we are now.
One other note: I do a lot of graphics, and when the computer get "loaded" with bmps, it starts acting up. Could this
cause some of the other stuff? I usually unload the BMPs onto a CD - that seems to help matters. Just a clue.

[rabee]

Another question - re:registry - dos - McAfee remnants......
Since I was having so much trouble getting anything done in DOS,
I decided to try "regedit" in the Run box, and sure enough, there was the registry.
I didn't do anything but look around, but, I found a McAfee folder listed there.
Would I be able to delete the folder safely in Windows rather than having to go to DOS?????
If so, exactly what do I have to do (obviously I'm too chicken to experiment)
Hope this isn't getting too long-drawn out, and thanks for the help.

[R2]

What looks like a "folder" in the registy is really a "key". No, you cannot delete a "key" in Windows or DOS, per se -- you do it in regedit.

But you don't have to delete anything -- simply rename it. The standard way of temporarily "removing" a registry key is to simply put a minus sign (-) in front of the name. That way, Windows will not find the key since it is not looking for keys with minus signs.

You can do the same thing with your Folders or Files. A renamed folder or file cannot be found by Windows.

[bigaldoc]

And may I add to what R2 said by a reminder that while in Regedit, you need to look in TWO places: HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. For both of those trees, open Software and look for keys with EITHER McAfee or NAI. They have not always been consistent in the past and I've sometimes found both references. I usually delete 'em when I find 'em but I think you'd be well served to take R2's suggestion about disabling.

[R2]

FYI and FWIW: RegCleaner is no longer supported -- and if you 'bought it', ask for your money back. As long as I can remember it was always freeware.

The newest JV16 product is called jv16 PowerTools and it includes the Registry Tool -- which is the decendant of RegCleaner.

[leif, Erickson?]

<P ID="edit" class=small>(Edited by DaveA on 07-Feb-03 19:20. )</P>Rabee: I had a similar experience with McAfee. Then my organization asked me to shift to Norton. I uninstalled McAfee via WIN 98 - and discovered later there were approx 600+ McAfee entries still in Register because I was still having problems even after running SystemWorks. I ended up buying RegCleaner at http://www.vtoy.fi/jv16/shtml/software.shtml. This site had people praising RegCleaner. It found them and deleted them and I still have McAfee showing up during start up, but I did get rid of all the problems, folders, etc. Like you, I was nervous about those deletes/changing registry, but it cured a bunch of problems and didn't seem to cause new ones. Only problem with RegCleaner web site is that it seems non-www-compliant and I had to fire up IE instead of Opera to browse it just now. leif, Erickson?

[almavery]

How much of this superb! explanation is applicable to W2K?

Thanks,

[rgrosz]

Unfortunately, very little is applicable to Win2K or WinXP. I highly recommend the freeware program ERUNT

It is the only free program I have found that allows you to backup a Win2K / WinXP registry.

[R2]

This was never meant to be for Win2K-XP -- that is why it is under the Windows98 forum.

However, I did post some information on backing up the Win2K Registry in this thread.

[R2]

Edited by HansV to remove link that no longer worked and to replace another link

I was asked to combine my above posts into one. Here is a sample. Let me know what should be changed. Thanks.
__________________________________________________ _

Backing up -- and Restoring -- the Windows98 registry

A. Backup - using ScanReg

1) Windows 98's ScanReg program automatically holds five backup copies of your registry at all times. These are held within ".cab" files (a type of zipped folder) inside a hidden folder named "C:WindowsSysbckup".

2) A backup is made for each new date that you reboot your computer. Therefore, if you reboot your computer five times today, only ONE backup from today will be saved -- the other four will be from previous days.

3) You can force windows to save a new copy for today by opening a Run box (Start | Run) and typing "scanregw" (no quotes) and hitting Enter. If Windows has already saved a copy for today, it will tell you this and ask you if you want to overwrite today's previously saved copy.

B. Backup - other methods There are several other ways to backup your registry -- including third party programs. But two ways that you can use without getting anything new are these:

1) Open a Run box again and type "regedit" (no quotes) and hit Enter. This opens your registry. Click Registry and select Export Registry file. Make sure the Export range is set at "All". Export the file to a new folder called "Backup" (or something easy to identify). Title the file with today's date (013103.reg or 31Jan2003.reg) ) and hit save. Now you have a complete backup as of today.

2) While you are at it, open a Find box and find user.dat and system.dat. Copy both of these into the same "Registry Backup" folder. Once they are there, rename them "user.31Jan2003.dat" and "system.31Jan2003.dat" -- or something equally useful.

You now have compulsively backed up your registry with several levels of redundancy.

____________________


Restoring a Backed-up Registry

A. Using ScanReg to Restore your Registry

The simplest method to restore is to use the scanreg.exe /restore function. This must be run from true DOS -- not from a DOS window inside of Windows. Since the registry controls essentially everything Windows does, you cannot restore the registry with Windows running. You must reboot your computer into DOS to restore the registry.

At the "C:/ Prompt", type "scanreg /restore" (no quotes) and hit Enter. I am sure there are multiple references out there. The first one I came to was this one:

Using ScanReg

...which is about Scanreg in general, but it touches on the "/restore function". The process is fairly intuitive, so it does not need a ton of explanation.

B. Restoring your Registry from the User.dat and System.dat files

This is a little more complicated, but it used to be the only reliable to way to do it in Win95. As above, this must be done in true DOS, so it helps to have a basic knowledge of DOS commands. After rebooting into DOS you need to change to the Windows directory, modify the attributes for the two .dat files, change back to the root directory, copy the desired backed-up .dat files to the Windows directory, then reboot. In "DOS" that is:

cd
cd windows
attrib -h -s -r system.dat
attrib -h -s -r user.dat
cd
copy c:Backupsystem.dat c:windows
copy c:Backupuser.dat c:windows

Then hit CTRL+ALT+DELETE to reboot.

Please note: The names of the files that you wish to restore should be renamed back to their originals -- that is, "user.31Jan2003.dat" should be renamed "user.dat" -- prior to restoring. Keep them in the "Backup" folder, but for the exact files that you wish restore, remove the date in the center. That will make it easier for you to find and copy them in DOS.

For more information or restoring your registry from the user.dat and system.dat files, please see:

Restoring the Registry
BACKING UP / RESTORING THE REGISTRY

C. Restoring specific sections of your Registy

Regedit is generally a Windows application. Therefore, for the same reasons as above, you cannot "restore" (read: Import) your entire registry using regedit -- however, you CAN restore entire sections.

One more thing worth mentioning -- It is also nice to have a "picture" of your registry before you do any major installing/uninstalling. Then you can get another "picture" afterwards and compare the two. If you wish to 'fix' a certain section of your registry after some event, you can find out what has changed by "comparing" the two pictures.

You can do this by simply comparing the entire registry files (.reg) using something like WinDiff -- but the process and the analysis is, well, challenging. A better method is to use "regshot" -- which is a very cool program for several reasons. Combining the use of RegShot with your backed up .reg file, you can go in and surgically return specific sections of you registry back to exactly the way they were before the 'event' that you were monitoring.

PCWorld's description of RegShot