Registry backup

Topic

New Reply

I’m told that I should backup the registry before manually uninstalling a program –
How do you do that?
I’ve been scared off of EVER touching the registry, so I want to be sure I
don’t do something stupid. Thanks

Reply | Quote

Replies

post 201506 by R2 (Rick) should provide the information. It also has a link to a more complete explanation.
Cheers,

Reply | Quote

Just to add some thoughts:

1) Windows 98 automatically holds five backup copies for you at all times.
2) A backup is made for each new date that you reboot your computer. Therefore, if you reboot your computer five times today, only ONE backup from today will be saved — the other four will be from different days.
3) You can force windows to save a new copy for today by opening a Run box (Start | Run) and typing “scanregw” (no quotes) and hitting Enter. If Windows has already saved a copy for today, it will tell you this and ask you if you want to overwrite today’s previously saved copy.
4) There are multiple other ways to backup your registry — including third party programs. But two ways that you can use without getting anything new are these:

a) Open a Run box again and type “regedit” (no quotes) and hit Enter. This opens your registry. Click Registry and select Export Registry file. Make sure the Export range is set at “All”. Export the file to a new folder called “Registy Backup” (or something easy to identify). Title the file with today’s date (013103.reg or 31Jan2003.reg) ) and hit save. Now you have a complete backup as of today.

While you are at it, open a Find box and find user.dat and system.dat. Copy both of these into the same “Registry Backup” folder. Once they are there, rename them “user.31Jan2003.dat” and “system.31Jan2003.dat” — or something equally useful.

You now have compulsively backed up your registry with several levels of redundancy.

Reply | Quote

> You now have compulsively backed up your registry with several levels of redundancy.

And next week’s lesson will teach you how to restore it…

StuartR

Reply | Quote

I assume that comment is facetious, but…

1) The simplest method to restore is to use the scanreg.exe /restore function.
2) You cannot “restore” (read: Import) an entire registry using regedit — however, you CAN restore entire sections.
3) You CAN restore your entire registry using the user.dat and system.dat files — hence the reason for backing up these separately.
__________

One more thing worth mentioning — It is also nice to have a “picture” of your registry before you do any major installing/uninstalling. Then you can get another “picture” afterwards and compare the two.

You can do this by simply comparing the entire registry files using something like WinDiff — but the process and the analysis is, eh, challenging. A better method is to use “RegShot” — which is a very cool program for several reasons. Combining the use of RegShot with your backed up .reg file, you can go in and surgically return specific sections of you registry back to exactly the way they were before the ‘event’ that you were monitoring.

PCWorld’s description of RegShot

Reply | Quote

I don’t know for sure, but I don’t think he was being fecetious. But you took the bait! Good job, R2!

Reply | Quote

Thank you, if I had known you were going to be that quick I could have said “tomorrow’s lesson”. Nice job.

StuartR

Reply | Quote

In case someone actually needs to use Scanreg /restore, I am sure there are multiple references out there. The first one I came to was this one:

Using ScanReg

…which is about Scanreg in general, but it touches on the /restore function. The process is fairly intuitive, so it does not need a ton of explanation.

If someone want to try to restore using the user.dat and system.dat files, it is a little more complicated. This used to be the only way to do it in Win95! It is done in DOS, so it is nice to have a basic knowledge of DOS commands:

Restoring the Registry
BACKING UP / RESTORING THE REGISTRY
Backup & Restore your Registry

Reply | Quote

In case you haven’t read it, I’m taking advantage of the timliness of your tutorials to try to help Duchess in this thread. I’m hoping she has a backup that usable from BEFORE her problem started.

Reply | Quote

Edited by HansV to remove link that no longer worked and to replace another link

I was asked to combine my above posts into one. Here is a sample. Let me know what should be changed. Thanks.
___________________________________________________

Backing up — and Restoring — the Windows98 registry

A. Backup – using ScanReg

1) Windows 98’s ScanReg program automatically holds five backup copies of your registry at all times. These are held within “.cab” files (a type of zipped folder) inside a hidden folder named “C:WindowsSysbckup”.

2) A backup is made for each new date that you reboot your computer. Therefore, if you reboot your computer five times today, only ONE backup from today will be saved — the other four will be from previous days.

3) You can force windows to save a new copy for today by opening a Run box (Start | Run) and typing “scanregw” (no quotes) and hitting Enter. If Windows has already saved a copy for today, it will tell you this and ask you if you want to overwrite today’s previously saved copy.

B. Backup – other methods There are several other ways to backup your registry — including third party programs. But two ways that you can use without getting anything new are these:

1) Open a Run box again and type “regedit” (no quotes) and hit Enter. This opens your registry. Click Registry and select Export Registry file. Make sure the Export range is set at “All”. Export the file to a new folder called “Backup” (or something easy to identify). Title the file with today’s date (013103.reg or 31Jan2003.reg) ) and hit save. Now you have a complete backup as of today.

2) While you are at it, open a Find box and find user.dat and system.dat. Copy both of these into the same “Registry Backup” folder. Once they are there, rename them “user.31Jan2003.dat” and “system.31Jan2003.dat” — or something equally useful.

You now have compulsively backed up your registry with several levels of redundancy.

____________________

Restoring a Backed-up Registry

A. Using ScanReg to Restore your Registry

The simplest method to restore is to use the scanreg.exe /restore function. This must be run from true DOS — not from a DOS window inside of Windows. Since the registry controls essentially everything Windows does, you cannot restore the registry with Windows running. You must reboot your computer into DOS to restore the registry.

At the “C:/ Prompt”, type “scanreg /restore” (no quotes) and hit Enter. I am sure there are multiple references out there. The first one I came to was this one:

Using ScanReg

…which is about Scanreg in general, but it touches on the “/restore function”. The process is fairly intuitive, so it does not need a ton of explanation.

B. Restoring your Registry from the User.dat and System.dat files

This is a little more complicated, but it used to be the only reliable to way to do it in Win95. As above, this must be done in true DOS, so it helps to have a basic knowledge of DOS commands. After rebooting into DOS you need to change to the Windows directory, modify the attributes for the two .dat files, change back to the root directory, copy the desired backed-up .dat files to the Windows directory, then reboot. In “DOS” that is:

cd
cd windows
attrib -h -s -r system.dat
attrib -h -s -r user.dat
cd
copy c:Backupsystem.dat c:windows
copy c:Backupuser.dat c:windows

Then hit CTRL+ALT+DELETE to reboot.

Please note: The names of the files that you wish to restore should be renamed back to their originals — that is, “user.31Jan2003.dat” should be renamed “user.dat” — prior to restoring. Keep them in the “Backup” folder, but for the exact files that you wish restore, remove the date in the center. That will make it easier for you to find and copy them in DOS.

For more information or restoring your registry from the user.dat and system.dat files, please see:

Restoring the Registry
BACKING UP / RESTORING THE REGISTRY

C. Restoring specific sections of your Registy

Regedit is generally a Windows application. Therefore, for the same reasons as above, you cannot “restore” (read: Import) your entire registry using regedit — however, you CAN restore entire sections.

One more thing worth mentioning — It is also nice to have a “picture” of your registry before you do any major installing/uninstalling. Then you can get another “picture” afterwards and compare the two. If you wish to ‘fix’ a certain section of your registry after some event, you can find out what has changed by “comparing” the two pictures.

You can do this by simply comparing the entire registry files (.reg) using something like WinDiff — but the process and the analysis is, well, challenging. A better method is to use “regshot” — which is a very cool program for several reasons. Combining the use of RegShot with your backed up .reg file, you can go in and surgically return specific sections of you registry back to exactly the way they were before the ‘event’ that you were monitoring.

PCWorld’s description of RegShot

Reply | Quote

Hi R2:
Thank you, R2. Good explanation!! I thought I recall you saying somewhere that although you can have more than 5 back ups, you can only restore from the last 5 using Scanreg. I take it that you would use the other method (e.g. the files named with the dates) for restoring anything other than the last 5 backups?

P.S. I’m wondering why the view of your message is “wide”. It probably has something to do with the attachment, but I don’t know what you could do so it you could read it without scrolling back & forth.
Cheers,

Reply | Quote

Doesn’t appear too wide on my system.

Reply | Quote

I’ve found that sometimes individual posts appear wider, or at a different vertical resolution, than others on the same page.
If I leave that page, then come back to it, it is usually back to normal.
Don’t know why, and it doesn’t bother me, so I’ve never questioned it……..but now I’m curious???

Have a Great day!!!
Ken

Reply | Quote

Sorry, the only thing that I can see that might be controlling the width is the line up top — which I shortened.

I am not sure it is worth adding the ‘more than five’ backup stuff into this post — I think it is already long enough. In all honesty, it is pretty rare that one needs more than five backups. In most cases, people are just happy to have one!

FYI: The Microsoft pages with information on this stuff are here:
Description of the Windows Registry Checker Tool (Scanreg.exe)
How to Customize Registry Checker Tool Settings
Command-Line Switches for the Registry Checker Tool

Reply | Quote

I agree. If your last 5 backups don’t work, then you’ve got problems. (And the post now appears correctly on my machine, although I notice Al didn’t have a problem with it. I’m at a different machine now anyhow. Maybe it was just an oddity.)

Reply | Quote

It’s me again-
I backed up the registry and followed instructions from McAfee (I was trying to get rid of the remnants of their Virus program)
Nothing they told me works, and now, going directly into DOS gets me nothing but
“bad command or something”
Here’s what they told me to enter:
Go to Dos
type cd
CD C:WINDOWSSYSTEM
MsiExec.exe/X{E4DC62CE-5F95-11D6-B254-00C04FF4B435}
exit
If the operation is successful, you will have to restart your computer……………….
I have never made it that far in about 7 or 8 tries so far.
Any ideas (other than write to McAfee again? – I’ve already done that, and am waiting……..)

Reply | Quote

I’m not sure what you’re trying to do. Your first question was how to back up the registry & R2 has now posted complete instructions on backup & restore. This is the first you’ve mentioned McAfee. If your trying to uninstall it, what happens if you use Add/Remove Software from the Control Panel?

Reply | Quote

It looks like they are telling him to uninstall using the MS Installer — and via the Class ID number — which is a little strange. The /x switch is for uninstall. and the parameters are Package|ProductCode. I guess the ProductCode could be the CLSID, but is the line missing the “Package”???

Info on msiexec.exe:
http://www.swynk.com/trent/Articles/msiexeccom.asp%5B/url%5D

Reply | Quote

Can you tell us some more about this McAfee story, please? McAfee has always been “fussy” about un-installation, but one should always first do the “normal” uninstall via Windows. Usually after that, one needs to erase the McAfee (NAI) folder or folders from the hard drive and then use REGEDIT to delete the McAfee/NAI keys in the registry. I’m hesitant to suggest you do that, unless you’re “comfortable” with modifying the registry, even IF you’ve made a backup! We need more info…..

Reply | Quote

How much of this superb! explanation is applicable to W2K?

Thanks,

Reply | Quote

Unfortunately, very little is applicable to Win2K or WinXP. I highly recommend the freeware program ERUNT

It is the only free program I have found that allows you to backup a Win2K / WinXP registry.

Reply | Quote

This was never meant to be for Win2K-XP — that is why it is under the Windows98 forum.

However, I did post some information on backing up the Win2K Registry in this thread.

Reply | Quote

OK, the McAfee story:
It came with the Dell computer in 2000, along with Win98SE. The problem started when I could never get a connection
to update McAfee…..tried many times – it just never would connect. So, I THOUGHT I had uninstalled it, and got a new and
different AntiVirus program.
Things were “normal” for the next year or so, then out of the blue, McAfee screens started popping up when I downloaded
something (pictures, small programs, etc.). It was at this point I wrote to McAfee to find out why I couldn’t get rid of the
remnants of McAfee. They sent me the instructions, and when they wouldn’t do what they said………….several tries………
I wrote to you guys.
In the meantime, I have used FIND, then deleted whatever McAfee stuff showed up, including a vshwin.exe file.
What bothers me is, I think I did all this same stuff (except for the DOS attempt- with the registry) before……then, it came back
like a ghost. It’s gone for a year, then, out of nowhere, it’s back. That’s where we are now.
One other note: I do a lot of graphics, and when the computer get “loaded” with bmps, it starts acting up. Could this
cause some of the other stuff? I usually unload the BMPs onto a CD – that seems to help matters. Just a clue.

Reply | Quote

(Edited by DaveA on 07-Feb-03 19:20. )

Rabee: I had a similar experience with McAfee. Then my organization asked me to shift to Norton. I uninstalled McAfee via WIN 98 – and discovered later there were approx 600+ McAfee entries still in Register because I was still having problems even after running SystemWorks. I ended up buying RegCleaner at http://www.vtoy.fi/jv16/shtml/software.shtml%5B/url%5D. This site had people praising RegCleaner. It found them and deleted them and I still have McAfee showing up during start up, but I did get rid of all the problems, folders, etc. Like you, I was nervous about those deletes/changing registry, but it cured a bunch of problems and didn’t seem to cause new ones. Only problem with RegCleaner web site is that it seems non-www-compliant and I had to fire up IE instead of Opera to browse it just now. leif, Erickson?

Reply | Quote

FYI and FWIW: RegCleaner is no longer supported — and if you ‘bought it’, ask for your money back. As long as I can remember it was always freeware.

The newest JV16 product is called jv16 PowerTools and it includes the Registry Tool — which is the decendant of RegCleaner.

Reply | Quote

Another question – re:registry – dos – McAfee remnants……
Since I was having so much trouble getting anything done in DOS,
I decided to try “regedit” in the Run box, and sure enough, there was the registry.
I didn’t do anything but look around, but, I found a McAfee folder listed there.
Would I be able to delete the folder safely in Windows rather than having to go to DOS?????
If so, exactly what do I have to do (obviously I’m too chicken to experiment)
Hope this isn’t getting too long-drawn out, and thanks for the help.

Reply | Quote

What looks like a “folder” in the registy is really a “key”. No, you cannot delete a “key” in Windows or DOS, per se — you do it in regedit.

But you don’t have to delete anything — simply rename it. The standard way of temporarily “removing” a registry key is to simply put a minus sign (-) in front of the name. That way, Windows will not find the key since it is not looking for keys with minus signs.

You can do the same thing with your Folders or Files. A renamed folder or file cannot be found by Windows.

Reply | Quote

And may I add to what R2 said by a reminder that while in Regedit, you need to look in TWO places: HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. For both of those trees, open Software and look for keys with EITHER McAfee or NAI. They have not always been consistent in the past and I’ve sometimes found both references. I usually delete ’em when I find ’em but I think you’d be well served to take R2’s suggestion about disabling.

Reply | Quote