TimTreeby
asked on
Bloated Registry Startup
I have a customers machine where everything works fine apart from extremely slow on startup. On investigation have found that
HKLM\Software\Microsoft\Cu rrent Version\Run
seems to have over 30 thousand entries. Most of this sem to relate to a file which has been deleted.either a virus or spyware.
My question is is there an easy way to delete the unwanted registry settings.
Bear in mind the following poins.
1) Have tried a System restore. That does not work.
2) If i click on the key Regedit process ends up as not responding.
3) Not sure when error actually occured so even if use Recovery Console and replace Registry files from backup not sure how far back i have to go or even how i would tell which might be a clean version.
Any ideas as to a quick and easy way to delete just the registry settings that i don't want.
Have tried an Export of HKLM\Software\Microsoft\Cu rrent Version but obviously this will take ages when gets to Run key on the basis that if i the delete the HKLM\Software\Microsoft\Cu rrent Version key and then merge back in after deleteing entries don't want using something like worpad etc. then this should work.
2 questions
1) If i do this will windows complain about anything on the basis that the merge will take place immediately after doing the delete of the key.
2) CAn any one think of a better way of doing it.
HKLM\Software\Microsoft\Cu
seems to have over 30 thousand entries. Most of this sem to relate to a file which has been deleted.either a virus or spyware.
My question is is there an easy way to delete the unwanted registry settings.
Bear in mind the following poins.
1) Have tried a System restore. That does not work.
2) If i click on the key Regedit process ends up as not responding.
3) Not sure when error actually occured so even if use Recovery Console and replace Registry files from backup not sure how far back i have to go or even how i would tell which might be a clean version.
Any ideas as to a quick and easy way to delete just the registry settings that i don't want.
Have tried an Export of HKLM\Software\Microsoft\Cu
2 questions
1) If i do this will windows complain about anything on the basis that the merge will take place immediately after doing the delete of the key.
2) CAn any one think of a better way of doing it.
if he has 30thousand entries, he probably doesnt want to uncheck the entries manually.
it would be easier to remove those entries through the registry, where you can highlight and delete them all.
i've seen this before, and i dont believe hijackthis will work because it too will list out all the gazillions of entries and you dont want to check them one by one.
to access them in regedit : HKEY_CURRENT_USER\SOFTWARE \Microsoft \Windows\C urrentVers ion\Run (make a backup before editing the registry)
also here: HKEY_LOCAL_MACHINE\SOFTWAR E\Microsof t\Windows\ CurrentVer sion\Run
it would be easier to remove those entries through the registry, where you can highlight and delete them all.
i've seen this before, and i dont believe hijackthis will work because it too will list out all the gazillions of entries and you dont want to check them one by one.
to access them in regedit : HKEY_CURRENT_USER\SOFTWARE
also here: HKEY_LOCAL_MACHINE\SOFTWAR
ASKER
Will HKLM\Software\Microsoft\Cu rrent Version\Run eventually open or not. because when i click on it i have been sat there for at least 5 minutes wairting for it to open and when i look at Task MAnager says that Regedit is Not Responding but is running at about 100% of CPU time. And also any idea how ling i may have to wait.
open notepad and put this in it
Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTW ARE\Micros oft\Window s\CurrentV ersion\Run ]
[-HKEY_CURRENT_USER\SOFTWA RE\Microso ft\Windows \CurrentVe rsion\Run]
[HKEY_LOCAL_MACHINE\SOFTWA RE\Microso ft\Windows \CurrentVe rsion\Run]
[HKEY_CURRENT_USER\SOFTWAR E\Microsof t\Windows\ CurrentVer sion\Run]
save it as something.reg
run it, click yes and ok
This will delete the run keys and add them again. No need to open regedit.
But please still run spybot
Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTW
[-HKEY_CURRENT_USER\SOFTWA
[HKEY_LOCAL_MACHINE\SOFTWA
[HKEY_CURRENT_USER\SOFTWAR
save it as something.reg
run it, click yes and ok
This will delete the run keys and add them again. No need to open regedit.
But please still run spybot
http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en
run this for a cleanup
also run sfc /scannow to replace any corruptions
run this for a cleanup
also run sfc /scannow to replace any corruptions
Jay_Jay70 just a question, how will the hive cleanup hlep out?
hmm im hoping its the same util that i hope it is, cleans up a stack of unwanted crap out of your registry, differs from a registry cleanup tool though, was just an option
or run regestry mechanic as atrial, better still 20 dollars is not a lot to pay and then you have unlimited usgae updates, it will delete all these safely and compact the regestry as well
free scan first if you like
http://www.pctools.com/registry-mechanic/
Download free trial is below
free scan first if you like
http://www.pctools.com/registry-mechanic/
Download free trial is below
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
but but... my answer is dead on and would have worked perfectly and I worked so hard on it...and stuff. ;-)
Oh well, don't you love when people get the answer and tehn abandon the post. ;-)
Oh well, don't you love when people get the answer and tehn abandon the post. ;-)
TimTreeby come back please and let us know if we helped you. Then close this post.
ASKER
Customer has only just got back to me. Am picking up PC today to get problem solved. Will let you all know how i get on.
ASKER
Just to say that having done the registry export as suggested by EnigmaLS1 which only took about 5 seconds to complete had a .REG file that was 10MB in size. Ithink i have deleted all the crap correctly leaves a 3.3KB size file. Have reimported and am running spyware scan on registry items that are left. But as i don't recognise some of them might ask which i can safely remove which might be leftovers from viruses/spyware
Sure, just post what you have left and I guarentee I can tell you what all of them are and if they're safe or not. ;-)
http://www.safer-networking.org/en/mirrors/index.html
update definitions and run on workstation
http://www.spywareinfo.com/~merijn/downloads.html
after you do the above download hijackthis and run,
post the log here
also click start >> run >> type msconfig
click startup tab
u can uncheck entries there