• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Identifying registry files

F

FLARE

n00b
Joined
Dec 18, 2009
Messages
13
Is there a way to know every single registry file that is associated with a program?
 
registry file?

Do you mean the registry entries? These are stored in a file, but they're all in the same few files in your windows folder. However, if you're looking to see what a program uses, you can use something like procmon to view everything in realtime.

I would recommend starting procmon, then filtering your search based on the the exe for the program. Then, up on the top right, use the icons to disable everything but the registry. You'll then see every read, write, and change to the registry that your program is making.

It's very intimidating because it's going to touch sooooo much.
 
Building on Demon's explanation, it gets more complex if we're talking about a large application: different EXE's being spun up, different instances of the EXEs (in some cases), Windows services, etc. And keep in mind that the registry could have zero-to-many details or settings about the running application (besides the Windows Installer keys).

Many of the Systernals tools can help with your digging.
 
Yes, I mean the registry entries. I have a program that installs a bunch of registry entries into hkey local machine classes clsid, interface, and typelib, but I think some of the registry entries (not associated with the program I want) have been infected by a virus, so I would like to just export, and isolate the registry entries associated with 1 specific program only, after reinstalling my operating system. This software is not a big program, it is used for industry export accounting. The program is about 10 years old, so it's difficult to reinstall it. Tech support for the program has ended. The accountant also does not know anything about computers and therefore doesn't know what the registration codes are. That's one of the reasons why the person can't reinstall the program. It's also in another language, and I can't read it. So you have one person who can read the foreign language, but knows nothing about computers. Then on the other hand, you have someone who knows something about computers, but can't read the language.
 
You must log in or register to reply here.
Back
Top