What is Regfix?
1.What is Regfix?

RegFix is an utility designed to analyse changes made to Windows Registry.

When installing software, it is possible to make a copy of the Registry before the installation and another one after the installation, to compare the copies and to see what changes the software has made. RegFix also allows to check what changes to the Registry installing new hardware (extension cards, periphery devices, etc) has caused. Moreover, RegFix can be used to compare configuration of different computers.

Unlike Registry monitoring software (e.g. such as RegMon and Win-Expose Registry), and most uninstallers (CleenSweep, Uninstall, etc.), RegFix compares full copies of the Registry made in different moments of time, whereas the above software products monitor all accesses to the Registry within the certain time interval and then filter them, which sometimes result in errors since other applications and the system could also modify the Registry during the same time.

RegFix searches for differences on all levels: in Keys, in Values Names, and in Values Data. Results of the comparison are displayed as three trees (see below).

Important: RegFix doesn’t do any changes to the Registry – don’t worry about it! RegFix deals only with root keys HKEY_LOCAL_MACHINE and HKEY_USERS, since the key HKEY_CURRENT_CONFIG is a copy of HKEY_LOCAL_MACHINE\Config\000õ; HKEY_CLASSES_ROOT is a copy of HKEY_LOCAL_MACHINE\Software\Classes; HKEY_CURRENT_USER is a part of HKEY_USERS; and HKEY_DYN_DATA is (normally) used by the system only and is of no interest to a user.


Registry Scan
2. Registry Scan

First you have to create initial copy of the Registry. To do this, you can either choose Registry/Scan Registry in the menu, or click the Scan Registry button on the toolbar. Depending on the Registry size and on your computer resources, this procedure can take from a few seconds to about a minute (on 486). The procedure duration (in seconds) is displayed on the status bar. Name of the root directory of this Registry copy is the scan date. Scanning can be also done when the file with saved Registry copies is open.


Saving to File. Deleting Copies
3. Saving to File. Deleting Copies

To save the Registry copy, choose File\Save As in the menu or click the Save button. Saving time is also displayed on the status bar. This RegFix version allows saving up to three Registry copies in the same file. It is possible to delete any copy, for example, to save a new one to a file that already contains three copies. To do this, make one of the root nodes active, choose Delete in the context menu and confirm deleting.


Comparing Registry Copies
4. Comparing Registry Copies

When you click the Compare button, the window for choosing 2 Registry copies appears. Choose copies you want to compare. The order of choosing doesn’t affect the result since one copy is always newer than the other – it will be marked as New, and the older one will be marked as Old. When comparing is finished, a window with three (or less) trees appears:

1) "Deleted - xx" – this is a tree showing deleted Keys and Value Names, i.e. those ones that used to be the old copy of the Registry, but were not found in the newer one.

2) "Added - xx" – this is a tree showing added Keys and Value Names;

3) "Distinct in data - xx" – this is a tree showing changed Value Data.

In the first tree - "Deleted - xx", (xx = number of keys and value names missing in the new copy as compared to the old one) deleted Keys are marked by a yellow bulb, all their Subkeys are marked by a grey bulb. The Keys with deleted Value Names are marked by a green bulb, only Value Names not found in the new copy are shown there. Subkeys that remained the same are not shown.

A similar notation system is used in the second tree ("Added - xx"), the only difference is that Keys and Value Names present in the new copy and not found in the old one are shown here. Analysing this tree after installing new software is helpful to understand whether it is a Trojan, or whether the software makes illegal changes in critical registry areas.

In the third tree ("Distinct in data - xx"), only differences in Value Data are shown. Here, xx is a total number of pairs where differences in Value Data were found. The Keys where such differences were found are marked with a green bulb. The data with the same Value Names are shown in columns and marked with the digits 1 and 2 for the old copy and for the new one respectively. Icons showing the data type are alike icons in the Registry Editor, but the digital type us divided into the three subtypes: 1 - Double word; 2 - Binary; 3 - Multi size.

By choosing Locate in Old or Locate in New in the context menu (depending on the active tree) of the selected Key, you can go to the respective source Key in the main window.

Upon double-clicking on a data string the Copy String window appears, where you can copy Value Name and the Value Data from.


Search
5. Search

Compared to Search in Registry Editor, RegFix features additional option of Case-Sensitive Search, backward / forward navigation through found items. Search time is reduced by several times. You can also search over all copies shown in the main window.


Afterword
6. Afterword

RegFix development has been just started, so we will highly appreciate any constructive comments and suggestions.

The software was not adapted for work with NT, therefore some errors can occur when running it under this OS – your comments welcomed, again.

If you have ever come across any utilities of the kind, let us know the address (URL), please.

We hope RegFix, if it still doesn’t help you to avoid all the problems with the Registry, will at least allow you to solve some of them.