ZSoft Software Support Forum

General => General Support => Topic started by: Brown Sugar on August 28, 2007, 06:48:27 pm

Title: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Brown Sugar on August 28, 2007, 06:48:27 pm
It's my understanding that the "Reg Deleted!" will be added back to the registry upon uninstalling a program.  I usually edit the zulog files and delete these as they consist of MRU's, counts, Zone Alarm information, or strings that are copies of Reg Added! ones.

Is there any reason these should be kept in the zulog file?
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Admin on August 28, 2007, 07:40:04 pm
If you doesn't want them readded you can remove them. This will upon uninstallation delete the values.

But if you're just removing it anyway, why not just just use the ignore filter?
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: soyabeaner on August 29, 2007, 12:26:17 am
But if you're just removing it anyway, why not just just use the ignore filter?

Forgive my ignorance, but I've not used such feature before.  Please explain where this is located and how this is done.  Thanks.  (Help file is outdated as it refers to v2.2.5)
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Admin on August 29, 2007, 03:47:06 pm
Yeah, the help-file is very outdated... I kind of hope that someone will offer to write a new one so I don't have to ;D

Well, anyway, the ignore-filter:
Press the analyze-button on the toolbar. In the window that pops up there is a button called 'Edit Ignore List'. Click it. Another window pops up. If you want to add something, press the 'Add' button (the window changes), select whether you want to add a file or a registry-entry and click browse. When your done browsing simply click 'Add It' and your done.

Hope this is clear enough, if it isn't, please ask again.
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: soyabeaner on August 30, 2007, 02:18:23 am
Thanks.  So this feature is not universal - only applies to when one is about to analyze or pre-snapshot an uninstallation.
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Admin on August 30, 2007, 03:41:33 pm
It is only in the analyze-feature, yes, but that should also be sufficient for your needs from above :)
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Brown Sugar on August 30, 2007, 04:12:08 pm
From your first reply, I was under the assumption that you just could add  "Reg Deleted!" to the Ignore List and it would ignore any  strings with the "Reg Deleted!" tag in the zulog file upon uninstalling.   However, from your last reply, it sounds as if you can only use the Ignore List for before and after analysis.

If that's the case, how does one know what to add to the Ignore List for purposes of avoiding a future addition of the Reg Deleted strings  to the registry upon uninstalling a program, since they're always going to be different (and haven't been created until the compare is finished and the zulog file is created)?
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Admin on August 30, 2007, 07:09:23 pm
The ignore-list is only in effect in the before and after scan.

You can't avoid future additions of 'Reg Deleted' in a whole (and you don't want that either, at least not 'system-wide'...), but you can just add the MRU path (etc.) to the ignore-list, and it won't be recorded at all. Granted, it doesn't remove them either, but MRU changes all the time anyway...
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: soyabeaner on September 07, 2007, 02:44:29 am
It took me a long time before I've noticed that entries marked as deleted files don't get restored, whereas deleted registry keys do get restored upon uninstallation by ZU.

I have the same train of thought as Brown Sugar: I've yet to see any use for having deleted registry keys (or files), so would it be possible to have an option to not restore them upon uninstallation or not trace them altogether?  This would speed up the uninstallation and the task for users like us who have to manually delete them from the logs or figure out what to add to the filter list, which would be tedious anyway because lots software contain tons of files & registries. (If I post this in the wrong thread please inform).
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Admin on September 07, 2007, 03:13:16 pm
It would be extremely dangerous, because if something has changed, it will (if not recreated) just be deleted, and the registry won't be rolled back, but be destroyed one bit at a time...
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: soyabeaner on September 07, 2007, 06:49:54 pm
I didn't realize that.  Too late for me because I edited all my log files :'(
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Admin on September 07, 2007, 10:13:19 pm
Well, if you just removed the 'reg deleted' lines for some of the stuff (like MRU's etc. (the stuff you don't want recreated)) it ok, but else it will be potentially devastating...
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: soyabeaner on September 07, 2007, 11:54:46 pm
This is my confusion:
After installing a program, ZU detects registry keys that have been deleted in the process (by that program).  Hence, the REG DELETED! entries.  But what you imply/mean is that when uninstalling that program, the natural occurrence for stability is the program's own uninstaller (or Windows) is supposed to re-create those exact same registry keys that it deleted ???  That doesn't make sense to me.

Perhaps an example my shed light to this slow mind O0
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Admin on September 08, 2007, 10:37:33 am
I don't know how common it is, but as I see it, it could easily happen that a program changed something in the registry that didn't belong to itself (e.g. tweak windows or whatever). ZU doesn't have a 'reg changed', but registers it as 'reg deleted' and 'reg created'. Upon uninstallation it will then removed the 'reg created' and insert the 'reg deleted' value. If you have removed the 'reg deleted' value it will only be deleted, and if it was something important that isn't very good... Hope you understand.
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: soyabeaner on September 08, 2007, 01:50:22 pm
ZU doesn't have a 'reg changed', but registers it as 'reg deleted' and 'reg created'.

The changed part being classified as either of those 2 was something I didn't know about.  Thanks.

There is one remaining workaround for me:  I'll keep the logs as references for files & registry keys that I know are safe to manually remove if any are left around after running the programs' own uninstallers.  By safe I mean those that contain the program names.  So to be safe I won't run ZU on my edited logs; it'll just be potentially time-consuming ;)
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Brown Sugar on December 29, 2007, 04:28:37 am
Even though I started this thread, I didn't look at the last few replies until today so I wanted to add a comment or two.

Using Notepad, I've edited every zulog file for every program I've uninstalled, and deleted all the "reg deleted" keys.  So far I haven't experienced any problems.   Much of the time they relate to MRU streams, but there are some huge "reg deleted" keys with very long strings that start with "REG DELETED!   HKLM   SYSTEM\ControlSet001\Services\Eventlog\System".    This "Reg Deleted" key was about 40 lines long:

REG DELETED!   HKU   Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs

That one probably relates to the change in the start menu when the new program was added.  A great number of "Reg Deleted" keys refer to: Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints on various drive partitions.   

As I've stated, to date I haven't had a problem editing the zulog files and removed all references to "reg deleted" keys.   However, I would be interested to hear from others who may know of reg deleted keys which should not be removed when editing the zulog file.
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: soyabeaner on December 30, 2007, 03:03:51 am
I've done the same with Notepad before, but after Admin advised against it, I wouldn't take the risk.  I've dont a bit of registry cleaning this year and it just created unforeseeable problems (not necessarily serious, but annoying enough to not be fixable) later down the road.  Due to a recent incident of registry-cleaning, I'm now on the path of reformatting (which I haven't done in years). 

If it's just MRU (Most Recently Used) entries, they can be easily and safely removed by something like CCleaner afterwards.
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: Brown Sugar on January 02, 2008, 08:14:17 am
You have to be very careful when using registry cleaners from any vendor as they can delete important keys relating to MS Office and other much needed programs.  However, the "reg deleted" keys are usually deleted because another one has taken their place,
and to add back hundreds of lines of registry strings needlessly will just slow the boot process, and result in having to use one of those registry cleaners! 
Title: Re: Is is safe to edit zulog file and delete the "Reg Deleted!" registry items?
Post by: soyabeaner on January 02, 2008, 07:51:16 pm
Or just backup the entire registry before installing a software using ERUNT.  Sorry for the off-topic O0