Author Topic: Safe to edit zulog and delete Reg deleteds?  (Read 4983 times)

Offline Brown Sugar

  • Jr. Member
  • **
  • Posts: 28
    • View Profile
Safe to edit zulog and delete Reg deleteds?
« on: April 30, 2007, 08:21:47 pm »
When I check the zulog file, I usually see MRU streams in the reg deleted area which match similar strings in the reg added area.
Doesn't this mean that those strings will be added back when uninstalling?  Aren't those strings unnecessary?  I've edited the zulog file before and deleted all references to reg deleted MRU streams, then uninstalled with no problem

In addition, I sometimes find a load of keys similar to this in the reg deleted area.  I think this string is from a Zone Alarm system check and probably should remain deleted. 

REG DELETED!   HKU   S-1-5-21-329068152-1060284298-842925xxx-xxxx\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints\Q\_DriveFlags
This is from a Spyware Terminator zulog file and for that program the system has to be rebooted.  (I replaced actual numbers with x's).

I also see items called "Perflib data counts" which are probably related to Zone Alarm.

There are also such items as:

REG DELETED!   HKLM   SOFTWARE\Zone Labs\ZoneAlarm   ProgramSecuredCount   int:
REG DELETED!   HKLM   SOFTWARE\Microsoft\Cryptography\RNG   Seed   

along with references to updated programs.

Won't they be added back to the registry when uninstalling and is it really necessary that they should be added back? 

Most of the time, when I analyze the "reg deleted" area, it appears that most of the strings should remain deleted.
« Last Edit: April 30, 2007, 08:26:09 pm by Brown Sugar »

Offline Admin

  • Administrator
  • Hero Member
  • *****
  • Posts: 522
    • View Profile
    • ZSoft Software
Re: Safe to edit zulog and delete Reg deleteds?
« Reply #1 on: May 01, 2007, 08:36:31 am »
If something gets edited it will appear as both created and deleted in the zulog file.
Upon uninstallation the new value will be deleted and the old one put back in place (e.g. edited back).

And sometimes, yes, there really is no reason for these values to be re-added. The MRU thing is one of these values. But this can be 'fixed' with the ignore list :).

There really isn't another way around it though - the computer changes stuff all the time, and all those changes are being logged when running an installation analysis...

Offline Brown Sugar

  • Jr. Member
  • **
  • Posts: 28
    • View Profile
Re: Safe to edit zulog and delete Reg deleteds?
« Reply #2 on: May 01, 2007, 08:43:42 am »
I guess even if the streams are added back, a good Registry Cleaner will delete them when the registry is scanned.
I've used Regseeker but I think it's too agressive.  I had to reinstall Lotus 123 because it deleted an important string that must have had something to do with running a dll or exe file.

Do you have any recommendations regarding registry cleaners?

If I use the ignore list function, won't I have to answer yes or no to every string?

Offline Admin

  • Administrator
  • Hero Member
  • *****
  • Posts: 522
    • View Profile
    • ZSoft Software
Re: Safe to edit zulog and delete Reg deleteds?
« Reply #3 on: May 01, 2007, 01:07:49 pm »
If I use the ignore list function, won't I have to answer yes or no to every string?

?

Offline Brown Sugar

  • Jr. Member
  • **
  • Posts: 28
    • View Profile
Re: Safe to edit zulog and delete Reg deleteds?
« Reply #4 on: May 02, 2007, 09:06:30 pm »
If I use the ignore list function, won't I have to answer yes or no to every string?

?


In your first reply, you stated:
Quote
and sometimes, yes, there really is no reason for these values to be re-added. The MRU thing is one of these values. But this can be 'fixed' with the ignore list

What exactly is the ignore list?



Offline Admin

  • Administrator
  • Hero Member
  • *****
  • Posts: 522
    • View Profile
    • ZSoft Software
Re: Safe to edit zulog and delete Reg deleteds?
« Reply #5 on: May 02, 2007, 10:01:37 pm »
If you open the main analyze window (by clicking the "Analyze" button on the toolbar) you can find the ignore list by clicking on the "Edit Ignore List" button at the bottom. You can then add folders and/or registry locations.

When something is added to the ignore list the content of the specified folders / registry locations will not be 'indexed', i.e. it will not be in the 'image' created when doing an analysis.

You can then, for instance, add "HKU\{whetever the key is on your computer}\Software\Microsoft\Windows\ShellNoRoam" and the content of that key will not get into the image and therefor, even though something might change inside, not end up in the zulog file either.

Offline Brown Sugar

  • Jr. Member
  • **
  • Posts: 28
    • View Profile
Re: Safe to edit zulog and delete Reg deleteds?
« Reply #6 on: May 03, 2007, 05:52:08 am »
Thanks for explaining that.  I didn't even notice the button, or if I did, it was when I first installed the program.

I really wouldn't take a chance on adding anything, as it might be something that needs to be deleted upon uninstalling.