# Registry recovery



## cwt1924 (Jun 15, 2004)

Last week, I bought and installed a new copy of Symantic Systemworks 2005. Right away some of the features did not work, so I went to Symantic's Automated support site. They told me my computer was running in the Audit Mode and I should go to Regedit and delete one of the items in the registry, which I did. They said I should backup the registry first and provided a button to do that. I did. Then I found that a number of other programs would not run or run properly. So I went back to Symantic Automated Support but could not find anything that fit my situation and can't locate the backup that Symantic supposedly made. That's my problem. Can you tell me how to recover lost registry items or how to find the backup (if it exists)? I will be eternally grateful.
cwt1924


----------



## JSntgRvr (Jul 1, 2003)

All will depend upon the number of days these changes were made.

Uninstall Symantic Systemworks 2005. Boot the computer to a command prompt. At the prompt type the following and press Enter:

Scanreg /Restore

Select a date prior to the installation and press Enter. That will restore your registry.


----------



## cwt1924 (Jun 15, 2004)

Thanks to JSntgRvr for the reply. Unfortunately, I need to go back to the 12th and Scanreg/Restore only goes to the 14th. Any other suggestions? Thanks in advance.
cwt1924


----------



## Kitch (Mar 27, 2005)

See if you can find the backup, run a find/files & folders, search for *.reg

Hopefully the backup will have a sensible name, if in doubt check it's properties
for the creation date.


----------



## cwt1924 (Jun 15, 2004)

Thanks to Kitch for the response. I followed you instructions but don't find any *.reg entries that seem likely. Here's a list of them:

Autolnch.reg
Zonedoff.reg
Zonedon.reg
JPE JPEG JPG l
adofre15.reg
adoapt15.reg
Handler.reg
Handsafe.reg
Handunsf.reg
newud.reg
nonewudl.reg
mtxoci7x winnt.reg
mtxoci80 win2k.reg
mtxoci80 winnt.reg
mtxoci81 win2k.reg
mtxoci81 winnt.reg
mtxoci7x win2k.reg
PhotoshopElement...
component.reg
cnfgMail.reg
einhelp.reg
Rexclude.reg
Sku.reg
Exclude.reg
Ap fast.reg
Ap norm.reg
Ap9xpoff.reg
Ap9xpon.reg
Apid run.reg
Apid vxd.reg
Apmsgoff.reg
Apmsgon.reg
Logo off.reg
Logo on.reg
core1.regwp9.reg
core2.reg
OnDemnd9.reg
wp9.reg
wp9ole.reg
wpq1.reg
alarm.reg
CC9Help.reg
CC9.reg
xml.reg
gfinder.reg
textart.reg
Dad9.reg
pr9.reg
prlayout.reg
qp9.reg
qp9web.reg
scrapbook.reg
ua.reg
DefaultLayout.reg
Rexclude.reg
3frame.reg
4frame.reg
5frame.reg
Allow16BitTwain.reg
Disallow16Bitwain.reg
FullCrop.reg
NormCrop.reg
Rexclude.reg
DefaultLayout.reg
core1.reg
core2.reg
OnDemnd9.reg
wp9.reg
wp9ole.reg
wpq1.reg
alarm.reg
CC9help.reg
CC9.reg
xml.reg
gfinder.reg
testart.reg
Dad9.reg
pr9.reg
prlayout.reg
gp9.reg
gp9web.reg
scrapbood.reg
ua.reg
Ap fast.reg
Ap norm.reg
Ap9xpoff.reg
Ap9xon.reg
Apid run.reg
Apid vxd.reg
Apmsgoff.reg
Apmsgon.reg
Logo off.reg
Logo on.reg
Sku.reg
Exclude.reg
cnfgMail.reg
elnhelp.reg
component.reg
PhotoshopElement...
newudl.reg
nonewudl.reg
mtxoci7x winnt.reg
mtxoci80 win2k.reg
mtxoci80 wint.reg
mtxoci81 win2k.reg
mtxoci81 winnt.reg
mtxoci7x win2k.reg
Handler.reg
Handsafe.reg
Handunsf.reg
adofre15.reg
adoapt15.reg
JPE JPEG JPG l...
Zonedoff.reg
Zonedon.reg
AutoInch.reg
3Frame.reg
4frame.reg
5frame.reg
Allow16BitTwain.reg
Disallow16BitTwain
FullCrop.reg
NormCrop.reg

Whew! I had to copy those by hand since c&p are not working for some reason. Any further help welcome!
cwt1924



elnhelp.reg


----------



## JSntgRvr (Jul 1, 2003)

cwt1924 said:


> Thanks to JSntgRvr for the reply. Unfortunately, I need to go back to the 12th and Scanreg/Restore only goes to the 14th. Any other suggestions? Thanks in advance.
> cwt1924


What you ran was Scanregw.exe and saved the registy. This backup is made part of the regular daily backups. It is done in case something goes wrong during installation, and it is expected to be used within days of the installation. The backup are saved as Rb000.cab to Rb004.cab. After four days there will be no backup available for that date.

I understand your intention is to recover the AuditInProgress and AuditMode values in the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

That will have no effect in the computer's performance as it is a key to allow PC manufacturers to verify the the hardware and software that comes with your PC is configured properly. So it should not have any effect in the performance of the computer whatsoever.


----------



## cwt1924 (Jun 15, 2004)

To JSbtgRvr:
Thanks for your reply. All I'm really interested in now is to get my computer running properly again and rid myself of Symantic programs forever. How do I go about restoring the *.cab files?. Thanks for your patience.
cwt1924


----------



## JSntgRvr (Jul 1, 2003)

There is no need to. The Registry Cabs are in the computer. Search for *rb*.cab* and you will be able to see them. These are daily registry backups created by Scanregw.exe at startup.

Scanregw.exe backs-up once a day, but only keeps the last four. That's the reason you wont be able to restore your registry to May 12th, as that backup was already overwritten by Scanregw.exe.

All you need to do is to remove Norton from the computer.

Now, I know you atempted to install System Works 2005. Was there a previous Antivirus Program installed in the coputer? If so, was it Norton? Which Version?

Run Hijackthis and let me see the running proccesses in the computer:

http://www.majorgeeks.com/download3155.html

Run HJT and Save the log. Copy and Paste a copy of it in a reply.


----------

