n2casey
13-12-2006, 06:36 PM
Friends, this is my first tutorial. I was not able to post it before coz I was using a dialup connection.
Tutorial is completely based on Tracing Registry Changes & Software Behaviour. Softwares needed r System Mechanic 3.7g (http://www.ntu.edu.sg/cits2/software/download/system_mechanic.exe) (v3.7h can also be used) & Regsnap v5.8 (build 1920) (www.lastbit.com). Both softwares r fully functional 30 Days use trial versions. If anythng in this tutorial is illegal, mods can delete that & PM me.
First take a look to registry legend to understand a brief about registry.
http://img185.imageshack.us/img185/9945/0reglegendqd5.th.jpg (http://img185.imageshack.us/my.php?image=0reglegendqd5.jpg)
Install both the softwares & for better results be careful for:
both softwares shud b installed on a drive where u will not install any other software for tracing.
both softwares shud not b installed on the drive where u have installed windows.
Now run System Mechanic, & click on SYSTEM tab. Here we will use two tools:
One for cleaning registry (Clean system Registry) - Using it clean all the obsolete registry.
& other for managing startup items (Windows Startup manager) - Using it disable all the startup items.
http://img185.imageshack.us/img185/1560/1initialzp7.th.jpg (http://img185.imageshack.us/my.php?image=1initialzp7.jpg)
Now restart ur system.
We r going to trace software and here I m taking CDEject 1.6 as example so that we can know how Vishal Gupta added a right click context menu for ejecting CD-ROM. (Sorry Vishal but don't take it otherwise.)
Again run System Mechanic & on SYSTEM tab click on fifth tool (Safe Installer) to start the tracing procedure.
http://img185.imageshack.us/img185/2056/2mainep2.th.jpg (http://img185.imageshack.us/my.php?image=2mainep2.jpg)
A child window will pop-up. Enter a report description (i.e. name of report e.g. cdeject) & path of Install program (simply browse the software to be installed). Click Next.
http://img185.imageshack.us/img185/7210/3reportdescti3.th.jpg (http://img185.imageshack.us/my.php?image=3reportdescti3.jpg)
Here select the drives to b traced. Obviously one will b Windows drive & other will b for installing CDEject. Click Next.
http://img185.imageshack.us/img185/9265/4seldrivegh6.th.jpg (http://img185.imageshack.us/my.php?image=4seldrivegh6.jpg)
Here u can add files to be traced for changes. By default SYSTEM.INI & WIN.INI are added. As I think no need to add more files so click Next.
http://img186.imageshack.us/img186/1863/5selfilege3.th.jpg (http://img186.imageshack.us/my.php?image=5selfilege3.jpg)
Here browse Report file location (i.e. path for saving report). By default the report will b saved in My Documents folder. Click Next.
http://img186.imageshack.us/img186/4599/6finalsetls3.th.jpg (http://img186.imageshack.us/my.php?image=6finalsetls3.jpg)
Click on Start button to take a snapshot. When snapshot will b taken, installation of CDEject will b started. Just install it.
http://img186.imageshack.us/img186/9674/7startsnapbn0.th.jpg (http://img186.imageshack.us/my.php?image=7startsnapbn0.jpg)
After finishing installation Done: Report button will appear.
http://img186.imageshack.us/img186/7159/8finalsnapkf1.th.jpg (http://img186.imageshack.us/my.php?image=8finalsnapkf1.jpg)
Click on it & a report will b generated (which has been already saved in My Documents folder).
http://img186.imageshack.us/img186/8761/9finalreportdg1.th.jpg (http://img186.imageshack.us/my.php?image=9finalreportdg1.jpg)
Exit System Mechanic & open the report. Report will be some what like
System Changes Report: cdeject
==========================================
generated by System Mechanic SafeInstaller
Wednesday, November 29, 2006 09:44 PM
System modifcations tracked via: Disk contents comparison
Drives Tracked:
D:\
E:\
FILES AND DIRECTORIES ADDED: (15)
D:\Documents and Settings\N2CASEY\Local Settings\Temp\Perflib_Perfdata_c44.dat
D:\Documents and Settings\N2CASEY\Start Menu\Programs\CDEject
D:\Documents and Settings\N2CASEY\Start Menu\Programs\CDEject\CDeject.lnk
D:\Documents and Settings\N2CASEY\Start Menu\Programs\CDEject\Help.lnk
D:\Documents and Settings\N2CASEY\Start Menu\Programs\CDEject\Uninstall CDEject 1.6 Demo.lnk
D:\Documents and Settings\N2CASEY\Start Menu\Programs\Startup\CDEject.lnk
E:\Projector\CD Eject
E:\Projector\CD Eject\cdeject.cnt
E:\Projector\CD Eject\cdeject.dll
E:\Projector\CD Eject\cdeject.exe
E:\Projector\CD Eject\cdeject.hlp
E:\Projector\CD Eject\file_id.diz
E:\Projector\CD Eject\INSTALL.LOG
E:\Projector\CD Eject\README.TXT
E:\Projector\CD Eject\UnGins.exe
FILES CHANGED: (2)
D:\Documents and Settings\N2CASEY\ntuser.dat.LOG
D:\WINDOWS\system32\config\software.LOG
NO CHANGES MADE TO D:\WINDOWS\SYSTEM.INI...
NO CHANGES MADE TO D:\WINDOWS\WIN.INI...
REGISTRY KEYS ADDED: (8)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\CDEject 1.6 Demo
HKEY_LOCAL_MACHINE\SYSTEM\.............
REGISTRY KEYS DELETED: (4)
HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Discardable\PostSetup\ShellNew
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\PCI\V EN_8086&DEV_24C2&SUBSYS_24C08086&REV_01\3&13c0b0c5&0&E8\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\PCI\V EN_8086&DEV_24C4&SUBSYS_24C08086&REV_01\3&13c0b0c5&0&E9\DeviceDe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\A CPI\51Typ
REGISTRY KEY VALUES CHANGED: (1)
HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum
Value "Implementing": binary data changed
REGISTRY KEY VALUES ADDED: (7)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\@="CDEject Context Menu Shell Extension"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\@="E:\Projector\CD Eject\cdeject.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\ThreadingModel="Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}\@="E:\Projector\CD Eject\cdeject.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\PSCDEJECT="E:\Projector\CD Eject\cdeject.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\CDEject 1.6 Demo\DisplayName="CDEject 1.6 Demo"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\CDEject 1.6 Demo\UninstallString="E:\Projector\CD Eject\UnGins.exe "E:\Projector\CD Eject\install.log""
REGISTRY KEY VALUES DELETED: (2)
HKEY_USERS\S-1-5-21-329068152-13430.......
From this report we can find the changes made to the system but we have to look for the important/required changes. So from the report,
first we get the list of files and directories added. Leave the files added to Local Settings & Start Menu. Next there's list of files added to CD Eject directory. Since only cdeject.dll has a context menu handler registry entry (see the registry addition/changes in report) so the cdeject.dll is the only file of interest.
Next is the list of files changed, & it shows that no changes were made to the WIN.INI & SYSTEM.INI so leave that.
Next is list of REGISTRY KEYS ADDED.Only three keys seems to b of our interest.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}
Next is list of REGISTRY KEYS DELETED, which is of no use (in most cases).
Next is list of REGISTRY KEY VALUES CHANGED. In this any of keys isn't of our interest but many times they r important.
Again there is list of REGISTRY KEY VALUES ADDED & only four seems to b of our interest.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\@="CDEject Context Menu Shell Extension"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\@="E:\Projector\CD Eject\cdeject.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\ThreadingModel="Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}\@="E:\Projector\CD Eject\cdeject.dll"
& next is REGISTRY KEY VALUES DELETED, again they r of no use.
Now take a look at Registry Keys in section 3 & section 6 and observe the difference. In section 3, Keys r created & in section 6, values (e.g. String, DWORD etc.) r added to them. So we nedd only Registry Key Values fron section 6 only.
================================================== =======
OK. Now copy cdeject.dll to another directory (e.g. %Windows/System32/) & uninstall the CD Eject 1.6.
Now open Notepad, type Windows Registry Editor Version 5.00 & copy the Registry Values from section 6. It shud b like
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}]
@="CDEject Context Menu Shell Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\]
@="D:\\Windows\\System32\\cdeject.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\]ThreadingModel="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}]
@="D:\\Windows\\System32\\cdeject.dll"
Now save the file as xyz.reg.
Note that I have changed the path for cdeject.dll (which is shown in bold letters) since cdeject.dll is now in %Windows\System 32\
and note the [ & ] (every Key).
--------------------------------------------------------------------------------------------------------------
OK. Just click on xyz.reg & u will b asked to add the registry, select Yes so that registry values get added to Windows Registry. Check that do u get the option for Insert at the CD-ROM right click context menu or not. Boooooooooooommmmm..... We have got the Insert in right click context menu. So xyz.reg is the registry entry for such option & we don't need to install CDEject 1.6 any more...
=====================X========================X=== ========
Now, next I m going to find out the changes made to registery when a software is registered (for full version etc.). This is useful coz many times, I found it very irritating to register every software separately when a fresh installation of windows is done. So what I did is, I have traced all s/w during registering procedure & made a single registry file for all s/w & when I install a fresh copy of windows, just install all s/w & register all s/w using registry file & so no need to register a s/w individually.
Here I m using WinZip as an example. Install WinZIp. Now run System Mechanic & on SYSTEM tab click on fifth tool (Safe Installer) to start the tracing procedure.
Enter report description & in the path of Install program browse the WINZIP32.exe. Move furthur & just take a snapshot (no need of any other option).
Now WinZip will b executed & it will ask u for registration, just enter ur registration details & close WinZip.
Now click on Done & report will b generated. Only four Key Values r added for registration details:
[code]
HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Nico Mak Computing\WinZip\WinIni\Name1="Your Name"
HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Nico Mak Computing\WinZip\WinIni\SN1="xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
HKEY_LOCAL_MACHINE\SOFTWARE\Nico Mak Computing\WinZip\WinIni\Name1="Your Name"
HKEY_LOCAL_MACHINE\SOFTWARE\Nico Mak Computing\WinZip\WinIni\SN1="xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
[code]
Here Name1 is for ur name & SN1 is for ur serial number. So just made a registry file like:
[code]
Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Nico Mak Computing\WinZip\WinIni\]
"Name1"="Your Name"
[HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Nico Mak Computing\WinZip\WinIni\]
"SN1"="xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Nico Mak Computing\WinZip\WinIni\]
"Name1"="Your Name"
[HKEY_LOCAL_MACHINE\SOFTWARE\Nico Mak Computing\WinZip\WinIni\]
"SN1"="xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
[code]
Follow the same steps for other s/w & u can prepare a single registry file for all.
===================X=======================X====== =======
OK. Now based on above procedure, another tracing can b done for Windows Media Player. In a previous thread, someone has asked to change the crossfading time of WMP & so I writing this tute.
Just follow the same steps & in the installation path, browse wmplayer.exe. After taking snapshot when WMP will b launched, just make some changes like change crossfading time, volume etc. Now close WMP, generate a report & u will find that registry values r changed for such effects. Key Values r changed in hexadecimal. (Only bad thing is that, if u will increase crossfading time more than 10 sec it will cause no effect).
================X====================X============ =======
OK. Now we will trace System Mechanic itself for registry changes.
[list]
Run RegSnap, click File> Startup Wizard. Now click [color=red]New Snapshot[color].
http://img186.imageshack.us/img186/1417/10regsnapzc3.th.jpg (http://img186.imageshack.us/my.php?image=10regsnapzc3.jpg)
It will ask to enter a remark for ur snapshot (i.e. name of ur snapshot). Enter any remark, select Registry snapshot only & press OK. It will take a snapshot of ur system registry (trial version doesn't allow u to save snapshot).
http://img186.imageshack.us/img186/3640/11snapshotixz0.th.jpg (http://img186.imageshack.us/my.php?image=11snapshotixz0.jpg)
After finishing (don't close RegSnap), start System Mechanic, click on third tool Customize Windows settings. Now made some changes in settings (e.g. Start Menu reaction speed, Use Explorer when..... from Windows Explorer tab etc.) & close System Maechanic.
Now take another snapshot using RegSnap (remark shud b different from previous one).
After finishing, again click File> Startup Wizard. Now click compare button.
http://img186.imageshack.us/img186/6711/12rscomparelj3.th.jpg (http://img186.imageshack.us/my.php?image=12rscomparelj3.jpg)
It will show u both snapshots (current & previous one) for compariison. Choose the options as I have mentioned in following pic.
http://img80.imageshack.us/img80/8521/13rscomparisiondd3.th.jpg (http://img80.imageshack.us/my.php?image=13rscomparisiondd3.jpg)
After comparision, it will generate a report (u can save it :D).
Since I have changed only two options, Start Menu reaction speed & Use Explorer when opening "My Computer", so registry value change which I got were:
[code]
HKEY_CURRENT_USER\Control Panel\Desktop\MenuShowDelay
New: String: "282"
Old: String: "300"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\@
New: String: "explore"
Old: String: ""
[code]
So just made a registry file & customize ur system.
================================================== =======
Sorry for any mistake, since my english is not so good. I have tried to write this tute for beginners & so it becomes somewhat lengthy. I m sorry for that.
Tutorial is completely based on Tracing Registry Changes & Software Behaviour. Softwares needed r System Mechanic 3.7g (http://www.ntu.edu.sg/cits2/software/download/system_mechanic.exe) (v3.7h can also be used) & Regsnap v5.8 (build 1920) (www.lastbit.com). Both softwares r fully functional 30 Days use trial versions. If anythng in this tutorial is illegal, mods can delete that & PM me.
First take a look to registry legend to understand a brief about registry.
http://img185.imageshack.us/img185/9945/0reglegendqd5.th.jpg (http://img185.imageshack.us/my.php?image=0reglegendqd5.jpg)
Install both the softwares & for better results be careful for:
both softwares shud b installed on a drive where u will not install any other software for tracing.
both softwares shud not b installed on the drive where u have installed windows.
Now run System Mechanic, & click on SYSTEM tab. Here we will use two tools:
One for cleaning registry (Clean system Registry) - Using it clean all the obsolete registry.
& other for managing startup items (Windows Startup manager) - Using it disable all the startup items.
http://img185.imageshack.us/img185/1560/1initialzp7.th.jpg (http://img185.imageshack.us/my.php?image=1initialzp7.jpg)
Now restart ur system.
We r going to trace software and here I m taking CDEject 1.6 as example so that we can know how Vishal Gupta added a right click context menu for ejecting CD-ROM. (Sorry Vishal but don't take it otherwise.)
Again run System Mechanic & on SYSTEM tab click on fifth tool (Safe Installer) to start the tracing procedure.
http://img185.imageshack.us/img185/2056/2mainep2.th.jpg (http://img185.imageshack.us/my.php?image=2mainep2.jpg)
A child window will pop-up. Enter a report description (i.e. name of report e.g. cdeject) & path of Install program (simply browse the software to be installed). Click Next.
http://img185.imageshack.us/img185/7210/3reportdescti3.th.jpg (http://img185.imageshack.us/my.php?image=3reportdescti3.jpg)
Here select the drives to b traced. Obviously one will b Windows drive & other will b for installing CDEject. Click Next.
http://img185.imageshack.us/img185/9265/4seldrivegh6.th.jpg (http://img185.imageshack.us/my.php?image=4seldrivegh6.jpg)
Here u can add files to be traced for changes. By default SYSTEM.INI & WIN.INI are added. As I think no need to add more files so click Next.
http://img186.imageshack.us/img186/1863/5selfilege3.th.jpg (http://img186.imageshack.us/my.php?image=5selfilege3.jpg)
Here browse Report file location (i.e. path for saving report). By default the report will b saved in My Documents folder. Click Next.
http://img186.imageshack.us/img186/4599/6finalsetls3.th.jpg (http://img186.imageshack.us/my.php?image=6finalsetls3.jpg)
Click on Start button to take a snapshot. When snapshot will b taken, installation of CDEject will b started. Just install it.
http://img186.imageshack.us/img186/9674/7startsnapbn0.th.jpg (http://img186.imageshack.us/my.php?image=7startsnapbn0.jpg)
After finishing installation Done: Report button will appear.
http://img186.imageshack.us/img186/7159/8finalsnapkf1.th.jpg (http://img186.imageshack.us/my.php?image=8finalsnapkf1.jpg)
Click on it & a report will b generated (which has been already saved in My Documents folder).
http://img186.imageshack.us/img186/8761/9finalreportdg1.th.jpg (http://img186.imageshack.us/my.php?image=9finalreportdg1.jpg)
Exit System Mechanic & open the report. Report will be some what like
System Changes Report: cdeject
==========================================
generated by System Mechanic SafeInstaller
Wednesday, November 29, 2006 09:44 PM
System modifcations tracked via: Disk contents comparison
Drives Tracked:
D:\
E:\
FILES AND DIRECTORIES ADDED: (15)
D:\Documents and Settings\N2CASEY\Local Settings\Temp\Perflib_Perfdata_c44.dat
D:\Documents and Settings\N2CASEY\Start Menu\Programs\CDEject
D:\Documents and Settings\N2CASEY\Start Menu\Programs\CDEject\CDeject.lnk
D:\Documents and Settings\N2CASEY\Start Menu\Programs\CDEject\Help.lnk
D:\Documents and Settings\N2CASEY\Start Menu\Programs\CDEject\Uninstall CDEject 1.6 Demo.lnk
D:\Documents and Settings\N2CASEY\Start Menu\Programs\Startup\CDEject.lnk
E:\Projector\CD Eject
E:\Projector\CD Eject\cdeject.cnt
E:\Projector\CD Eject\cdeject.dll
E:\Projector\CD Eject\cdeject.exe
E:\Projector\CD Eject\cdeject.hlp
E:\Projector\CD Eject\file_id.diz
E:\Projector\CD Eject\INSTALL.LOG
E:\Projector\CD Eject\README.TXT
E:\Projector\CD Eject\UnGins.exe
FILES CHANGED: (2)
D:\Documents and Settings\N2CASEY\ntuser.dat.LOG
D:\WINDOWS\system32\config\software.LOG
NO CHANGES MADE TO D:\WINDOWS\SYSTEM.INI...
NO CHANGES MADE TO D:\WINDOWS\WIN.INI...
REGISTRY KEYS ADDED: (8)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\CDEject 1.6 Demo
HKEY_LOCAL_MACHINE\SYSTEM\.............
REGISTRY KEYS DELETED: (4)
HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Discardable\PostSetup\ShellNew
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\PCI\V EN_8086&DEV_24C2&SUBSYS_24C08086&REV_01\3&13c0b0c5&0&E8\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\PCI\V EN_8086&DEV_24C4&SUBSYS_24C08086&REV_01\3&13c0b0c5&0&E9\DeviceDe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\A CPI\51Typ
REGISTRY KEY VALUES CHANGED: (1)
HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum
Value "Implementing": binary data changed
REGISTRY KEY VALUES ADDED: (7)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\@="CDEject Context Menu Shell Extension"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\@="E:\Projector\CD Eject\cdeject.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\ThreadingModel="Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}\@="E:\Projector\CD Eject\cdeject.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\PSCDEJECT="E:\Projector\CD Eject\cdeject.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\CDEject 1.6 Demo\DisplayName="CDEject 1.6 Demo"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\CDEject 1.6 Demo\UninstallString="E:\Projector\CD Eject\UnGins.exe "E:\Projector\CD Eject\install.log""
REGISTRY KEY VALUES DELETED: (2)
HKEY_USERS\S-1-5-21-329068152-13430.......
From this report we can find the changes made to the system but we have to look for the important/required changes. So from the report,
first we get the list of files and directories added. Leave the files added to Local Settings & Start Menu. Next there's list of files added to CD Eject directory. Since only cdeject.dll has a context menu handler registry entry (see the registry addition/changes in report) so the cdeject.dll is the only file of interest.
Next is the list of files changed, & it shows that no changes were made to the WIN.INI & SYSTEM.INI so leave that.
Next is list of REGISTRY KEYS ADDED.Only three keys seems to b of our interest.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}
Next is list of REGISTRY KEYS DELETED, which is of no use (in most cases).
Next is list of REGISTRY KEY VALUES CHANGED. In this any of keys isn't of our interest but many times they r important.
Again there is list of REGISTRY KEY VALUES ADDED & only four seems to b of our interest.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\@="CDEject Context Menu Shell Extension"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\@="E:\Projector\CD Eject\cdeject.dll"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\ThreadingModel="Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}\@="E:\Projector\CD Eject\cdeject.dll"
& next is REGISTRY KEY VALUES DELETED, again they r of no use.
Now take a look at Registry Keys in section 3 & section 6 and observe the difference. In section 3, Keys r created & in section 6, values (e.g. String, DWORD etc.) r added to them. So we nedd only Registry Key Values fron section 6 only.
================================================== =======
OK. Now copy cdeject.dll to another directory (e.g. %Windows/System32/) & uninstall the CD Eject 1.6.
Now open Notepad, type Windows Registry Editor Version 5.00 & copy the Registry Values from section 6. It shud b like
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}]
@="CDEject Context Menu Shell Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\]
@="D:\\Windows\\System32\\cdeject.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02a07e8 0-efa2-11d4-8306-a7ebd4c50c7c}\InProcServer32\]ThreadingModel="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ ContextMenuHandlers\{02a07e80-efa2-11d4-8306-a7ebd4c50c7c}]
@="D:\\Windows\\System32\\cdeject.dll"
Now save the file as xyz.reg.
Note that I have changed the path for cdeject.dll (which is shown in bold letters) since cdeject.dll is now in %Windows\System 32\
and note the [ & ] (every Key).
--------------------------------------------------------------------------------------------------------------
OK. Just click on xyz.reg & u will b asked to add the registry, select Yes so that registry values get added to Windows Registry. Check that do u get the option for Insert at the CD-ROM right click context menu or not. Boooooooooooommmmm..... We have got the Insert in right click context menu. So xyz.reg is the registry entry for such option & we don't need to install CDEject 1.6 any more...
=====================X========================X=== ========
Now, next I m going to find out the changes made to registery when a software is registered (for full version etc.). This is useful coz many times, I found it very irritating to register every software separately when a fresh installation of windows is done. So what I did is, I have traced all s/w during registering procedure & made a single registry file for all s/w & when I install a fresh copy of windows, just install all s/w & register all s/w using registry file & so no need to register a s/w individually.
Here I m using WinZip as an example. Install WinZIp. Now run System Mechanic & on SYSTEM tab click on fifth tool (Safe Installer) to start the tracing procedure.
Enter report description & in the path of Install program browse the WINZIP32.exe. Move furthur & just take a snapshot (no need of any other option).
Now WinZip will b executed & it will ask u for registration, just enter ur registration details & close WinZip.
Now click on Done & report will b generated. Only four Key Values r added for registration details:
[code]
HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Nico Mak Computing\WinZip\WinIni\Name1="Your Name"
HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Nico Mak Computing\WinZip\WinIni\SN1="xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
HKEY_LOCAL_MACHINE\SOFTWARE\Nico Mak Computing\WinZip\WinIni\Name1="Your Name"
HKEY_LOCAL_MACHINE\SOFTWARE\Nico Mak Computing\WinZip\WinIni\SN1="xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
[code]
Here Name1 is for ur name & SN1 is for ur serial number. So just made a registry file like:
[code]
Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Nico Mak Computing\WinZip\WinIni\]
"Name1"="Your Name"
[HKEY_USERS\S-1-5-21-329068152-1343024091-854245398-1003\Software\Nico Mak Computing\WinZip\WinIni\]
"SN1"="xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Nico Mak Computing\WinZip\WinIni\]
"Name1"="Your Name"
[HKEY_LOCAL_MACHINE\SOFTWARE\Nico Mak Computing\WinZip\WinIni\]
"SN1"="xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"
[code]
Follow the same steps for other s/w & u can prepare a single registry file for all.
===================X=======================X====== =======
OK. Now based on above procedure, another tracing can b done for Windows Media Player. In a previous thread, someone has asked to change the crossfading time of WMP & so I writing this tute.
Just follow the same steps & in the installation path, browse wmplayer.exe. After taking snapshot when WMP will b launched, just make some changes like change crossfading time, volume etc. Now close WMP, generate a report & u will find that registry values r changed for such effects. Key Values r changed in hexadecimal. (Only bad thing is that, if u will increase crossfading time more than 10 sec it will cause no effect).
================X====================X============ =======
OK. Now we will trace System Mechanic itself for registry changes.
[list]
Run RegSnap, click File> Startup Wizard. Now click [color=red]New Snapshot[color].
http://img186.imageshack.us/img186/1417/10regsnapzc3.th.jpg (http://img186.imageshack.us/my.php?image=10regsnapzc3.jpg)
It will ask to enter a remark for ur snapshot (i.e. name of ur snapshot). Enter any remark, select Registry snapshot only & press OK. It will take a snapshot of ur system registry (trial version doesn't allow u to save snapshot).
http://img186.imageshack.us/img186/3640/11snapshotixz0.th.jpg (http://img186.imageshack.us/my.php?image=11snapshotixz0.jpg)
After finishing (don't close RegSnap), start System Mechanic, click on third tool Customize Windows settings. Now made some changes in settings (e.g. Start Menu reaction speed, Use Explorer when..... from Windows Explorer tab etc.) & close System Maechanic.
Now take another snapshot using RegSnap (remark shud b different from previous one).
After finishing, again click File> Startup Wizard. Now click compare button.
http://img186.imageshack.us/img186/6711/12rscomparelj3.th.jpg (http://img186.imageshack.us/my.php?image=12rscomparelj3.jpg)
It will show u both snapshots (current & previous one) for compariison. Choose the options as I have mentioned in following pic.
http://img80.imageshack.us/img80/8521/13rscomparisiondd3.th.jpg (http://img80.imageshack.us/my.php?image=13rscomparisiondd3.jpg)
After comparision, it will generate a report (u can save it :D).
Since I have changed only two options, Start Menu reaction speed & Use Explorer when opening "My Computer", so registry value change which I got were:
[code]
HKEY_CURRENT_USER\Control Panel\Desktop\MenuShowDelay
New: String: "282"
Old: String: "300"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\@
New: String: "explore"
Old: String: ""
[code]
So just made a registry file & customize ur system.
================================================== =======
Sorry for any mistake, since my english is not so good. I have tried to write this tute for beginners & so it becomes somewhat lengthy. I m sorry for that.