Win98banter - View Single Post - Why does the registry store unimportant file locations

**Lostgallifreyan** · March 6th 12, 01:09 PM posted to microsoft.public.win98.gen_discussion

wrote in :

When I run something like RegSeeker, to check the registry for junk, I
often find references to files that I deleted, and even some that are
self deleting from the "temp" folder. often named xxxxx.tmp.

That needs careful examining, so start by finding out exactly where in the
registry those file records are kept. Full key/branch names. Post what you
find, especially if more than one location in the registry is being used.

It may be a nasty tracking problem, or it may just be from 'Recent Files'
lists for various programs being examined by an over-zealous registry
cleaner.

Looking at the registry paths that hold the records is vital to help find out
which.

Or lets say that I save a picture called tree22.jpg in my folder named
"c:\downloads". Then I move that file to f:\pictures\nature. When I
clean the registry it will say "tree22.jpg can not be found in
"c:\downloads". Or xxxxx.tmp can not be found in c:\windows\temp.

First off, dont windows clean up after a file is deleted or moved?

W98 wouldn't even care, unless the file is associated by ClassId or some
other means. Even then it's often associated by directory, not each
individual file. And as far as NT kernel OS's go, unless the file protection
cache is involved, the same probably applies, barrign read/write permissions.

It looks as if something is watching your files more closely than the OS's
normally would, which is why thios needs careful watching from you. It might
not be serious, but you won't know without a close look.

Secondly, why does windows even put non-executible files in the
registry? Isn't there a way to shut this off? It seems so senseless,
not to mention slowing down the system with an oversized registry.

Normally it will watch for shared DLL's (and not all that many of those in
W98), but not data files. That's why this is weird.

This is not just Win98, but Win2000 and XP also do it. (I supposed
vista and Win7 do it too, but I have never used those).

If it does it for many data files, and does it consistently across all those
OS's, start looking at all the software you have brought in to all of them.
It may be something common to all of them, added by you, by accident or
design.

I have always wondered if windows stores EVERY file location in the
registry? I have a huge hard drive with thousands of saved downloads,
pictures, text files, etc. Is all of that in the registry? Once again,
this is all stuff that has no reason to be in the registry, only .EXE
files really need it, and probably .DLL and possibly .INI.

INI won't, they were specifically about NOT using it.

EXE files don't
either, they just use a base association to run, and the OS doesn't track
what they are or where they are to do that. DLL's may be registered to
prevent deletion on uninstall, if some other program shares it, and even
then, the 'record' is a DLL name, and a count of how many times the OS thinks
it was registered. It may not even know the path to the DLL if it's not on
the main system path.

If something really is watching thousands of files and keeping a record of
them all, you need to monitor net connections until you're sure that this
isn't part of something benign and local. There have been attempts by
attackers on P2P networks, to get software onto machines that monitor for all
content, looking for copyrighted files. I'm not at all sure this is what's
happening, but something is watching closely, in far more detail than the OS
normally would. I think if this were an OS standard feature I'd have heard a
lot more about it, and apart from the things I mentioned, there isn't a lot
else unless it gets added by someone.