Saturday, October 29, 2011

Hacking Windows XP Registry Part-III

0 comments
Save to del.icio.us 0 hits!

1. Modify Control Panel Categories

Even if you like the new style for Control Panel, you might at times wish you could shift some items around into a different category. It's possible.

[Start] [Run] [Regedit]

Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468e-B848-2B2E8E697B74} 2

Modify/Create DWORD Value of Data type REG_DWORD Named [Choose one of the applets with .cpl extension]

Setting for Value Data: [Select the value from table below]

Other Control Panel Options 0
Appearance and Themes 1
Printers and Other Hardware 2
Network and Internet Connections 3
Sounds, Speed, and Audio Devices 4
Performance and Maintenance 5
Date, Time, Language, and Regional Options 6
Accessibility Options 7
Add or Remove Programs 8
User Accounts 9

Exit Registry / Reboot

To further customize the items that appear in the new Control Panel, do a search of your system for all files that end in .cpl extension. If they aren't already listed, you can add them with a new DWORD value and then assign them to a category of your choosing.

2. Enable/Disable Run Commands Specific to the Registry

This tweak controls the use of the Run command on the local machine

[Start] [Run] [Regedit]

Go to: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ Policies\Explorer

Create a DWORD value of Data Type REG_DWORD for each Run function that will be disabled.

Modify/Create the Value Name [DisableLocalMachineRun]
Modify/Create the Value Name [DisableLocalMachineRunOnce]

Modify/Create the Value Name [DisableCurrentUserRun]
Modify/Create the Value Name [DisableCurrentUserRunOnce]

Setting for Value Data: [0 = Disabled / 1 = Enabled]

Exit Registry / Reboot

3. Enable/Disable System Properties Access from My Computer

This tweak removes access to System Properties via My Computer as well as via Control Panel.

[Start] [Run] [Regedit]

Go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Modify/Create DWORD Value of Data type REG_DWORD Named [NoPropertiesMyComputer]
Value Data: [0 - Display Properties / 1 - Hide Properties]

Exit Registry / Reboot

4. Uninstall Programs Manually

Just because Windows XP has the Add/Remove Programs feature it doesn't mean your application will appear in the list. Furthermore, even if it does appear, it's no guarantee that the uninstall feature will work. When you run across one of these situations the items listed below will help in getting rid of the application. Be aware that these steps may not remove everything associated with the application and can impact other applications on the computer. Have a backup or restore point and use caution.

Find the directory for the application and delete all the files in the directory. Delete the directory.

Open regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE and find the folder for the application. Delete the folder.

Open regedit and navigate to HKEY_CURRENT_USER\SOFTWARE and find the folder for the application. Delete the folder.

To remove the application entry from Add/Remove Programs (if present) open regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and find the folder for the application. Delete the folder.

Some applications have Services attached to them. If this is the case, navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services, locate and delete the service.

In Windows Explorer, navigate to the individual user settings and delete program references. Common places to check would be:

C:\Documents and Settings\All Users\Start Menu\Programs and delete relevant entries.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup and delete relevant entries.

C:\Documents and Settings\%YourUserID%\Start Menu\Programs and delete relevant entries.

[Do this for each User ID listed]

C:\Documents and Settings\%YourUserID%\Start Menu\Programs\Startup and delete relevant entries.

[Do this for each User ID listed]

If no entries were found in the previous step and the application launches automatically, navigate to

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

and delete the entry.

5. Create a right-click command prompt option

You can right-click a folder to get a list of actions you can apply to it. Here?s a way to create an action on that right-click menu that opens a command prompt window with that folder as the current directory. In a text editor such as Notepad, type the following exactly:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Folder\shell\Cmd Here]

@=?Command &Prompt Here?

[HKEY_CLASSES-ROOT\Folder\shell\Cmd Here\command]

@=?cmd.exe /k pushd %L?



Save the file with any name you want, with a .reg extension. Then double-click the saved file and choose Yes to merge the file?s information into the Registry. You can delete the file. Right-click any folder and you?ll see the CommandPrompt Here option.

6. Adjusting System Restore values

The new System Restore feature in Windows XP automatically backs up a snapshot of your system, including your Registry, every 24 hours. It also saves restore points for 90 days. Neither of these values is directly editable in the System Restore program, but you can change them in the Registry. Go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore

You?ll find an assortment of settings here. To change the interval between automatically created restore points, change the RPGlobalInterval setting. To change the number of days that a restore point is retained, change the RPLifeInterval setting.

System Restore time intervals are measured in seconds, not days, so you must convert the number of days you want into seconds. There are 86,400 seconds in a day, so multiply 86,400 by the number of days you want to determine the value. (There are 3,600 seconds in an hour, I hope you know)

7. Erase the swap file at shutdown

You might be concerned about someone browsing your users? swap files and gathering up little bits of their sensitive data. A remote possibility, to be sure, but it could happen. For that extra measure of security, go to:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management

Set the ClearPageFileAtShutdown DWORD to 1. This will make shutdowns take longer, because it overwrites everything in the swap file with zeroes. Don?t turn this feature on unless you have a serious security threat.

8. Delete the Files Stored on This Computer category in the My Computer window

In Windows XP, the My Computer window?s listing is broken down by categories: Hard Disk Drives, Devices with Removable Storage, and so on. One of these categories is Files Stored on This Computer, which appears at the top of the My Computer window. If a user doesn?t need it , you can get rid of it. To do so, go to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\
NameSpace\Delegate Folders

Delete the {59031a47-3f72-44a7-89c55595fe6b30ee} subkey to remove the category.

9. Change the desktop cleanup frequency

Through Display Properties (Desktop tab, Customize Desktop button, General tab), you can turn on and off a feature that runs the Desktop Cleanup Wizard every 60 days. You don?t have an option to set a different interval there, but you can change the interval in the Registry. To do so, go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz

Change the Days Between Clean Up Value to some other number of days (in decimal format).

10. Sort menus alphabetically

When you install a new program for a user, it doesn?t find its place in the alphabetical Start menu hierarchy right away; it hangs out at the bottom for a little while. If your users employ the Classic Start menu, they can re-alphabetize it manually by right-clicking the taskbar and choosing Properties, clicking the Customize button next to the Classic Start Menu, and clicking the Sort button. With the Windows XP style of Start menu, however, you don?t have an equivalent button. To make Windows always alphabetize the list, remove the permissions from the Registry key that controls the sort order for the Start menu. To do so, go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder

Choose Edit | Permissions and click the Advanced button. Deselect the Inherit From Parent The Permission Entries That Apply To Child Objects check box and then click Copy when the Security dialog box pops up. Click OK and clear the Full Control entry for your account and all security groups you are a member of. Leave only Read permission.

11. Prevent programs from loading at startup

Remember back in the good old days of Windows 3.1 when you could open up the Win.ini file in a text editor and remove an item from the RUN= line to disable it from running at startup? With Windows 9x and above, the Win.ini file became less useful because 32-bit programs were set to run at startup from within the Registry instead.

One way to selectively disable programs from loading at startup is to use MSCONFIG (from the Run command) to deselect certain items. Another way to remove them is to edit the Registry directly. Consider the following locations:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

for applications that start up for all users

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

for applications that start up when the current user logs on

Remove the entry for a program by right-clicking it and selecting Delete to prevent it from loading.

12. Change categories in the Control Panel

Windows XP?s Control Panel is broken down by category in the default Category view, but the group to which an item belongs is not always obvious. If you disagree with Microsoft?s assignments, you can switch them around. To assign a different category to an item, go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\
{305CA226-D286-468e-B848-2B2E8E697B74} 2

Find the item you want to change and double-click it to bring up a dialog box. Change the item?s DWORD value to your preference. Use the Table given below as a guide (shown with decimal numbers, which is the way you should enter them).

DWORD value to set

Other Control Panel Options 0

Appearance and Themes 1

Printers and Other Hardware 2

Network and Internet Connections 3

Sounds, Speed, and Audio Devices 4

Performance and Maintenance 5

Date, Time, Language, and Regional Options 6

Accessibility Options 7

Add or Remove Programs 8

User Accounts 9

13. Grouping multiple open windows

Windows XP will group multiple open windows (IE windows for example) into one group on the task bar to keep the taskbar clear. This can be annoying at times - especially when comparing different web pages because you have to go back to the task bar, click on the group and then click on the page you want and then you only get one page because you have to click on each one separately. I think the default for this is 8 windows - any combination of apps or utilities open.

You can modify this behavior by adding this registry key at:

HKEY_CURRRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\

add a Dword value of type REG_DWORD named [TaskbarGroupSize]

modify "TaskbarGroupSize" entry to be the number of windows you want open before XP starts to group them on the task bar.

A value of 2 will cause the Taskbar buttons to always group

Another tweak is to disable or enable recent documents history. This can be done at:

HKEY_CURRRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

this key should already be present - if it isn't you'll need to add it:

Add a Binary value of type REG_BINARY named [NoRecentDocsHistory]

modify it so that value reads 01 00 00 00

14. Disable Tips

To disable Ballon tips in Windows XP do this registry tweak

Go to : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Create a new DWORD value, name it EnableBalloonTips, and set it equal to 0. If EnableBalloonTips is already there and equal to 1, set it equal to 0. Quit the registry editor, log off, and log back on. Voila! Your computer will stop talking down to you.

15. Add/Remove optional features of Windows XP

To dramatically expand the list of applications you can remove from Windows XP after installation, navigate to C:\WINDOWS\inf and open the sysoc.inf file. {Opps , if you didn?t find the inf directory, you are right. It?s a hidden folder, so go to Tools>Folder Options> View , enable Show Hidden Files & Folders.}

[Version]

Signature = "$Windows NT$"

DriverVer=07/01/2001,5.1.2600.0

[Components]

NtComponents=ntoc.dll,NtOcSetupProc,,4

WBEM=ocgen.dll,OcEntry,wbemoc.inf,hide,7

Display=desk.cpl,DisplayOcSetupProc,,7

Fax=fxsocm.dll,FaxOcmSetupProc,fxsocm.inf,,7

NetOC=netoc.dll,NetOcSetupProc,netoc.inf,,7

iis=iis.dll,OcEntry,iis.inf,,7

com=comsetup.dll,OcEntry,comnt5.inf,hide,7

dtc=msdtcstp.dll,OcEntry,dtcnt5.inf,hide,7

IndexSrv_System = setupqry.dll,IndexSrv,setupqry.inf,,7

TerminalServer=TsOc.dll, HydraOc, TsOc.inf,hide,2

msmq=msmqocm.dll,MsmqOcm,msmqocm.inf,,6

ims=imsinsnt.dll,OcEntry,ims.inf,,7

fp_extensions=fp40ext.dll,FrontPage4Extensions,fp40ext.inf,,7

AutoUpdate=ocgen.dll,OcEntry,au.inf,hide,7

msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7

RootAutoUpdate=ocgen.dll,OcEntry,rootau.inf,,7

IEAccess=ocgen.dll,OcEntry,ieaccess.inf,,7



Games=ocgen.dll,OcEntry,games.inf,,7

AccessUtil=ocgen.dll,OcEntry,accessor.inf,,7

CommApps=ocgen.dll,OcEntry,communic.inf,HIDE,7

MultiM=ocgen.dll,OcEntry,multimed.inf,HIDE,7

AccessOpt=ocgen.dll,OcEntry,optional.inf,HIDE,7

Pinball=ocgen.dll,OcEntry,pinball.inf,HIDE,7

MSWordPad=ocgen.dll,OcEntry,wordpad.inf,HIDE,7

ZoneGames=zoneoc.dll,ZoneSetupProc,igames.inf,,7

[Global]

WindowTitle=%WindowTitle%

WindowTitle.StandAlone="*"

The entries that include the text hide or HIDE will not show up in Add/Remove Windows Components by default. To fix this, do a global search and replace for ,hide and change each instance of this to , (a comma). Then, save the file, re launch Add/Remove Windows Components,

16. Remove Windows Messenger

It seems that a lot of people are interested in removing Windows Messenger for some reason, though I strongly recommend against this: In Windows XP, Windows Messenger will be the hub of your connection to the .NET world, and now that this feature is part of Windows, I think we're going to see a lot of .NET Passport-enabled Web sites appearing as well. But if you can't stand the little app, there are a couple of ways to get rid of it, and ensure that it doesn't pop up every time you boot into XP. The best way simply utilizes the previous tip:

If you'd like Windows Messenger to show up in the list of programs you can add and remove from Windows, navigate to C:\WINDOWS\inf and open sysoc.inf (see the previous tip for more information about this file). You'll see a line that reads:

msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7

Change this to the following and Windows Messenger will appear in Add or Remove Programs, then Add/Remove Windows Components, then , and you can remove it for good:

msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,7

17. Rename multiple files ( it is not a Registry tweak though. I thought this to be really cool, so I have put it here)

A new, small, neat feature for Windows XP deals with renaming files. I personally have always wanted the OS to include a way to do a mass file renaming on a bunch of files. You can now rename multiple files at once .Its really simple:

Select several files in Explorer, press F2 and rename one of those files to something else. All the selected files get renamed to the new file name (plus a number added to the end). Simple J




I hope you enjoyed the above Registry tricks ! May be next time I?ll come up with more. That's all for now .

Comments
0 comments
Do you have any suggestions? Add your comment. Please don't spam!
Subscribe to my feed

Post a Comment

Subscribe now! RSSFeeds RSS

Advertise Here

Earn by receiving SMS Advertise with Slodive Advertise with Slodive

Subscribe now! RSSSlodive's Latest Posts

Subscribe now! RSSSlodive's Latest Comments

Subscribe now!Slodive's Hot Links