Registry cleaner

From Wikipedia, the free encyclopedia

This article needs additional citations for verification. Please help improve this article by adding reliable references. Unsourced material may be challenged and removed. (December 2008)

A registry cleaner is a type of software utility designed for the Microsoft Windows operating system whose purpose is to remove redundant or unwanted items from the Windows registry. However the necessity and usefulness of registry cleaners is a controversial topic, with experts not agreeing on their benefit. The problem is further clouded by the fact that malware and scareware is often associated with utilities of this type.

Contents 1 Purpose 2 Advantages 3 Disadvantages 3.1 Registry damage 3.2 Malware payloads 3.3 Scareware 3.4 Marginal performance benefit 3.5 Undeletable registry keys 3.6 Recovery capability 3.7 Malware removal 3.8 Application virtualization 4 References 5 External links

[edit] Purpose

Registry Cleaners are software utilities that attempt to remove configuration data from the Windows Registry that is no longer in use or that is unwanted on the system. Such data may include information left by software that has not been uninstalled completely from the computer, information that is no longer of use, or settings required for the operation of malware. A registry cleaner scans the registry, and attempts to pick out the unnecessary values in order to delete or repair them.

[edit] Advantages

Registry cleaners, or registry cleanup software, may improve the performance of computers by ridding the registry of redundant information.^{[citation needed]}

Due to the sheer size and complexity of the registry database, manually cleaning up debris and invalid entries would be impractical, so registry cleaners are essentially tools that automate the process of looking for invalid entries, missing file references or broken links within the registry and resolving them.

The correction of an invalid registry key can provide some benefits.^{[citation needed]} For example, on older versions of Windows, a registry entry indicating a program should be run at startup from a network path that no longer exists can delay startup by as long as the network protocol takes to timeout. (Note: A registry cleaner is not required to correct this, as free tools such as AutoRuns from Sysinternals (now Microsoft) can resolve this issue.^[1])

Noted Windows architecture expert Mark Russinovich has concluded that registry cleaners will continue to have a role until most applications have moved to the .NET Framework platform that does not rely on the registry for application settings.^[2]

Some registry cleaners offer backup and restore functions that allow the user to revert changes made by the registry cleaner in case they are undesired. A registry cleaner may be useful for someone that adds or removes programs from their computer very often; however, a virtual machine is a faster and more reliable means of reverting an operating system to a previous good known state in a testing scenario.

[edit] Disadvantages

Some registry cleaners make no distinction as to the severity of the errors, and many that do may erroneously categorize errors as "critical" with little basis to support it—a modern form of snake oil.^{[citation needed]}

[edit] Registry damage

Most notably, critics say there is no reliable way for a third party program to know whether any particular key is invalid, redundant or neither. Poorly designed registry cleaners may not know for sure whether a key is still being used by Windows or what detrimental effects removing it may have. This has led to examples of registry cleaners causing loss of functionality and/or system instability.^[3][4][5]

[edit] Malware payloads

The benefits of Registry cleaners have been used by a number of trojan applications to install malware, typically through "social engineering" attacks that use website popups. Rogue registry cleaner "WinFixer" has been ranked as one of the most prevalent pieces of malware currently in circulation.^[6]

[edit] Scareware

Rogue registry cleaners are often marketed with alarmist advertisements that falsely claim to have pre-analyzed your PC, displaying bogus warnings to take "corrective" action, hence the reason that they are sometimes called "scareware". In October 2008, Microsoft and the Washington attorney general filed a lawsuit against two Texas firms, Branch Software and Alpha Red, producers of the "Registry Cleaner XP" scareware.^[7] The lawsuit alleges that the company sent incessant pop-ups resembling system warnings to consumers' personal computers stating "CRITICAL ERROR MESSAGE! - REGISTRY DAMAGED AND CORRUPTED", before instructing users to visit a web site to download Registry Cleaner XP at a cost of $39.95.

[edit] Marginal performance benefit

On Windows 9x computers, it is possible that a very large registry could slow down the computer's startup time. However this is far less of an issue with NT-based operating systems (including Windows XP and Vista) due to a different on-disk structure of the registry, improved memory management and indexing.^[8] Slowdown due to registry bloat is thus far less of an issue in modern versions of Windows. More importantly, however, the difference in speed due to the use of a registry cleaner is negligible: rarely do they remove more than a few kilobytes from the total size of the registry. In fact, technology journalist Ed Bott has claimed that no one has ever successfully managed to measure any significant performance increase from the use of a registry cleaner.^[9] Any potential user of a registry cleaner must thus balance a probably negligible performance increase against the possibility of system instability. A safer and more measurable approach to registry performance is to defragment the registry files using a Microsoft-supported tool such as PageDefrag.^[10]

[edit] Undeletable registry keys

Registry cleaners cannot repair scenarios such as undeletable registry keys caused by embedded null characters in their names; only specialized tools such as the RegDelNull utility from Sysinternals (now Microsoft) are able to do this.^[11]

[edit] Recovery capability

A Registry cleaner cannot repair a Registry hive that can't be mounted by the system. However a corrupt registry can be recovered in a number of ways that are supported by Microsoft (e.g. Automated System Recovery, from a "Last Known Good" boot menu, by re-running setup or by using System Restore).

[edit] Malware removal

Registry cleaners are not specialized malware removal utilities, and therefore are not equipped to deal with complex scenarios where malware such as spyware, adware and viruses can re-infect a computer through multiple infection vectors, where removal results in system instability or infection of the tool itself.

A registry cleaner cannot detect or remove registry entries associated with a rootkit, which will hide this information from other processes. A specialized tool such as RootkitRevealer is required to compare the results returned by Registry API's against the raw underlying registry storage.^[12]

[edit] Application virtualization

A registry cleaner is of no use for cleaning registry entries associated with a virtualised application since all registry entries in this scenario are written to an application-specific virtual Registry instead of the real one.^[13]

[edit] References

[edit] External links