Notes on the Windows 9x Registry

This page contains a few notes on the Windows Registry. For information concerning HKCR and Windows Explorer, see here.

Allowing Long Filenames

Long Filename support is controlled under
Win31FileSystem = 0Long filenames are enabled
Win31FileSystem = 1Long filenames are disabled
Also known as "the Windows 3.1 File System"

Reference: Windows 95 Annoyances - Windows 95 Keeps Deleting My Applications

Programs Run When Booting

When Windows 9x (2000, XP, NT4 ...) starts, it runs the programs identified in
as well as those in the directories pointed to by
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
      Common Startup=C:\WINNT\Profiles\All Users\Start Menu\Programs\StartUp (NT)
      Common Startup=C:\WINNT\All Users\Start Menu\Programs\StartUp          (NT)
   HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
      Startup=C:\WINDOWS\Start Menu\Programs\StartUp                (95)
      Startup=C:\WINNT\Profiles\userid\Start Menu\Programs\StartUp  (NT)
(If you rename HKLM\..\Common Startup, NT 4 just creates another one.)

Review C:\BOOTLOG.TXT to see those programs loaded via Config.sys and Autoexec.bat followed by the Windows operating system files. Those run via the registry entries and StartUp are not listed.

Not all of the registry keys will contain values. For instance, on one of my fairly plain systems, only HKLM/../Run includes any programs (4). The rest of the keys are either empty or missing. Some of the registry keys may not exist on your system. HKCU/../RunOnce, HKLM/../RunOnceEx, and HKLM/../RunServices are missing and the HKCU/../Run and HKLM/../RunServices key are empty. In general, the 4 RunOnce keys are empty since they are only used if it is necessary to re-boot the system when installing new software.

BTW, simply renaming the StartUp directory won't hide it from the Windows boot process. For more information, see here.

This Microsoft knowledge base article explains the purpose of each Run... key and indicates when it is executed. However, notice that RunOnceEx is not listed.

A list of the Programs (.exe) started during the boot process is available via Start / Programs / Accessories / System Tools / System Information / Software Environment / Startup Programs (assuming that your system has msinfo loaded).


If you run msconfig.exe, then many programs are moved to other registry locations. This runs msconfig.exe.
    MSConfig=C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\msconfig.exe /auto
These programs are controlled via msconfig.exe.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig
      This is a list of files in your Start\Programs\Startup directory
      key = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Run msconfig.exe to disable these programs.


I don't know why, but my Windows XP Pro system is missing the following keys
I suppose that a new method was introduced to run Services. Possibly, they are loaded via

The dll's located here are executed


XP - Running a Virus in Windows Safe Mode

I recently had a parasite problem on my XP system where the parasite was still running when booting into Windows Safe mode! What happens is that Explorer.exe is the program that displays the desktop (also known as the shell). Therefore, this key makes sense. However, Explorer can also take command line arguments (usually a directory path) that instruct the program to perform some action. In this case, the argument is a program and Explorer executes (runs/opens) it.

When Windows runs in Safe mode, the non-operating system drivers and programs specified in most other locations are not run. This hack gets around that problem and causes the virus to run.

Regedit Command Line Options

Most of the command line options are documented here (Win 3.1 /s /v), here (Dos Mode), and here on the Microsoft web site and in the Windows 95 Resource Kit (2.2M/2.9M). The basic syntax (from Windows 95 Registry/Registry Structure/Saving and Restoring the Registry) is
regedit [/L:system.dat] [/R:user.dat] file1.reg, file1a.reg...
regedit [/L:system.dat] [/R:user.dat] /e file3.reg [regkey]
regedit [/L:system.dat] [/R:user.dat] /c file2.reg

Backup the Registry

In order to make an exact backup of the registry, Usually, I just make ASCII (text) backups by exporting the entire registry to a file. This can be done with either the GUI or from the command line.

Registry Scripts

Regini.exe (provided with the Windows NT Server Resource Kit) uses special script files to configure the registry. Ref

KiXtart 95, part of the Windows NT 4.0 Resource kit, allows you to use a Basic like language to read & modify the registry and to send key strokes to any open window. [1] [2] [3]

When importing .reg files, it is possible to delete keys. Simply edit the .reg file and place a minus sign in front of any key you want to delete. For instance

Watch out - this could be very dangerous!


Author: Robert Clemenzi -
URL: http:// / user / clemenzi / technical / Win_95_Registry.htm