Solved Can not export/backup registry

[noisywan]

Hi folks,

I'm using Win 7 SP2 64bit Ultimate on a desktop PC.

I have 2 questions:
Q1) Recently I tried creating a backup of registry and I got this error:

"Cannot export. Error writing the file. There may be a disk or file system error."
Even though it aborts the exporting process with an error, it creates a LARGE file that is ~2.8 GB(!) in size.

To find the branch with the problem, I tried exporting each branch to a separate file. All branches got exported fine except this one;

"\\HKEY_CURRENT_USER\Software"
(and it's mirror; "\\HKEY_USERS\S1-5-21...1001\Software")

What could be the problem? I need help from advanced users.

Q2) The branch HKEY_LOCAL_MACHINE has a size of ~2.7 GB. Is this normal for a 12 years old Windows install?

 

[SIW2]

HKEY_LOCAL_MACHINE has a size of ~2.7 GB. Is this normal for a 12 years old Windows install?

no. 200-300mb is normal

 

[noisywan]

[FONT=&quot]UPDATE: Found the culprit! It's Kaspersky Internet Security[/FONT]
[FONT=&quot]Bloated size in registry is caused by this entry;
Kaspersky Lab Filter Core
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt
This entry is 858 MB in size. It has 2 copies in ControlSet001 and 002 which explains the 2.7 GB export/backup file size.[/FONT]

 

[file3456]

And people wonder why I don't use any anti-virus software....


For your reading enlightenment.


Kaspersky bans and allegations of Russian government ties - Wikipedia

Like NortonLifeLock, Avira Bundles Antivirus With Cryptocurrency Miner, Too | PCMag

The crap (yes, crap) has gotten so bloated today it's not even funny. Not even a feather magically made to make a clown laugh and fart at the same time funny...

In lieu of BS, over bloated anti-virus software, I use (and up for your consideration) the following:

The now free and open source software Sandboxie for my browser. Although, not the new revamped crap, but Sandboxie classic. What this does (if configured right) is keep all the potential bad crap from touching your computer since the browser is in a so-called "sandbox." So malicious JavaScript and whatnot on a webpage shouldn't be able to hop the sandboxed environment and execute on your computer outside the sandboxed environment that the browser is in. Well, at least that's the theory until some virus or what ever figures out how to jump a sandboxed environment or virtual environment for that matter. Even then, it'll get patched. And probably right away for Sandboxie since it's an open source collaboration at Github.

Then I run the uBlock Origin add-on in my browser with the malware domains blocking list (for what it's worth) and several custom uBlock Origin block lists of my own found at Github.

Then ALL downloads are scanned at the VirusTotal website. The general consensus is four hits and you toss. But it may depend on what you have. Don't depend on the community input if any exists for that upload at VirusTotal.

On top of all that, I run periodic full 1:1 full hard drive clones and data backups should disaster strike. If it does (so far so good) I can roll back as if most has never changed since the last full hard drive clone. Or even copy back specific data if need be from the multiple redundant data backups. But one should ALWAYS test their clone and backup strategy and make sure it actually works for when the time comes you need it.

So there you have it. Security or even privacy always comes at a cost of cumbersomeness, but in the end it's worth it.

 

[noisywan]

I contacted Kaspersky support chat and they were sleeping so I took the risk and deleted the registry branch (after creating a backup)I disabled the self-defence in KIS and deleted the reg entries in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\klflt\Parameters\CollectionDataHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\klflt\Parameters\CollectionData(ControlSet001 did not have the `CollectionData` entry so I did nothing in that branch)I booted the PC and the problem is fixed. No delay at logon.

After deleting the `CollectionData` I checked it again and it was populated with 44 entries (~1 MB in size)
I wonder what kind of `data` is `collected` here and why is it written into Windows Registry...

- - - Updated - - -

And people wonder why I don't use any anti-virus software....

Well no software is safe until you debug it's code by yourself.

Kaspersky, Microsoft, Norton, Google... They know everything about us. It's a paranoia fest.

I'm no James Bond so I use them all. No need to spy on me, Putin can have my Steam account pass if he kindly asks.