Unusual registry keys

[GRoston]

All,

Today was not a good day - I ran Windows update and after restarting, my computer hung at the ""Preparing to configure Windows. Do not turn off your computer." message. Took numerous reboots, including safe mode and using a previous restore point to get things running again.

After all of these shenanigans, I found a number of unusual registry keys, specifically HKEY_USERS\PE_C_CLASSIC .NET APPPOOL, HKEY_USERS\PE_C_DEFAULTAPPPOOL, HKEY_USERS\PE_C_TEMP, and HKEY_USERS\PE_D_DEFAULT.

I googled, but found no reference to these. I do not know if there is any correlation between the events of today and these keys. The date stamp on them makes me think not, but I do need to ask if anyone knows what they are? Should they be removed?

 

[marsmimar]

It's my understanding that the HKEY_USERS hive is broken down in to individual sub-keys with each user profile having its own sub-key. If no additional profiles have been registered, Windows is programmed to show a “default” sub-key inside the HKEY_USERS tree. This is the overriding profile when no other accounts have been setup, and should be treated with caution. A bad edit or deletion could conceivably prevent Windows from operating correctly or not at all.

Another consideration is besides there being a list of settings under HKEY_USERS, you’ll also find an exact replica or duplicate in HKEY_CURRENT_USER. This is necessary so that when you login, your user profile is taken from HKEY_USERS and copied in to a new table for easy access via the registry. Don’t be misled by the term replica or duplicate, though. The data stored in the HKEY_CURRENT_USER table is actually a live reference mapping to the very same information that is stored in the HKEY_USERS hive. Indiscriminate editing/deleting of HKEY_USERS will therefore affect HKEY_CURRENT_USER, and vice versa.

According to a lot of posts on this Forum by people a lot smarter than me, Windows 7 doesn't need any registry tweaking. It's able to handle the registry just fine on its own. It's not a question of if editing the registry will cause problems but when.

Having said that, a lot of folks here recommend CCleaner and its built in registry cleaner. It's not too aggressive and has a good track record. Especially if you take advantage of its ability to save the current registry before doing any cleaning. Additionally, it wouldn't hurt to make a current restore point or even better a system image before editing the registry.

CCleaner - PC Optimization and Cleaning - Free Download

Just for future reference, depending on how many Windows Updates need to be installed, I've found it safer to turn off automatic updates and install the updates manually, just a few at a time. Keep track of the KB numbers, install maybe 4-5 at a time, and reboot after each group is installed. If problems occur you'll know which group to uninstall. Then reinstall just one at a time, rebooting after each one. They'll either all install just fine or you'll know which update is the problem. Save it for last and continue with the next group. Yes, it's a lot slower this way but it's always worked for me.

 

[gigagiggles]

Searched for "apppool" in my registry. None found.

Patch Tuesday did include two .NET security updates, 3.51 and 4.0. Perhaps the keys are remnants of a failed update and cleanup?

 

[wanchoo]

I suggest that you save these unusual Registry individually and delete them one by one separated by reboots. These entries appear redundant on the face of it.

If all these entries get deleted without creating any problems, then even keep the back-ups for at least two months just in case there is a delayed reaction to the deleting. If everything is OK after even two months then perhaps you may delete the saved Registry entries.

Of course it would best if you created a back-up image before tinkering with the Registry. In that case when deleting the unusual Registry entries you needn't even back them up.

 

[GRoston]

Just a follow-up - those registry keys have disappeared. Very strange...

 

[wanchoo]

Good for you. That is what you wanted anyway.

Just a follow-up - those registry keys have disappeared. Very strange...