PDA

View Full Version : Restoring registry from backup



tonymeman2486
2008-07-15, 22:34
I created a registry backup with Spybot a couple weeks ago. Yesterday, another user did a system restore and reset the registry. Is there any way to access the backup and restore the previous registry?

blues
2008-07-16, 07:44
i just looked in some folders and found this C:\Documents and Settings\All Users\Programdata\Spybot - Search & Destroy\Backups but the programdata folder is hidden. i dont know if the folder is called programdata in english. but i am not sure if this is the right backups. you should wait before doing anything with this until someone with more knowledge than me on this helps you.

tonymeman2486
2008-07-18, 04:14
bump

If I'm an idiot and this is impossible just tell me.

md usa spybot fan
2008-07-18, 07:09
tonymeman2486:


... Is there any way to access the backup and restore the previous registry?
Yes, but using backups from "... a couple weeks ago." may be worse than the "system restore" depending on how old the "restore point" used for the "system restore" was and what occurred that required "system restore".

The registry backups taken by Spybot are not full backups of the entire registry and are not coordinated with other system changes such as Windows updates that "system restore" handles and I personally would hesitate to use those backups to restore the Registry (at least in their entirety) because once you've run your system for any period of time they would be outdated and could possibly do has much harm as good.

When you do a "Create registry backup" in Spybot, two files are created:
regLocal.reg
regUsers.reg
The directory they are created in depends on the OS you have as follows:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Backups
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Backups
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Backups
Vista:
C:\ProgramData\Spybot - Search & Destroy\Backups
The two files are exported "REGEDIT4" type files if specific registry keys as follows:
regLocal.reg
[HKEY_LOCAL_MACHINE\Software]
regUsers.reg
[HKEY_USERS]