Regshot/Regmon Filters

HKEY_Local_Machine and HKEY_CURENT_USER (not HKLU, but HKCU) are the places most programmers will place their registry entries. HKLM is used when you want the registry entry to affect the whole machine, such as context menus, or dll registrations and such. HKCU is used when you want the entries to affect only the current user. Most of the time, software, well small freeware/opensource stuff, will store their registry entries within HKCU\SOFTWARE. IF you take a glance at that location, I guarantee you will find information from different programs you have run on your system.

Also HKEY_USER is another place the stores the same registry settings as HKCU, however, HKU stores them in HKU\{SOME BIG LONG NUMBER}\SOFTWARE. The {SOME BIG LONG NUMBER} is different on every machine.

Some examples are Angry IP scanner stores its program settings in HKCU\SOFTWARE\ANGRYZIBER\, while WinImage stores it settings (Including registration info) in HKU\{SOME BIG LONG NUMBER}\SOFTWARE\WINIMAGE\.

My Registry Rapper program, runs a search on the HKCU, because most of the software I have tested stores it registry entries in HKCU\SOFTWARE. However, I will be adding in the HKU and possibly HKLM at a later date.

I hope this helps.

***********************************
Deuce   {The Core}
"Portable Software: Just the beginning..."