Peenie Wallie

The registry is stored at several locations.

There are five main registry branches in Windows XP), each containing a specific portion of the information stored in the Registry. They are as follows:

* HKEY_CLASSES_ROOT - this branch contains all of your file types as well as OLE information for all your OLE-aware applications.
* HKEY_CURRENT_USER - this branch points to the part of HKEY_USERS appropriate for the current user.
* HKEY_LOCAL_MACHINE - this branch contains information about all of the hardware and software installed on your computer. Since you can specify multiple hardware configurations, the current hardware configuration is specified in HKEY_CURRENT_CONFIG.
* HKEY_USERS - this branch contains certain preferences (such as colors and control panel settings) for each of the users of the computer. In Windows 95/98/Me, the default branch here contains the currently-logged in user. In Windows 2000/XP, the default branch here contains a template to be used for newly-added users.
* HKEY_CURRENT_CONFIG - this branch points to the part of HKEY_LOCAL_MACHINE appropriate for the current hardware configuration.

So, it looks like Nero only fvcked my system registry in 4 out of the 5 main branches. They missed one. Yeah!

• HKEY_CLASSES_ROOT


• HKEY_CURRENT_USER


• HKEY_LOCAL_MACHINE


• HKEY_USERS

The following Registry files are stored in %SystemRoot%\System32\Config\:

* Sam - HKEY_LOCAL_MACHINE\SAM
* Security - HKEY_LOCAL_MACHINE\SECURITY
* Software - HKEY_LOCAL_MACHINE\SOFTWARE
* System - HKEY_LOCAL_MACHINE\SYSTEM
* Default - HKEY_USERS\.DEFAULT
* Userdiff - Not associated with a hive. Used only when upgrading operating systems.[14]

The following files are stored in each user's profile folder:

* %UserProfile%\Ntuser.dat - HKEY_USERS\ (linked to by HKEY_CURRENT_USER)
* %UserProfile%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat (path is localized) - HKEY_USERS\_Classes (HKEY_CURRENT_USER\Software\Classes)

Unfortunately, I get sharing violations when I try to open any of these files with Notepad or Ultraedit. Didn't use to be this way, but now I can't open them. Thanks, Microsoft. Thanks for that.

So, I ran REGEDIT and exported the HKEY_CLASSES_ROOT hive to my desktop as HKEY_CLASSES_ROOT.reg. But, I was expecting it to be a text file and it's clearly not a text file. It used to be, but it's not now. Thanks for that Microsoft. You're swell.

Nero offers pretty much no support. They have a tech support line but it's not free and I sent them an email to their free tech support dept and haven't hear jack back from them. Then, I found this post on Major Geeks and I began to think that maybe there is an uninstall utility for Nero that might work?

This site mentions a tool called Nero General CleanTool that Nero released to uninstall their viral product.

Follow The Steps for How To Completely Uninstall Nero 9

1) Download Nero General CleanTool from here.

2) Unzip downloaded zip file and double click on extracted Nero General CleanTool Exe file.

3) Nero Clean tool will popup with listing of installed Nero Products.

4) Select the check boxes next to the Nero products that you want to remove.

5) Click Clean Button to Proceed for Uninstallation of Selected Nero Product.

6) Once finished Reboot your Computer. That's it we have finished with Uninstallation process.

So, I downloaded, extracted, and ran the Nero General CleanTool utility. It found some flavor of Nero and I hit the "Clean" button and it asked me if I was sure and I was like "Not just yeah, but H3LL YEAH!" and then it whirred away for a bit and came back and said "Some filed could not be deleted until you restart" and so I restarted. I want this virus off of my computer in a big way.

Well, that definitely helped. It got rid of a ton of Nero garbage. Didn't get rid of all of it, but much better than before. So, I ran it again and selected "Manual Find" mode and tried click all the buttons so that it would delete every occurrence of the word Nero from my computer for now and ever after and it seemed to act like it was going to do something additional. Now, it wants me to restart again.

From the Major Geeks post:

If you haven't got it, install the MajorGeeks recommended program 'CCleaner' (in its 'slim no toolbar' version): http://www.majorgeeks.com/CCleaner_S...bar_d4191.html
Now open it up and go to 'Registry > and hit 'scan for issues' then after it shows '100% completed' click on 'fix all issues' *but* make sure you say 'YES' to making a back up and save that back up somewhere you wont forget.
Now run a 'Registry > Scan for Issues' *again* to deal with any orphaned entries from the first scan, and make a back up again.

So, I ran CCleaner and it made things much better. I still have some occurrences of "Nero" in my registry, but I suppose there's a price to pay for stupidify.

Update: Idiots at Nero finally replied back to me 7 days after I asked for help removing this bloatware: Here's their precious email:

From: Nero Support [mailto:techsupport@nero.com]
Sent: Monday, October 13, 2008 9:38 AM
To: xx@xxxxx.xxx
Subject: Re: Nero Support Nero ID [4192955008]

Dear Valued Customer,

Thank you for contacting the Nero Support Center.
We are pleased to provide you with the following answer to your inquiry based on the pre-selection criteria you indicated on our website:

The failed installation of Nero 9 on your system cannot be solved with a simple workaround.

To solve the problem we suggest that you uninstall all Nero 9 applications from your computer first and proceed by reinstalling Nero 9 completely. Please proceed with the following three steps:

1. Find your Nero 9 serial number.
2. Uninstall all Nero 9 programs using the Nero General CleanTool
3. Install the latest version of Nero 9

[snip - here, they go on for pages about how to wipe out Nero]

Thank you!

Your Nero Support Team

NERO - SIMPLY ENJOY™
*********************************************************
Nero AG
Im Stoeckmaedle 13-15
76307 Karlsbad
Germany

Vorstand/ Board of Directors: Udo Eberlein (CEO), Charly Lippoth (CTO/CSO)
Aufsichtsratvorsitzender/ chairman of the supervisory board: Richard Lesser
Amtsgericht Mannheim HRB 362519
*******

And, of course, my reply:

Thanks for your prompt reply. I figured out to use the Nero General CleanTool seven days ago. I will never install this bloatware again. Nero suck @ss.

Warm Regards,
Peenie Wallie