What is Active Registry Monitor?

Active Registry Monitor
© SmartLine, Inc., 2000,2002

for Win95/98/ME/NT/2000/XP

main.gif (605 bytes) What is Active Registry Monitor?

Active Registry Monitor (ARM) is a utility designed to analyze changes made to Windows Registry.

When installing software, you can create a copy of Windows Registry by means of ARM before the installation and another copy after the installation. Later you can compare the copies and see what changes the new software has made.

Besides, you can use ARM to analyze changes occurred to the Registry upon installation of new hardware, to compare respective keys on different machines, as well as to find out which key changes upon change of system settings or of settings in a software you are interested with.
You can use ARM to explore the Registry for the number and types of subkeys in any key.
ARM can be used to search for data of certain types and with certain modification time.
NEW! ARM now supports not only export to REG files, but also import, both in the old format and in the new one (Windows 2000, XP).
Now you can use ARM to compare REG files and to get the results in a convenient and understandable format. This feature is especially helpful when the REG files are big and manual comparing is very difficult.

Unlike Registry monitoring software (such as RegMon and Win-Expose Registry) and most uninstallers (CleenSweep, Uninstall, etc.) ARM compares full copies of the Registry made in different moments of time, whereas the above mentioned software monitor all accesses to the Registry within certain period of time and filter them, that sometimes results in errors, since other applications and system could also modify the Registry during the same time. The main ARM window looks like following:

ARM works with single file where you can store up to 100 scans (we tested up to 50 scans). With this "database" you can do such operations as search and comparison.

The program doesn't support such operations with different files!

ARM searches for differences on all levels: in Keys, in Value Names, and in Value Data. Results of comparison are displayed in three trees (see in Comparing registry copies).

Based on the results of comparison, ARM creates Undo and Redo files in *.reg format.
These files can be used to modify the Registry by switching from the newer copy to the older one and vice versa.
You can also modify registry directly from ARM without creating *.reg files

ARM deals only with root keys HKEY_LOCAL_MACHINE and HKEY_USERS, since the key
HKEY_CURRENT_CONFIG is a copy of HKEY_LOCAL_MACHINE\Config\0000;
HKEY_CLASSES_ROOT is a copy of HKEY_LOCAL_MACHINE\Software\Classes;
HKEY_CURRENT_USER is a part of HKEY_USERS; and HKEY_DYN_DATA is (normally) used by the system only and is of no interest to a user.

To view the current state of a key, or to modify it, you can use Jump to Regedit function.

Contents of any key can be exported to *.reg file.

for technical support: | support@protect-me.com
website: | http://www.ntutility.com/arm/


Registry Scan

First of all, you have to create an initial copy of the Registry. When you run ARM first time, the program will do it automatically and will save results under ARM_DB.rgf name. To do this yourself, make a new file through the File\ New menu item and scan the current state of the Registry to your file by selecting Registry\ Scan menu item or by clicking the Scan Registry button on the toolbar.

Depending on the Registry size and your computer resources, this procedure can take from a few seconds to about a minute (on 486). The procedure duration (in seconds) is displayed on the status bar. Copy of the Registry will be displayed in form of tree of folders. Name of the root folder is the scan date. It is called Main Node.

After scanning you can see properties of any key by clicking right button on the mouse pointing to the node , and selecting Properties.

Attention! Scanning is only possible when a file is opened. The file may be either newly created (empty), or it may contain a number of scanned copies.

ARM can also scan a part of the Registry. If a key other than the Main node is active, ARM will first prompt you to choose what to scan: the entire Registry or a part of it - the current key.

Each newly scanned copy is saved to the file automatically. No more than 2 copies are stored in RAM simultaneously. Copies stored in RAM are called active, their Main Node are yellow. Copies, which are inactive, are displayed with white Main Node. For inactive Main Node Comment menu item is accessible only.

If you want viewing, comparing, searching, and initial scanning options would be possible the Main Node should be active. To switch to active mode, you simply have to open relevant Main Node of the tree. The only process that will take some time is loading data from file to memory.
If you have two active Main Node on the tree opened by that moment, the dialog window appears for choosing a Main Node to be closed (switched to inactive mode).

However, if you have earlier set a relevant option in Settings\ Active Main Node to close, newest or oldest Main Node would be close before opening a new one.

You can add a comment (up to 2000 characters) by clicking right button on the mouse pointing to the Main Node , and selecting Comment.
During the scan process, the machine name, the operation system, and, if a part of the system is scanned, the relevant path (key name) will be added to the Comment automatically).


Tree navigation

Expand

This command expands the currently selected key entry in the tree by showing any subkeys. Any subkeys are also expanded, thereby showing this key of the tree in its entirety.

Collapse

This option hides any subkeys of the currently selected key. Double-clicking on an expanded key also does this.

Goto the same key

Depending on options in [image] Switching mode the function Goto the same key enables to move:
1) to the node of the same name to other tree - copy ( Switching mode \ Switching between same keys in other copies): 10.12.2001 11:09:12\HKEY_LOCAL_MACHINE\HARDWARE ---> 11.12.2001 19:54:35\HKEY_LOCAL_MACHINE\HARDWARE

2) to the node of the same name concerning two defined main nodes (Switching mode \ Switching between same keys of 2 defined nodes) It is possible that main nodes could be in one tree - copy:
10.12.2001 11:09:12\HKEY_USERS\.DEFAULT and 10.12.2001 11:09:12\HKEY_USERS\S-1-5-18 ,
as well as in different:
10.12.2001 11:09:12\HKEY_USERS\.DEFAULT and 11.12.2001 19:54:35\HKEY_USERS\S-1-5-18
The transition "Goto the same key" then will take place from the node:
10.12.2001 11:09:12\HKEY_USERS\.DEFAULT\AppEvents\EventLabels to the node:
11.12.2001 19:54:35\HKEY_USERS\S-1-5-18\AppEvents\EventLabels ,
for example.

This option is useful when you need to examine two nearly similar by structure branches of the registry, however, they have different original paths. If you choose these paths as basic, you could compare the subnodes visually.
You can switch on this option manually - by choosing Switching mode \ Switching between same keys of 2 defined nodes and filling the fields for basic nodes (First/Second defined node) with the help of [image] Insert selected node button.
This option will switch on automatically after completion of function Compare with other key.


Saving to File

All changes in structure (adding / deleting Main Nodes, adding or/and editing Comments) are saved to file (*.rgf) automatically. That is why only Save As menu item is present in ARM. To save structure to other file, choose File/Save As in the menu or click the Save As button.

Saving time is displayed on the status bar.

ARM allows saving up to 100 Registry copies (Main Nodes) in the same file.


Deleting Copies

You may delete any copy (Main Node) as well. To do this highlight the Main Node to be deleted, choose Delete in the context menu and confirm deleting.


Export

A useful feature of ARM is an ability to export any key to a *.REG file, which is a text file. Later you can use this *.REG file to modify local (as well as remote) Registry settings. After exporting a key you may see the layout of the *.REG file by simply opening it in an editor by clicking [image] (to choose an external editor, which will be used for revision, click on External Editor tab of the Settings window).

To export a key to a *.REG file by means of ARM select the key, then from the File menu choose Export to REG File, define a filename, and save it.

ARM is capable of exporting data both into the old format (supported by regedit 4), and into the new format (Unicode, supported by regedit 5)
You can choose the export format by setting one of the following rules from Oprtions\Settings \ Editor, Import, Export & Logfile:
Auto - (the regedit5 format is used for Win 2000 and newer, and the old format is used for older Windows versions);
Ask for confirmation - you will have an opportunity to choose the format for each export action
New (W2000 + ...) - the regedit5 format
Old - the regedit4 format

If you open this file in an editor (as it was described above) you will see a text similar to the example below:

Windows Registry Editor Version 5.00
; ARM - 09.08.2002 14:51:23\HKEY_LOCAL_MACHINE\SYSTEM\Setup
[HKEY_LOCAL_MACHINE\SYSTEM\Setup]
"CmdLine"="setup-newsetup"
"SetupType"=dword:00000000
"SystemPartition"="\\Device\\HarddiskVolume1"
"SystemPrefix"=hex(03):d2,03,00,00,00,c0,3c,18

The layout is quite simple: Windows Registry Editor Version 5.00 indicates the file type,
; ARM - 09.08.2002 14:51:23\HKEY_LOCAL_MACHINE\SYSTEM\Setup is a comment,

[HKEY_LOCAL_MACHINE\SYSTEM\Setup] indicates the key the values are from,
"SetupType"=dword:00000000 is the value itself. The portion after the "=" varies depending on the type of value:
String, Binary, or Dword.


Import

To import a key to a *.REG file by means of ARM select the key, then from the File menu choose Import from REG File, choose the filename, and import it into the ARM internal format.
The file being imported may be either in the new or in the old format. You will get one more main node containing the REG file data - data from one of the keys.
Now you can compare the imported key to respective keys from earlier copies, as well as to the current Registry


Additional Information about Registration files

If you wish to export the entire Registry, select the active main node of the tree. Note that only the rootkeys HKEY_LOCAL_MACHINE and HKEY_USERS get exported because all other rootkeys are included (they can be found as subkeys of any of these two rootkeys).

Warnings about Registration (REG) files

You can use RegEdit-compatible registration files to create distributable registry scripts but not to backup or to store data. Because of bugs in all existing regedit.exe versions, certain registry values exported into a registration file may remain ignored when reimported. This problem exists with both ANSI and UNICODE REG files.

It is also possible that certain registry keys do not get exported because the user who is currently logged on may have insufficient permissions to read them. Typically, a reg file does not contain any information on security, permissions and ownership when running on Windows XP/2000/NT.

CAUTION: You have to know that if you ever accidentally double-click on a *.reg file, its content will merge into your Registry. To prevent this, open Windows Explorer (My Computer) select View/ Options menu (for Windows XP/2000 - Tools/Folder Options). On the File Types tab scroll to Registration Entries and select it. Click the Edit button. In the Actions list, select Edit and press the Set Default button.

These actions change the default behavior so that double-clicking a *.REG file will open it in notepad. If you want to merge it with the Registry, click mouse-right-button and select Merge from the menu.

Windows 95,98: in rare circumstances, when the Registry is badly corrupted, you can start the computer using the Windows 95 startup disk. Then you can use the real-mode REGEDIT.EXE utility on the startup disk to import a *.REG file. In this case, the following command syntax can be used at the command prompt.

regedit [/L:system] [/R:user] file1.reg, file1a.reg...

regedit [/L:system] [/R:user] /c file2.reg

Parameter Description

/L:system Specifies the location of SYSTEM.DAT.

/R:user Specifies the location of USER.DAT.

file1.reg Specifies one or more .REG files to import into the Registry.

/c file2.reg Specifies the .REG file to use to replace the entire contents of the Registry.

CAUTION: Use the !!!(regedit /c) option with extreme care, and only when you are sure that the specified *.REG file contains a complete image of the Registry.


Comparison

ARM compares the following objects:

- whole of different registry copies
- the keys from different registry copies with identical paths
- different keys (with different paths) from one registry copy or from different copies
- definite key of the registry copy with current state of this key

You can exclude certain keys from comparison see "Exclude from comparison "


Comparison of different registry copies

Compare button and menu item are operable only when 2 Main Nodes are active. So, when you want to use this option you should have at least 2 scans of Registry in the current file (see. Registry Scan ))

You can choose any key for comparing, when you click the Compare button. If the relevant key exists in another active tree the procedure of comparison will be accomplished, otherwise the following message will be displayed: "Appropriate node does not exist :..".


Comparison of different keys in one or in different copies in registry

Such a comparison is useful for revelation of distinction in keys similar by structure but different in names - paths, for example:
HKEY_USERS\.DEFAULT and HKEY_USERS\S-1-5-18.
Such a comparison is possible to do in one copy or in different copies.
To compare the selected key with the other one press Compare with other key button. After you see the message "choose the second key for comparison", it has to be already opened, because ARM will choose the next key selected by you for comparison.
Now you have to defined the main ("root") key from these two keys, i.e. the key about which the results of comparing will be distributed in the "Compare window " - the keys, which will appear in the "Added" and in the "Deleted" tabs.
After that you will see the window with the results of comparing.


Comparison of key of the registry copy with current state of this key

You may compare any key from previously scanned copy of registry with its current state in the registry with the help of Compare with current registry button and menu item.
With all this going on the new scanning take place with creation of copy of this key (it will be written down into the RGF file), and then operation of comparing is going. If there are no differences, and you need not to store the newly scanned key, don't forget about Deleting Copies.


Comparison window

One copy is always newer than the other – it is marked as New, and the older one is marked as Old. When comparing is finished, a window with three (or less) trees appears:

1) "Deleted - xx" – this is a tree showing deleted Keys and Value Names, i.e. those ones that used to be the old copy of the Registry, but were not found in the newer one.

2) "Added - xx" – this is a tree showing added Keys and Value Names;

3) "Distinction in data - xx"– this is a tree showing changed Value Data.

In the first tree - "Deleted - xx" (xx = number of keys and value names missing in the new copy as compared to the old one) deleted Keys are marked by a yellow bulb [image] , all their subkeys are marked by a gray bulb [image]. The Keys marked by a green bulb [image] are those from which some Value Names were deleted. Only Value Names not found in the new copy are shown there. Subkeys which are remained the same are not shown.

Similar notation system is used in the second tree ("Added - xx"). The only difference is that Keys and Value Names present in the new copy and not found in the old one are shown here.

Analyzing this tree after installing of new software is helpful to understand whether there is a Trojan, or whether the software made illegal changes in critical Registry areas.

In the third tree ("Distinction in data - xx") only differences in Value Data are shown. Here !!!(xx) is a total number of pairs, where differences in Value Data were found. The Keys where such differences were found are marked with a green bulb [image]. The data with the same Value Names are shown in columns and marked with the digits 1 and 2 for the old and new copy respectively. Icons showing data type look similar to icons in the Registry Editor, except for the digital type is divided into the three subtypes: 1 - Double word; 2 - Binary; 3 - Multi size. You can see the corresponding numbers in the bottom-right corner of icons.

If the Open selected key in other tree box is checked in Settings/Comparison, then when you switch to a tree under comparison the same key, that was selected in previous tree, would be opened (provided it exists in a tree you're switching to).

You can run case sensitive/non-sensitive comparison by checking/unchecking the Case sensitive box. This option works for Key and Value Name and doesn't work for Value Data.
Comparison for Value Data is always case-sensitive.

By choosing Locate in Old [image] or Locate in New [image] in the context menu (depending on the active tree) of the selected Key, you can go to the corresponding source Key in the main window.

Upon double-clicking on a data string the Copy String window appears, where you can copy Value Name and the Value Data.


Registry Scan on a Remote Machine

To scan remote machine Registry successfully, both machines (local as well as remote) must be configured properly. Consult User Manual for Operation System. For NT, Windows 2000, you should have privileges of a remote machine admin.

Criterion of proper configuration is possibility to access remote Registry from Regedit / Regedt32.

Warning! Direct change of functions Undo / Redo works only for local machine - all changes will be done to local machine!

It is possible to use logfile while scanning. If logfile is used, all error messages are saved in logfile instead of being displayed on the screen, so, you could save your time not reading and answering all those messages. This might be helpful with Registry scanning under NT / 2000, when many keys are not permitted to read and the warning messages appears.

Logfile can be specified on External Editor & Logfile tab in the program Settings.


Bookmarks / Exclude Lists

/

Bookmarks and Exclude From Comparison are lists of keys (paths) of the Registry. These lists are similar in their functions. Moreover, one and the same list can be used both as Bookmarks and as Exclude From Comparison. The only difference is that Exclude From Comparison list affects on results. The keys in current Exclude From Comparison list are excluded from process of comparing, i.e. comparison is not done for them. Current mode is set by Bookmarks / Exclusion Lists selections in the Settings / General window.

You can create as many Lists as you want, and use different lists depending on the current task.

You can view and edit any key in the Bookmarks / Exclude From Comparison window. All changes for list and tree and vice versa are done simultaneously.

Exclude List ScreenShot

The following operations are possible for current list:

1) There are two possible ways of adding key into a list:

- highlight the desired key of the tree in the main window and use function Mark key (check) / Exclude from comparison (check) of the context menu. The chosen key will be marked with [image] /

- specify the key (path) in the Key combobox of the Bookmarks / Exclude From Comparison window and click the Add button.

While adding a key into the list it will be verified on multiplicity. It means that when subkeys of newly added key already exist in the list the ARM offer to delete them. Or when adding a subkey of the key already existed in the list the ARM does not add it and informs you about it.

If you want to save the marked / excluded data, you should create a new List (see below).

2) There are also three possible ways of removing a key from list

- unmark the marked key by using function Mark key (check) / Exclude from comparison (check);

- highlight the key in the list of Bookmarks / Exclude From Comparison window and click Delete.

- you can unmark all the marked subkeys of the active key by clicking UnMark / UnExclude All Subkeys button.

3) Replacement. In fact, this the way you can edit the highlighted key - its path or description To do that, edit the Key and/or Description comboboxes of the active key in the Bookmarks / Exclude From Comparison window. To apply changes, click Replace.

4) You can add or edit description for the active key in the Description field by clicking the Add Description button.

5) To view all marked subkeys in the active key, click Expand Marked Keys button

Having marked a certain key in certain tree, you also mark all the keys with the same paths in other trees.

Depending on the option Jump to < > opened tree on the tab Settings / Comparison, double-clicking a line in list opens the relevant key in the first or in the second active Main Node. If the key with the specified path does not exist Jump to < > opened tree could not be accomplished (no key is opened). You can check whether a key contains any marked subkeys using the Expand Marked / Excluded Keys button. To remove all the marked subkeys in a key from the Bokmark / Exclusion List, use the UnMark / UnExclude All Subkeys button.

The following operations with lists are possible:

1) You can create a new list. To do this, a new list name should have been put into the Bookmarks / Exclusion List combobox in the Bookmarks / Exclude List From Comparison window. Use Registry/ (Bookmarks / Exclusion List) menu to open the window, click the Add New List button and enter name of the new list in the List Name window, which appears on your screen, and confirm it.

If you don't enter any name, the list you create won't be saved till the next session. This might be helpful when you want to create a list for one session and don't be concerned with deleting it.

2) You can delete the active list in the Bookmarks / Exclude From Comparison window (the active list is shown in the Bookmarks / Exclusion List combobox) by clicking the Delete List button.

3) You can copy the active list by clicking the Copy List button.


Undo and Redo in ARM

In ARM Undo is used for:
- the Registry roll-back to some previous state
- programs and hardware uninstalling
It is helpful to use Undo as an uninstaller when installed program has not uninstaller itself or when its uninstaller works incorrectly, i.e. removes its keys and values from the Registry incompletely.

Redo is used for:
- the Registry roll-back to its previous state after using Undo
- programs and hardware installing
It is advisable to use Redo as an installer by system administrators, when it is necessary to install one and the same program on several users’ PCs.

Undo and Redo are available only from Compare window. To generate Undo/ Redo for chosen keys use function of comparing for certain key and possibility to exclude some subkeyes from comparing. There are two Undo/Redo methods in ARM.

The first method is creation *.REG files and execution them later independently from ARM, e.g. with Windows Explorer. You can apply this method by pressing buttons with hints Save to Undo files and Save to Redo files in Compare window.

In addition, these files can be used for:
- viewing changes in text format (unlike the trees, presented in ARM)
- storing changes compactly independently from ARM
- editing prior to executing.

Executing *.REG files doesn't always produce excellent results due to some bugs - limitations - in programs which process these files. For example, too long lines are truncated. Or, if the key has Value Name = (Default), and Value Data = (value not set) it is impossible to restore the value (Default) - (value not set) without deleting the key.

That is why Undo and Redo functions that change the Registry directly were introduced. They employ the second method. In Compare window they are represented by buttons with hints Undo into Registry! and Redo into Registry!


How Undo and Redo works in ARM?

What will occur to the Registry after executing *.REG files or after using the function of direct Registry changing - Undo/Redo into Registry!?
Undo modifies the Registry key, including its subkeys, for which comparison was done. This key becomes absolutely similar to the key from Old copy of the Registry.

Undo modifies the Registry in the following ways:
- removes from the Registry keys marked with yellow bulb [image] as well as values in the green bulb [image] marked keys on the Added tab
- adds keys and values marked on the Deleted tab to the Registry
- changes data "2" to data "1" in values on the Distinction in Data tab.

Redo modifies the Registry in the following ways:
- adds marked keys and values in the marked keys on the Added tab to the Registry
- removes marked keys and values on the Deleted tab from the Registry
- changes data "1" to data "2" in values on the Distinction in Data tab.


Creating Undo/Redo Files

/

Undo/Redo files can be created only from Comparison window by clicking Save to Undo files or Save to Redo files button. These *.REG file is created in text format required by your system.

*.REG file begins with DELETE section, which is followed by ADD section
Delete section of Undo.REG file contains Keys and Values, which will be removed from the Registry, found in the New copy and not found in the Old one.
Add section of Undo.REG file contains Keys and Value Names found in the Old copy and not found in the New one, as well as Value Data from the Old copy modified in the New one.

Redo files are created in the same way, but their function is reverse.
Delete section of Redo.REG file contains Keys and Values, which will be removed from the Registry, found in the Old copy and not found in the New one.
Add section of Redo.REG file contains Keys and Value Names found in the New copy and not found in the Old one, as well as Value Data from the New copy modified in the Old one.

CAUTION! Use Undo/Redo files to modify the Registry only when it is absolutely necessary, having checked them before, if possible. Make sure you’ve backed up the Registry files (system.dat, user.dat, system.da0, user.da0) before using Undo/Redo files.


Undo/Redo functions

/

Undo function is advisable to use provided the "New" copy is actually new, i.e. newly scanned, and reflects the current state of the Registry. Only in that case the proper return to the previous version of the key would take place. If time since last scan exceeds 10 minutes, you will see the warning. Of course, the time limit (10 minutes) is not a criterion reliable enough to ensure that the key is up-to-date, it might be as well you to control this yourself.

So, if you have scanned a new copy of the Registry and immediately ran comparing, without having been switched to any task before comparison, you may well admit that you have compared current state of the Registry to some previous state. Should it be necessary, you can return to that previous state correctly.

You may ask, why Undo is available when the "New" copy is not up-to-date? The answer is that it is not always necessary to change only fresh version, you may well need to change some old ones. For example, if you compare copy of the Registry scanned before installation of a program to the copy scanned after it, Compare function shows changes that appeared due to installation of that program. In that case Undo removes only changes caused by the program installation.

Contrariwise, Redo in this instance does the same changes to the Registry, as installation of the program did.

Unlike Undo, Redo is time senseless i.e. gives no warning if the time since New copy scan exceeds 10 minutes.

In general, it is advisable to use Redo only when settings of a program are damaged and you want to restore them and have the Registry copies scanned prior to installation of the program and after it.


Command Line

Only scan function is available from command line so far.

Command line syntax:

arm/<command> <RGF-file>.rgf {-o|-a}[-b][-m:\\<remote machine>][-l:<logfile>]

<command>
s - Registry scan

<RGF-file> - is a file where registry scan will be saved, it must have RGF extension. This may be either a new file, or a file that contains some scans already

<Switches>
-o if file (RGF) exists, overwrite
-а if file (RGF) exists, add to the end of file.
-b if file exists, create its backup (*.bak)
-m scan registry of a remote machine named "remote machine".
-l if any errors occur while executing the command, they are saved in file named "logfile"


Search

As compared to search options of Registry Editor an additional Case sensitive search option is presented in ARM. Duration of search is several times shorter. You can search in all copies displayed in the main window at once.
You can search in Comparison window independently from searching in main window.

Results of search are displayed as lines containing the Keypath and, probably, the Name and Data. By double clicking on the line you can open a tree in the respective Key, if the Main Node shown in the line is not active at that moment, it is opened, which takes some extra time.

If you enter key path in the Find combobox, clicking the FindPath button will bring you to the main window of the relevant key.

Find Main screenshot

On the Advanced criteries tab you can set such search criteria as data type, and in NT- based systems you can also choose certain modification date range.
This feature might prove helpful if you are interested only in recent changes in the Registry.
If the Find combobox is empty, ARM will search for all data complying with the specified criteria.

Find Advanced screenshot

The only difference for search in Comparison window is that there is a new field Tree showing in which tree the object was found Deleted, Added or Distinction in data)


Jump to RegEdit

If you want to modify or view current state of a key in Regedit, you can do it by clicking Jump to Regedit button on the toolbar. ARM will launch Regedit (if it hasn’t been already launched) and navigate directly to the appropriate key. Note, that if you select a non-existent value or key ARM will take Regedit to a position as close as possible to where the key would be located.


Notes about ARM functionality under NT, Windows 2000, XP

In NT, some keys are inaccessible by default for reading/changing even for administrator.
Some keys are permitted to read but not permitted to change. So, Undo/Redo functions don't work with such keys.

To change key permissions, use Regedt32 (Regedit under XP), however, you must have appropriate privileges, of course.

It is possible to use logfile while scanning. If logfile is used, all messages are saved into logfile instead of being displayed on screen:

Logfile can be specified on External Editor & Logfile tab in the program Settings.


ARM Usage Examples

1- You can use ARM to find out what keys in the Registry are responsible for certain
   settings of the system or of a program. To do that, create copy of the Registry before
   changing any settings and after doing it, and then compare the copies.

2- If you have problems with a program that uses Registry to save its settings, you can
   solve them with ARM.

   Method 1 (most reliable): you need two copies of the Registry
   (it is assumed that Registry copies are saved in one file) - one created
   before installing the program (Old), and the other created after installing and
   configuring the program (New).
   Should any problems occur while the program works, you can restore its settings, which it has immediately after
   installation.
   To do that, compare the Old and the New copies and make Redo from Comparison window.

   Method 2: You need a copy of the Registry created when the program worked
   properly (Old).
   When a problem occurs, create a New copy of the Registry and then find out what keys are
   related to the program (keyword search might prove helpful). Then highlight appropriate
   part of the Registry (key), and, probably using List of Exclusion, compare the New and the Old copies
   by keys related to the program. Make "Undo" from the Comparison window.
   This method of comparing is helpful when there are not too many differences between the
   copies.

3- Function of generating *.REG files based on revealed differences might prove helpful
   when you install the same software on many PC's. Install software on one machine, having
   made Registry copies before installation and after it, compare the copies, and generate
   *.REG file of differences from the Comparison window.
   You can install this file on the other machines. Thus, the only thing you will have to do
   is to copy necessary files to complete the installation.

4- You can compare standard REG files using the import feature


Active Registry Monitor. Help

Active Registry Monitor
© SmartLine, Inc., 2000 - 2002

END-USER LICENSE AGREEMENT FOR Active Registry Monitor (ARM):

 - All copyrights to ARM are exclusively owned by SmartLine, Inc.

 - Anyone may use this software during a trial period of 30 days only,
   on one computer of a local network, at any single time. Following this
   trial period of 30 days, if you wish to continue to use ARM then
   you MUST register.

 - A registered user is granted a non-exclusive license to use ARM
   on one computer at a time, for any legal purpose. The registered
   ARM software may not be rented nor leased, but may be permanently
   transferred, if the person receiving it agrees to the terms of this license.
   If the software is an update, the transfer must include all updates and all
   previous versions of the ARM software.

 - An unregistered, evaluation version of ARM may be freely
   distributed, provided the distribution package is not modified. No person
   nor company may charge a fee for the distribution of ARM without
   written permission from the copyright holder SmartLine Inc.

 - To register, you must complete the registration form and send it, with the
   registration fee, to one of the authorized registration sites.

 - ARM IS DISTRIBUTED "AS IS". NO WARRANTY OF ANY KIND IS EXPRESSED
   OR IMPLIED. YOU USE IT AT YOUR OWN RISK. THE AUTHOR OR SMARTLINE, INC. WILL
   NOT BE HELD LIABLE FOR DATA LOSS, DAMAGES, LOSS OF PROFITS NOR ANY OTHER
   KIND OF LOSS AS A RESULT OF OR WHILE USING OR MISUSING THIS SOFTWARE.

 - You may not use, copy, emulate, clone, rent, lease, sell, modify,
   decompile, disassemble, otherwise reverse engineer, nor transfer the
   licensed program, nor any subset of the licensed program, except as
   provided for in this agreement. Any such unauthorized use shall result in
   immediate and automatic termination of this license and may result in
   criminal and/or civil prosecution. All rights not expressly granted here
   are reserved by SmartLine, Inc.

 - Installing and using ARM signifies acceptance of these terms and
   conditions of the license.

 - If you do not agree with the terms of this license you must remove
   ARM files from your storage devices and cease to use the product.