I have the misfortune of encountering a client who has suffered some
registry damage, possibly at the hands of some malware which has now
been dealt with.

He uses XP Pro SP2 and one way or another this user has managed to
disable system restore, so obviously that is not an option. The damage
manifests in that the "add/remove programs" applet in Control Panel
which, whilst well populated, lacks an add remove program button for
everything installed prior to the damage. It turns out that to display
this button, the applet uses information found under HKLM\SOFTWARE
\Microsoft\Windows\CurrentVersion\Uninstall. I feel there is a slight
chance it may be possible to reconstruct this portion of the registry
from information stored elsewhere in the registry.

I have researched this fairly extensively and no registry repair tool
is capable of automatically reassembling this stuff, so it's going to
be a manual process; if you have any information on the process, or
how this may be achieved, please do reply.

....and just in case any future prospective employers find this post:
It wasn't my fault!

Merry Christmas!

On Sun, 23 Dec 2007 22:02:22 -0800 (PST), brigman wrote:

> I have the misfortune of encountering a client who has suffered some
> registry damage, possibly at the hands of some malware which has now
> been dealt with.
>
> He uses XP Pro SP2 and one way or another this user has managed to
> disable system restore, so obviously that is not an option. The damage
> manifests in that the "add/remove programs" applet in Control Panel
> which, whilst well populated, lacks an add remove program button for
> everything installed prior to the damage. It turns out that to display
> this button, the applet uses information found under HKLM\SOFTWARE
> \Microsoft\Windows\CurrentVersion\Uninstall. I feel there is a slight
> chance it may be possible to reconstruct this portion of the registry
> from information stored elsewhere in the registry.
>
> I have researched this fairly extensively and no registry repair tool
> is capable of automatically reassembling this stuff, so it's going to
> be a manual process; if you have any information on the process, or
> how this may be achieved, please do reply.
>
Back-up all data and reformat HDD.

well there is no automatic process to repair the uninstall hive from
registry....
you will have to manually handle this.

"brigman" wrote:

> I have the misfortune of encountering a client who has suffered some
> registry damage, possibly at the hands of some malware which has now
> been dealt with.
>
> He uses XP Pro SP2 and one way or another this user has managed to
> disable system restore, so obviously that is not an option. The damage
> manifests in that the "add/remove programs" applet in Control Panel
> which, whilst well populated, lacks an add remove program button for
> everything installed prior to the damage. It turns out that to display
> this button, the applet uses information found under HKLM\SOFTWARE
> \Microsoft\Windows\CurrentVersion\Uninstall. I feel there is a slight
> chance it may be possible to reconstruct this portion of the registry
> from information stored elsewhere in the registry.
>
> I have researched this fairly extensively and no registry repair tool
> is capable of automatically reassembling this stuff, so it's going to
> be a manual process; if you have any information on the process, or
> how this may be achieved, please do reply.
>
> ....and just in case any future prospective employers find this post:
> It wasn't my fault!
>
> Merry Christmas!
>