
                       Chkunin64, by Randy Hall


If you are reading this, you have successfully un-zipped PRIMO.ZIP.


********************** Documentation ************************

Chkunin is a companion utility for Regshot.
There are two versions of the new Chkunin..
Chkunin-x64-ANSI.exe is the 64-bit version.
chkunin-x86-ANSI.exe is the 32-bit version.

Chkunin_32_XP.exe is the last(?)32-bit version for Windows XP.

To install Chkunin, copy the above files and "CHKUNIN.TXT" (for HELP..) 
to the folder you wish to run it from.
You can rename them to whatever you want. For the rest of this document,
assume you have renamed "Chkunin-x64-ANSI.exe" to "Chkunin64.EXE".

If you want all this documentation available from HELP in Chkunin, copy
this file (Chkunin x64 documentation.TXT) to the same folder and rename 
it to "Chkunin.txt".

To use Chkunin64, you must have Regshot produce it's report in 
ENGLISH and in TEXT MODE.

Once you have installed Chkunin64, the best way to use it is to set up a 
shortcut in the "C:\USERS\userid\SendTo" folder, or 
"C:\Documents and Settings\userid\SendTo" for Windows XP.
For Windows 10, Windows 8, and probably Windows 7, this is in...
"C:\Users\userid\AppData\Roaming\Microsoft\Windows\SendTo".
If you want to add your own app or folder to the SendTo menu, 
it's very simple: Press Win+R to open Run, then enter this command 
into the text box: shell:sendto

To create the shortcut: 
    1: right-click on "Chkunin64.EXE" in the folder where you have put it.
    2: left-click on "Create Shortcut". 
       This will create the shortcut in the same folder.
    3: right-click on the "Chkunin64.EXE" shortcut.
    4: left-click on "Cut". 
    5: Change to your "C:\....\userid\SendTo" folder.
    6: right-click on the "SendTo" folder name.
    7: left-click on "Paste"
Then you can right-click the Regshot Text mode file and send it to Chkunin64. 

Virtually every modern program has an install utility that installs or 
updates files, records data in the Registry, and possibly updates INI files 
or other essential text files. Likewise, modern programs include an 
uninstall utility that should precisely reverse the effects of the install 
utility. When a newly-installed program causes existing applications to 
fail, or when the supplied uninstall utility can't complete its task, 
you need a record of exactly what the original install utility did. 

If you use Regshot to track all your installations, you'll have that record 
when you need it.

Each time you install a new program on your computer, make sure to do so 
under Regshot's tracking system. Then, if something goes wrong, you can 
determine exactly what changes were made during the install.

The Registry changes section lists the Registry keys added, 
Registry keys deleted, Registry values added and values deleted.

If (or when) you remove a program, you have no way of knowing if it removes
all the files and registry entries it created. With Chkunin64 you do.

To use Chkunin64, you must first have Regshot produce it's report in 
ENGLISH and TEXT MODE. 
Chkunin64 will then use the text mode report as input to see if the registry
entries and files added by the program's install have really been deleted.

Chkunin64 produces up to 4 files.
A .BAT file for file delete commands, a .REG file for registry delete commands,
a _MODS.Reg file that can be used to roll back modified values, and an
_ERRORS.TXT file that lists any errors encountered.

If your Regshot text file is called AAA.TXT, Chkunin64's files will be 
AAA.BAT, AAA_MODS.REG and AAA.REG and possibly AAA_ERRORS.TXT.
These files are not automatically run after they are generated. 
This allows you to check what will be deleted, and modify it if necessary 
before you run it.
 
REMEMBER TO BACKUP THE REGISTRY BEFORE YOU CHANGE IT!
I am not responsible if you crash your registry.
See "http://support.microsoft.com/kb/322756" for help.
The relevant part of the article in also in file
"How to back up and restore the registry.txt".

From the "Files added:" section of the Regshot text report, Chkunin64 will
check every file listed to see if it still exists. If it does, a DOS RMDIR
command will be generated in the .BAT file for a folder name, and a
DOS DELETE command will be generated in the .BAT file for a file name.
A DELETE command will not be generated for a file name if it is in the 
previous folder that will be deleted.

From the registry "Keys added:" section, Chkunin64 will check the key to see
if it still exists in the registry. If it does, a REGEDIT command will be
generated in the .REG file to delete the key. Since any sub-keys under a main
key are deleted when the main key is deleted, Chkunin64 will check to see if
a key is a sub-key of a main key. If it is, no delete command is generated.

From the registry "Values added:" section, Chkunin64 will check the key to see
if it still exists in the registry. If it does, a REGEDIT command will be
generated in the .REG file to delete the key. Since any sub-keys under a main
key are deleted when the main key is deleted, Chkunin64 will check to see if
a value key is a sub-key of an added main key in the "Keys added:" section.
If it is, no delete command is generated.

I have found that some registry keys with subkeys will not be deleted and you
will have to use regedit to manually delete all the subkeys before deleting
the main registry key. You could also try my new vbscript program,
"Clean registry.vbs" to see if it does a better job.

For the registry "Values modified:" section, Chkunin64 will check the key to 
see if it still exists in the registry. If it does, a REGEDIT command will be
generated in the _MODS.REG file to restore the key to the previous value. 
Some keys will not be restored. So far, they are...
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed
If you know of others that should not be restored, let me know.
There is a caveat.... this will work if you install and then un-install one 
program at a time, but if you install more than one program that modifies the 
same registry value, there could be a problem if you un-install the first 
program, and then restore the values to the first installed program values. 

Chkunin64 may also produce an error file. An *.ERRORS.TXT file will be created 
if errors occur, especially when checking registry keys.
A message box will tell you if this file is created.

***************************************************************

Some registry entries are in the Legacy section and cannot be deleted 
by running the AAA.REG file. You must modify the registry manually to
remove a Legacy entry:

How to delete a LEGACY registry entry from 
   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\

 1) Start/Run/Regedit
 2) Migrate to the ROOT key and left-click it once.
 3) Left-click on Security/Permissions
 4) Hilight "Everyone" and left-click on the Advanced button.
 5) Hilight "Everyone" and left-click on the View/Edit button.
 6) Left-click on DELETE under the ALLOW column to turn it on.
 7) Left-click OK.
 8) Left-click APPLY, then OK, then OK.
 9) Delete the LEGACY entry under the ROOT key.

You may not want to leave the DELETE authority turned on, so..

10) Migrate to the ROOT key and left-click it once.
11) Left-click on Security/Permissions again.
12) Hilight "Everyone" and left-click on the Advanced button.
13) Hilight "Everyone" that has the DELETE Permission
    and left-click on the REMOVE button.
14) Left-click APPLY, then OK, then OK.

Also, it looks like even though some keys are actually deleted from the 
registry, if you re-run Chkunin64, it says they are still there. 
This happened to me for the following key:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MSISERVER\0000\Control

After I rebooted, the [Control] part of the key was gone, so I assume part of 
the registry may be kept in memory and is not refreshed until a re-boot.


****************************************************************
July 17, 2011.
I have discovered a peculiarity with XP Pro SP3....

I installed a program on my laptop that apparently added folders and files to 
C:\WINDOWS\assembly called
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index49.dat and
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index4a.dat.

After I deleted the program that created the above entries, and ran the
.TXT file through Chkunin64.EXE, it said the folders and files
still existed, but when I tried to delete them, the DEL command said the
folders and files did not exist.
When I browse C:\WINDOWS\assembly, the folders and files do not exist.
This does not appear to happen on my desktop that has the same XP Pro SP3.
I cannot find out why this is happening.
This means you may have something like this happen too.

****************************************************************


You can email me at bitron@islandnet.com if you have any problems 
or questions. Thanks...

