AXCEL216 / MDGx Registry HACKs

Comprehensive Windows Registry Guide
+
200+ Ways To Hack Your Windows
9x/NT4/2000/ME/XP/2003 Registry

I will post here ALL New Registry HACKs [in chronological order] every time I'll also add them to REGISTRY.TXT, TIPSXP.TXT, TIPSME.TXT, TIPS2000.TXT, TIPS98.TXT, TIPSNT4.TXT, OSR2TIPS.TXT or AOLTIPS.TXT, all part of my Updated Windows 9x/NT4/2000/ME/XP/2003 + DOS 7.xx/8.00 ©Tricks + Secrets Files [W95-11D.EXE], FREEware.

A MUST: [99.99% FREE(ware)]

Contents:

COMPREHENSIVE WINDOWS REGISTRY GUIDE:
- The Registry
- Registry Structure
- REG Files
- Registry Inconsistencies, Curiosities + Oddities
- Registry Editing Rules
- REGISTRY BACKUP + RESTORE [Win95/98/ME] [separate page]
- RESTORE DAMAGED REGISTRY [Win95/98] [separate page]
- Registry Credits + Links
THE REGISTRY 200+ HACKs LIST

1. COMPREHENSIVE WINDOWS REGISTRY GUIDE

The Registry

DEFINITION: The Windows 95/98/NT/2000/ME/XP/2003 Registry (also called Registration Database) is a complex, unified, system wide, continually referenced during operation database, used for centrally storing, locating, editing and administering system, hardware, software and user configuration information, following a hierarchical structure.
Its role is to replace the text/ASCII based MS-DOS configuration (.BAT, .SYS) and Windows initialization (.INI) files, used by the old MS-DOS 3/4/5/6.xx, Windows 3.xx and Windows for WorkGroups 3.1x (REG.DAT) releases.
Most data from the MS-DOS startup configuration files: AUTOEXEC.BAT and CONFIG.SYS, and from the Windows system initialization files: CONTROL.INI, SYSTEM.INI, WIN.INI, PROTOCOL.INI, NETWORK.INI etc, is now contained into the Registry, together with most of the other system settings. Most Win32 (32-bit) and Win64 (64-bit) specific applications store their initialization and configuration data into the Registry instead of into .INI, .CFG etc files. The MS-DOS and .INI files are kept only for backward compatibility with older MS-DOS and Win16 (16-bit) based programs.
The Registry is stored in binary data format (.DAT), and the information it contains can be accessed (read from/written to) at any time during operation by any Registry aware Windows programs, as needed.

More info @ Microsoft:

MSKB: Description of Microsoft Windows Registry.
MS TechNet: The Windows Registry.
Windows 2000: Registry structure.
MS Technet: Administering Windows NT Registry.
MSDN: Structure of the Registry.
MSKB: Description of Registry Files in Windows 95/98.
MSKB: Description of Registry Files in Windows ME.
MS TechNet: Windows 98 Registry.
MS TechNet: Windows 95 Registry.
MSDN: Registry Value Types.
MS Technet: Working with the Registry.

The Windows 95/98/ME Registration Database is contained in these 5 files, with the Hidden, Read-only attributes for write-protection purposes, usually located in the %WinDir% folder (default is C:\Windows) in stand-alone single-user environments:

SYSTEM.DAT = stores persistent hardware and software settings related to the system it resides on, contained in the HKEY_CLASSES_ROOT (Windows 95 and 98 only) and HKEY_LOCAL_MACHINE Hive keys.
USER.DAT = stores user specific and software settings contained in the HKEY_CURRENT_USER Hive key. If more than one user, then multiple user profiles enable each user to have their own separate USER.DAT file, located in %WinDir%\Profiles\%UserName%. When a user logs on, Windows OS (down)loads both USER.DAT files: the one from the local machine %WinDir% (global user settings), and the most recent one from the local machine %WinDir%\Profiles\%UserName%, or from the central (host) server if user profiles reside on a network (local user settings).
CLASSES.DAT = stores persistent data contained in the HKEY_CLASSES_ROOT Hive key, found only on Windows ME.
SYSTEM.DA0 + USER.DA0 = automatically created backups of SYSTEM.DAT + USER.DAT from the last successful Windows GUI startup, and found only on Windows 95 retail, 95a OSR1, 95B OSR 2.0, 95B OSR 2.1 and 95C OSR 2.5.

This other file is specific only to Windows 95/98/ME and resides usually on the central (host) server in multi-user environments/networks or in %WinDir% on stand-alone multi-user machines:

POLICY.POL = optional, provides additional info specific to the network, and can override certain settings in the Registry, allowing network administrators to control/restrict users access level to network/local computers.
Policy files (.POL) can be created/edited using the Policy Editor tool (PolEdit.exe), found in %WinDir% only on Windows 95, 95a OSR1, 95B/95C OSR 2.x and 98/98 SP1/98 SE(U) systems, if installed as an optional component from the Windows Setup CD-ROM: open Windows Explorer -> right-click on \Tools\Reskit\Netadmin\Poledit\PolEdit.inf -> select Install.
PolEdit requires Administrative privileges.
Microsoft removed the Policy Editor from Windows ME. :(
Get PolEdit.

In Windows 95 retail, 95a OSR1, 95B OSR 2.0, 95B OSR 2.1 and 95C OSR 2.5 the HKEY_LOCAL_MACHINE and HKEY_USERS Registry Hive keys can be backed up manually by using the Configuration Backup tool (Cfgback.exe) found on the Windows Setup CD-ROM in the \Other\Misc\Cfgback subfolder, and also part of Microsoft Windows 95 CD-ROM Extras:
Get CFGBACK.EXE [46 KB, free, unsupported].
On computers with more than one user only HKEY_LOCAL_MACHINE is backed up.
More info.
CfgBack can create up to 9 different compressed Registry backup copies with the .RBK extension. Registry BacKup files (.RBK) must reside in %WinDir%, and can be used exclusively by CfgBack to restore an older set of working Registry Hive keys.
See "REGISTRY BACKUP + RESTORE" to learn how to backup/restore your entire Registry safely.
MSKB: Confirmed CfgBack BUGs:

In Windows 98, 98 SE(U) and ME working Registry files (.DAT) are backed up automatically upon loading Windows by the Scan Registry tool (%WinDir%\Scanregw.exe) into compressed Cabinet files (.CAB = Microsoft proprietary compression technology) found in the %WinDir%\Sysbckup subfolder (default), and holding 5 (default), up to a maximum of 99 different backup copies, a new one being created upon the first successful GUI boot of each new day (the oldest is replaced with the newest). They are named from: RB000.CAB, RB001.CAB, ... up to RB099.CAB. Check their date/time stamp to determine the newest backup set.
Windows 98/ME automatic Registry backup is enabled by this command:

C:\Windows\Scanregw.exe /autorun

found as a String Value called "ScanRegistry" under this Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

See "SCANREGW, SCANREG + SCANREG.INI" for more details.

In addition, SYSTEM.1ST (Windows 95, 98 and ME) + CLASSES.1ST (Windows ME only) are found in the %HostWinBootDrv% folder (boot drive/partition root directory, usually C:\ on uncompressed drives/partitions), as a backup of the first Win95/98/ME SYSTEM.DAT and WinME CLASSES.DAT respectively, created at the end of a successful Setup. These are also Hidden, Read-only files.

The Windows NT/2000/XP/2003 Registration Database is contained in these 6 files located in the %SystemRoot%\System32\Config folder (default is C:\Winnt\System32\Config for Windows NT or C:\Windows\System32\Config for Windows 2000/XP/2003):

DEFAULT = stores the HKEY_USERS\.Default key.
SAM = stores the HKEY_LOCAL_MACHINE\Sam key.
SECURITY = stores the HKEY_LOCAL_MACHINE\Security key.
SOFTWARE = stores the HKEY_LOCAL_MACHINE\Software key.
SYSTEM = stores the HKEY_LOCAL_MACHINE\System key and the HKEY_CURRENT_CONFIG Hive key.
USERDIFF = stores the HKEY_CURRENT_USER Hive key with a correspondent subkey for every registered user,

these 2 files located in the %SystemRoot%\Profiles\%UserName% folder:

NTUSER.DAT (Windows NT/2000/XP/2003) + USRCLASS.DAT (Windows XP/2003 only) = store the HKEY_CURRENT_USER Hive key,

and their automatically created backups from the last known good booting process (successful startup):

SYSTEM.ALT = backup of SYSTEM file above.
DEFAULT.SAV, SOFTWARE.SAV + SYSTEM.SAV = backups of first Hive keys created at the end of a successful (text mode) Setup.

This other file is specific only to Windows NT4/2000/XP/2003 and resides usually on the central (host) server in multi-user environments/networks or in %SystemRoot%\Inf on stand-alone multi-user machines:

SYSTEM.ADM = optional, provides additional info specific to the system, and can override certain settings in the Registry, allowing network administrators to control/restrict users access level to network/local computers.
Administration Template files (.ADM) are in plain text/ASCII or Unicode/ASCII format, and can be created/edited using the plain text/ASCII Group Policy Editor (GPEDIT.MSC) computer management module (GPEDIT.DLL snap-in), found in %SystemRoot%\System32 only on Windows NT 4.0, 2000, XP Professional and 2003 systems.
Microsoft disabled Group Policy Editor from Windows XP Home. :(
GPEDIT requires Administrative privileges.
More info @ Microsoft:
- MS TechNet: Group Policy.
- MS TechNet: Managing Windows XP SP2 Features Using Group Policy.

In Windows NT 4.0, 2000, XP and 2003 the Registry Hive keys can be backed up or restored manually by using the command line Registry Console tool (Reg.exe) located in %SystemRoot%\System32, also part of Microsoft Windows NT4/2000/XP/2003 Resource Kits (RK).
More info.
MSKB: How To Backup, Edit and Restore the Registry in:

BACK 2 CONTENTS

Registry Structure

The Registry consists of 2 basic components (elements):

(Sub)Key: storage container (folder, directory, tree, heading, node). They organize the Registry data in a consistent and hierarchical format. Keys can contain subkeys and/or values. Each (sub)key name is predefined by the system or created by users or Win32/64 (32/64-bit) programs, and consists of most printable ANSI (alphanumeric) characters: 32 - 127, except: asterisk (*), backslash (\), space ( ), question mark (?), non-localized (other than latin alphabet) characters. Key names starting with a period (.) are reserved.
A (sub)key is defined by its complete pathway starting at the root level (main key = Hive Key = HKEY).
NOTE: These examples of Registry (Sub)Keys and Values follow the .REG file rules (more on this subject further below).

HKEY_KEY_NAME = Root Handle/Hive/Main/Parent Key. The Windows 95/98/ME Registry consists of 6 Root Keys under the "My Computer" heading (see further below). Hive Keys can contain one or more Child (Sub)Key(s) (see below).
Example:
[HKEY_LOCAL_MACHINE]
HKEY_KEY_NAME\SubKeyName = Child (Sub)Key. They are nested underneath each other (like branches) following a single or multiple level tree structure (like folders).
Example:
[HKEY_LOCAL_MACHINE\Software]

Value: stores actual Registry data created/modified/used by the system, users and Registry aware Win32/64 (32/64 bit) applications to control hardware, software and user settings. Values (like files) are stored inside (sub)keys (like folders):

"ValueName"=ValueType(API Code #):ValueData

Value Type defines Value Data, displayed in multiple alphanumeric formats.

This is how they appear in the Registry Editor:

LEGEND:
Left hand panel: (1) Main Heading [Tree]
(2) Hive [Root] Key
(3) Sub [Child] Key Right hand panel: (4) Value Name
(5) Value Data
(6) Value Type

LEGEND:
Left hand panel:	(1) Main Heading [Tree] (2) Hive [Root] Key (3) Sub [Child] Key		Right hand panel:	(4) Value Name (5) Value Data (6) Value Type

There are 4 basic (simple) Registry Value types, 3 of them (except REG_QWORD) valid for all Windows 95, 98, ME, NT, 2000, XP, 2003, Vista + 2008 releases, and available in both RegEdit and RegEdt32:
- REG_DWORD [DWORD Value: API code 4] = Double WORD data of 4 bytes (32 bits) in length, in 3 numeric formats: decimal (base of 10), hexadecimal (base of 16) or binary (base of 2).
  This applies to all 32-bit Windows OSes.
  Example:
  [HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\FileSystem]
  "ContigFileAllocSize"=dword:00000800
  There are 2 REG_DWORD Registry Value subtypes:
  - REG_DWORD_LITTLE_ENDIAN [DWORD Value: API code 4] = Windows/DOS OSes are designed to operate on Little Endian computer architecture ("normal order"): a multi-byte value is stored in memory from the rightmost lowest byte ("little end", "low order") to the leftmost highest byte ("big end", "high order"). Example: the value 0x12345678 is stored as 0x78 0x56 0x34 0x12.
  - REG_DWORD_BIG_ENDIAN [DWORD Value: API code 5] = UNIX/Linux/BSD OSes are designed to operate on Big Endian computer architecture ("reversed order"): a multi-byte value is stored in memory from the leftmost highest byte ("big end", "high order") to the rightmost lowest byte ("little end", "low order"). Example: the value 0x12345678 is stored as 0x12 0x34 0x56 0x78.
- REG_QWORD [Binary Value: API code 11] = Quadruple WORD data of 4 bytes (64 bits) in length, in 3 numeric formats: decimal (base of 10), hexadecimal (base of 16) or binary (base of 2).
  This applies only to 32-bit Windows 2000/XP/2003/Vista/2008 (NT based) OSes and to all 64-bit Windows OSes.
  There is only 1 REG_QWORD Registry Value subtype:
  REG_QWORD_LITTLE_ENDIAN [QWORD Value: API code 11].
- REG_BINARY [Binary Value: API code 3] = 8-bit or 16-bit data of any length, in 2 numeric formats: binary (base of 2) or hexadecimal (base of 16).
  Example:
  [HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\FileSystem]
  "Win31FileSystem"=hex:00
- REG_SZ [String Value: API code 1] = Data of any length, in 3 ANSI or Unicode formats: simple text/ASCII (fixed string), expanded (%string% variable string) or extended (multi-string) null terminated string -> see below for 2nd and 3rd String Value types.
  Example:
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
  "Version"="Windows ME"
There are several complex (multiple) Registry Value types (contain multiple or a list of data types of any length separated and terminated by null characters), valid only for Windows NT4, 2000, XP, 2003, Vista + 2008, and available only in RegEdt32:
- REG_EXPAND_SZ [Expanded String Value: API code 2] = in system variable (%string%) format, stores environment variables within strings, accessed by substituting variables with actual system path names.
- REG_LINK [Link String Value: API code 6] = symbolic link in Unicode format between system or software data.
- REG_MULTI_SZ [Multiple String Value: API code 7] = in extended multi-string format, stores an array of empty-string terminated multiple strings into a single Registry entry terminated by an empty-string and a null character.
- REG_RESOURCE_LIST [Resource List Value: API code 8] = device driver and hardware component list of hardware resources stored under the HKEY_LOCAL_MACHINE\HARDWARE\ResourceMap tree.
- REG_FULL_RESOURCE_DESCRIPTOR [Resource Descriptor Value: API code 9] = device driver and hardware component description of nested arrays of hardware resources stored under the HKEY_LOCAL_MACHINE\HARDWARE\Description tree.
- REG_RESOURCE_REQUIREMENTS_LIST [Resource Requirements List Value: API code 10] = device driver and hardware component list of hardware resource requirements stored under the HKEY_LOCAL_MACHINE\HARDWARE\ResourceMap tree.

This is the complete list of supported 32-bit Windows (Win32) OS (x86) Registry Value types:

Value Type	API Code #	Value Description

REG_ERROR	-1	Error request value
REG_NONE	0	Undefined binary value type
REG_SZ	1	Null terminated Unicode fixed string value
REG_EXPAND_SZ	2	Null terminated unexpanded Unicode/ANSI environment string value
REG_BINARY	3	Binary value of any form/length
REG_DWORD	4	32-bit numerical value
REG_DWORD_LITTLE_ENDIAN	4	32-bit numerical value
REG_DWORD_BIG_ENDIAN	5	32-bit reversed numerical value
REG_LINK	6	Symbolic Unicode link string value
REG_MULTI_SZ	7	Array of multiple Unicode strings separated by empty strings and ended by null character
REG_RESOURCE_LIST	8	Device driver list of hardware resources in Resource Map tree
REG_FULL_RESOURCE_DESCRIPTOR	9	List of hardware resources in Description tree
REG_RESOURCE_REQUIREMENTS_LIST	10	Device driver list of hardware resource requirements in Resource Map tree
REG_QWORD	11	64-bit numerical value

Unfortunately most Registry elements have fixed limits:

Registry Element	MAX Allowed Length/Size

(Sub)Key Name	255 characters
Value Name [Win2000/XP/2003]	255 ANSI or 16,383 Unicode characters
Value Name [Win95/98/ME]	255 characters
Value Data [Win2000/XP/2003]	Limited by available RAM
Value Data [Win95/98/ME]	16,383 Bytes [16 KB]
All Values within same (Sub)Key [Win2000/XP/2003]	Limited by available RAM
All Values within same (Sub)Key [Win95/98/ME]	65,535 Bytes [64 KB]

Values larger than 2,048 Bytes [2 KB] should be stored as separate files, and their file names stated in the Registry, for optimal efficiency.
More info @ MSDN.
Do NOT confuse this with the "RegistrySizeLimit" (RSL) Registry DWORD [REG_DWORD] Value used to configure paged database memory pools in Windows NT4/2000, and subsequently removed from Windows XP/2003.
More info.

When you run the Registry Editor (see further below), you'll see the following expandable Registry subtrees, each marked with a plus [+] sign, under the "My Computer" heading (main tree).
To further expand each subtree and view all underlying branches (subkeys), click on the plus [+] signs of the 6 main Hive Keys (HKEY) below.
(Sub)key/(sub)tree/(sub)heading are used here as synonyms.
This layout is a typical example of Windows 95/98/ME Registry:

[+] My Computer
 |
 |--[+] HKEY_CLASSES_ROOT (HKCR): Software settings, DDE, OLE,
 |      drag-and-drop, Win31 backward compatibility, shortcut
 |      settings and subkeys for every defined file association,
 |      also found at HKEY_LOCAL_MACHINE\Software\Classes .
 |
 |--[+] HKEY_CURRENT_USER (HKCU): Currently logged on user
 |   |  configuration settings, also found at HKEY_USERS\Username .
 |   |  Subkeys:
 |   |
 |   |--[+] AppEvents: Assigned system and applications sound events
 |   |      settings.
 |   |
 |   |--[+] Control Panel: Control Panel settings, similar to those
 |   |      defined in SYSTEM.INI, WIN.INI and CONTROL.INI in
 |   |      Windows/WfWG 3.xx.
 |   |
 |   |--[+] Identitites: Created and used by MS Outlook Express 4/5/6
 |   |      and its Address Book. [Thank you Ojatex!]
 |   |
 |   |--[+] InstallLocationsMRU (Most Recently Used): Installation and
 |   |      Startup folders paths.
 |   |
 |   |--[+] Keyboard: Current keyboard layout.
 |   |
 |   |--[+] Network: Network connection settings.
 |   |
 |   |--[+] RemoteAccess: Current logon location settings if using
 |   |      Dial-Up Networking (DUN).
 |   |
 |   *--[+] Software: Software configuration settings for the currently
 |          logged on user, sorted by developer/manufacturer/vendor.
 |
 |--[+] HKEY_LOCAL_MACHINE (HKLM): User independent hardware and
 |   |  software machine specific information: bus type, device drivers,
 |   |  keyboard layout etc. Subkeys:
 |   |
 |   |--[+] Config: System and software configuration.
 |   |
 |   |--[+] Drivers: Used by the Device Manager to keep track of active
 |   |      loaded drivers for hardware peripherals: PnP devices, PC
 |   |      cards, PCMCIA etc. [Thank you Ojatex!]
 |   |
 |   |--[+] Enum: Hardware devices information and settings.
 |   |
 |   |--[+] Hardware: Serial communication port(s) information and
 |   |      settings.
 |   |
 |   |--[+] Network: Information and settings about network(s) the user
 |   |      is currently logged on to.
 |   |
 |   |--[+] Security: Network security information and settings.
 |   |
 |   |--[+] Software: Software specific information and settings sorted
 |   |      by developer/manufacturer/vendor, each stored under its own,
 |   |      separate Subkey.
 |   |
 |   *--[+] System: System startup, device drivers and operating system
 |          information and settings.
 |
 |--[+] HKEY_USERS (HKU): Information about Desktop and user specific
 |      settings for each user who logs on to the same Windows 95/98/ME
 |      system. Each user has a separate subkey here. If there is only
 |      one user, the only subkey is .Default .
 |
 |--[+] HKEY_CURRENT_CONFIG (HKCC): Information about current hardware
 |      profile used by the local computer at startup, pointing to
 |      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current .
 |
 *--[+] HKEY_DYN_DATA (HKDD): Virtual key (exists only in memory)
     |  created every time Windows 95/98/ME initializes: dynamic
     |  configuration data about installed PnP devices. Changes constantly
     |  when hardware devices are added, swapped or removed on-the-fly.
     |
     |--[+] Config Manager: Hardware problem codes and status.
     |
     *--[+] PerfStats: System and network performance statistics.

These 6 Hive Keys (HK) are interrelated: the information contained in HKEY_LOCAL_MACHINE (HKLM) and HKEY_USERS (HKU) (the only 2 "real" keys) appears also in 3 other Hive Keys (also called "alias" keys):

Real Hive Key	Alias Hive Key

HKLM\Software\Classes + HKCU\Software\Classes	HKEY_CLASSES_ROOT
HKU\Username [HKU\.Default if only 1 user]	HKEY_CURRENT_USER
HKLM\Config\Profile	HKEY_CURRENT_CONFIG

The 3 "alias" keys are the Registry equivalent of Windows shortcuts ("pointers"), and their contents derives from the 4 "real" Hive Keys. Any data written to the "real" keys is also automatically registered ("cloned") into the correspondent "alias" keys, but not the other way around.
Any data contained in HKEY_CURRENT_USER (HKCU) overrides any data contained in HKEY_LOCAL_MACHINE (HKLM), therefore any change in HKEY_CLASSES_ROOT (HKCR) is always "cloned" into HKEY_CURRENT_USER (HKCU).
Exception makes HKEY_DYN_DATA (HKDD) ("virtual" key) [Windows 95/98/ME only], which is automatically created during every Windows initialization phase, exists only in the computer's memory, and is automatically erased upon system shutdown.

BACK 2 CONTENTS

REG Files

Windows 95/98/ME/NT/2000/XP/2003 use dedicated files in different (mostly plain text/ASCII) formats: .HTA (HyperText Application), .INF (INFormation), .REG (REGistration), .VBS (Visual Basic Script) etc, to import (insert, merge) and export (save) information into and from the Registry.
Exception: Windows 2000 can import ONLY binary (Unicode) .REG files.
Their purpose is to add, modify or delete Registry (Sub)Keys and/or Values.
See "DELETE REGISTRY KEY/VALUE" to learn how to delete Registry (Sub)Keys and Values in Windows 95B/95C OSR 2.x, 98, 98 SP1, 98 SE(U), ME, 2000, XP and 2003.
More info @ MSKB.
This can be achieved by running them directly from the Start -> Run... box, Windows Explorer (%windir%\Explorer.exe), File Manager (FM = %windir%\WINFILE.EXE) or native/real/true/pure MS-DOS prompt in Windows 95/98/ME (using %winbootdir%\REGEDIT.EXE command line switches = see further below).
This is possible because in all Windows 32/64-bit (Win32/64) OSes REG files are associated by default with the Registry Editor (Regedit.exe) executable, which resides in the main Windows folder (%windir%), listed on the system path.

We will discuss here the most well known and easy to create/modify/use, the "all mighty" .REG file, which can be in:

plain text/ASCII format in Windows 95/98/ME + NT/2000/XP/2003 or
binary (Unicode) format in Windows 2000/XP/2003.

Text .REG files can be easily viewed/created/edited by hand using any text/ASCII editor, like Notepad [%windir%\Notepad.exe, included with all Windows releases, but primitive, and limited to a maximum file size of only 64 KB :(], or any other 3rd party text editor [see "FREE WINDOWS 9x/NT/2000/ME/XP/2003/Vista TEXT EDITORS" for better Notepad replacement tools], eventually by cutting & pasting Registry specific text strings from other sources, like a fragment of, or entire Registry, saved as plain text .REG file by using a Registry Editor.
See "REGISTRY BACKUP + RESTORE" to learn how to backup/restore your entire Windows 95/98/ME Registry safely by exporting/importing .REG files.
Note that Regedit always saves REG files in plain text/ASCII format in Windows 95/98/ME, but in Windows 2000/XP/2003 they are always exported (default) in binary (Unicode) format, unless the user selects a different (text/ASCII) file format from the Export Registry File menu, like the Windows NT4 REG text format, available to both Regedit and Regedt32 in Windows 2000, XP and 2003.

Text/ASCII .REG file structure:

Header line: this FIRST line is mandatory. MUST contain only these exact words (case sensitive = character capitalization required!):
- REGEDIT4 = for Windows 95/98/ME + NT 4.0 or
- Windows Registry Editor Version 5.00 = for Windows 2000/XP/2003.
This is the only way any 32/64-bit MS Windows OS can recognize/validate, run/merge and import/export a .REG file.
Empty (blank) line: this second line is optional. Similar to inserting a carriage return (CR).
Remarked (comment) line(s): optional. MUST begin with a semicolon (;) which may be followed by a space (optional). Can contain Registry (Sub)Keys and Values (which can be disabled this way) or plain text comments/reminders. Windows does NOT process (ignores) remarked lines, treating them as comments. May be inserted anywhere in the .REG file, but NOT before the Header, which MUST be present as FIRST line.
(Sub)Key line: MUST be preceded and terminated by square parentheses ([]). (Sub)Key name MUST start with the Hive Key name (left end) and MUST contain entire Subkey pathway leading to the current Subkey name (right end). Consecutive (Sub)Key names MUST be separated by SINGLE backslash marks (\):
[HKEY_KEY_NAME\SubKeyName0\SubKeyName1\SubKeyName2\etc...]
Example:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
(Sub)Key names not present in the Registry will be automatically created when the REG file is merged into the Registry. Exception: new Hive (Root) Keys can be created ONLY in Windows NT4/2000/XP/2003, but NOT in Windows 95/98/ME.
Value line: MUST contain these elements in this EXACT order:
- Value name: MUST be preceded and terminated by quotation marks ("").
- Equal mark (=): MUST separate Value name from Value type.
- Value type: MUST be specified: dword: [DWORD = REG_DWORD], hex(#): [Binary = REG_BINARY] ONLY IF Value type other than String [REG_SZ].
- (API Code #): MUST be specified as alphanumeric hex value: from 2 [hex(2)] up to 10 [hex(a)] and MUST be preceded and terminated by round parentheses [()] ONLY IF Value type other than String [REG_SZ] (API Code 1) or DWORD [REG_DWORD] (API Code 4 or 5).
  Refer to the complete list of supported Registry Value types further above for details.
- Colon mark (:): MUST separate Value type from Value data ONLY IF Value type other than String [REG_SZ].
- Value data: MUST be in the same format as defined by Value type: text/ASCII, Unicode/ANSI, (alpha)numeric (decimal, hexadecimal or binary) etc. MUST be preceded and terminated by quotation marks ("") ONLY IF Value type is String [REG_SZ].
  Syntax:
  - String Value: hex(1) [REG_SZ] (API Code 1):
    "ValueName"="ValueData"
    Value Data is expressed here in Unicode or ANSI formats: simple text/ASCII, expanded or extended.
  - DWORD Value: hex(4) [REG_DWORD] (API Code 4):
    "ValueName"=ValueType:ValueData
    Value Data is expressed here in Double WORD (4 bytes = 32 bits) formats: decimal, hexadecimal or binary.
  - Simple (8-bit) or complex (16-bit) Binary (hex) Value of any length:
    - hex(3) [REG_BINARY] (API Code 3),
    - hex(2) [REG_EXPAND_SZ] (API Code 2),
    - hex(7) [REG_MULTI_SZ] (API Code 7),
    - hex(8) [REG_RESOURCE_LIST] (API Code 8),
    - hex(9) [REG_FULL_RESOURCE_DESCRIPTOR] (API Code 9) or
    - hex(a) [REG_RESOURCE_REQUIREMENTS_LIST] (API Code 10):
    "ValueName"=ValueType(API Code #):ValueData
    Large Value Data Strings can span onto more than one line, in which case each line (except the last one) is terminated by a comma (,) followed by a SINGLE backslash mark (\) and consecutive lines are separated by carriage returns (CR):
    "ValueName"=ValueType(API Code #):ValueData,ValueData,\
    ValueData,ValueData
    Value Data is expressed here in numeric: binary or hexadecimal, or multi-string (complex) formats: binary, hexadecimal, Unicode or ANSI.
    Consecutive bit pairs (double digits) of data MUST be separated by a comma (,).
  Separators and delimiters used in REG files on path name lines to separate drive letters, directory (folder) names and file names, or used on command line parameters lines etc... MUST be typed as DOUBLE backslash marks (\\).
  Here the first backslash (treated by the Registry as Escape character) is used to tag ("mark") the next character, the second backslash in this case. Regedit interprets in fact these two backslashes as a single one, and only the second backslash is processed as such. The first one is ignored.
  Exception: Registry (Sub)Key path names used in REG files MUST be separated by SINGLE backslash marks (\).
  When the REG file is merged into the Registry (Sub)Keys and Value names not present in the Registry will be automatically created. (Sub)Keys and Value names already present under the same Registry (sub)key(s) but containing different Value type(s) and/or data will be automatically updated to match the one(s) in the REG file.
Empty (blank) line: this LAST line is mandatory for proper operation. Similar to inserting a carriage return (CR) or a line feed (LF) or an end of file (EOF) character to mark the end of file.

This is how a generic text/ASCII .REG file looks like:

-----Begin cut & paste here-----
REGEDIT4

; This is a comment line.
[HKEY_KEY_NAME\SubKeyName0\SubKeyName1\SubKeyName2\etc...]
; String Value:
"ValueName"="ValueData"
; DWORD or Binary Value:
"ValueName"=ValueType:ValueData