Deleting registry entries - what happens

Question

I have a program, which deletes some registry entries, which I searched before. The program searches for registry keys, which referring to a DLL, but this DLL does not any more exist on the computer. In short: They are rubbish and I want to delete them. But what I want to know is this:

The number of registry keys which I found is different than the number of keys, which I delete. As an example, in the first search, I found 3880 keys, and there were deleted 2230. I found out, that some keys are written two times. A copy in HKEY_LOCAL_MACHINE and a copy in HKEY_CLASS_ROOT. And when I delete only a copy in HKEY_LOCAL_MACHINE, then also a copy in HKEY_CLASS_ROOT will be deleted (automatically, without my help, in the background). And in my search I search for keys in both HKEY's.

When this is true, then I could search only in one of HKEY's. So I searched for my keys only in HKEY_LOCAL_MACHINE. Now I found 2266 keys and deleted 2230. I made a comparison and found out, that the 36 keys, which were not deleted by me (and also not counted), didn't exist anymore.

So my question is: What happens in the background? My assumptions is, that somes references will be deleted automatically, but is there any rule for it?

Answer 1

HKEY_CLASSES_ROOT is not a hive in itself and is merely a pointer to keys underneath HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER. ergo there is only one key that get deleted. however Windows logically shows these keys as HKEY_CLASSES_ROOT for easier access. This is the same with HKEY_CURRENT_CONFIG.

The content of HKEY_CLASSES_ROOT comes from two sources: HKEY_LOCAL_MACHINE\SOFTWARE\Classes and HKEY_CURRENT_USER\SOFTWARE\Classes.

from: http://technet.microsoft.com/en-us/library/cc739822(v=ws.10).aspx

Answer 2

HKEY_CLASS_ROOT is just a shortcut to HKEY_LOCAL_MACHINE\SOFTWARE\Classes.