hotcore3.sys

Like many a previous user of Acronis ATIH 2010,11,12 I found all the nasty hang-overs of upper and lower filter drivers that would not go away on uninstall, but have managed it now.

Still there, however is hotcore3.sys in an upper filter in key which I believe comes from a trial install of Paragon Backup & recover free 2012. Like ATIH it seems to not properly clean up after itself.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F
and in
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HOTCORE3\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hotcore3
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_HOTCORE3\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_HOTCORE3\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HOTCORE3\0000

Whilst there is no obvious bad effects on my Win 7 system at the moment, I feel the sensible thing would be to remove all those references, especially the CurrentControlSet one. Can anyone confirm that please ?

 

I think you can remove these references- The HotCore driver was designed for Windows 2000. In current Windows versions, the MS service VSS is used instead to create online or "hot" images.

 

Agreed, I have done that OK. There are various other drivers as well which are clearly sourced by other packages I have tried, like Macrium Reflex. For example

pssnap
uim_im
uim_vim
uim_fio
uimbus

Seems to me a bit of a scandal that so many different drivers can be dumped on your system and not removed afterwards.
Having said that I think I understand the reasons why they did use their own file locking package - all those hours of development and testing - and then MS goes and does it all themselves - more hours and hours of finding out how VSS works, changing all your own code, not sure if VSS is as reliable and fast as your own system.

The tragedy is they never removed their own drivers at uninstall, and unfortunate people like me still install on a test basis slightly out-of-date versions, often because they already paid for them.....so certain software houses gain a black mark from me for unprofessional behavior.

 

I certainly agree uninstallers should get rid of all their tracks but I think you'll find most complex programs leave tracks.

I used to get a bit upset about it but I found that the reality was cleaning out unused entries in the registry did virtually nothing for performance improvements and deep-cleaning was risky. There are so many legitimate files in the Windows folder that a few unused ones mean nothing. However, if it bothers you then it bothers you. Of course, if these un-used entries are causing errors to show in the Event Viewer or elsewhere you should address them. Some people like the Revo Uninstaller but you may have to reload the unwanted program for it to find all traces.

The best way to avoid them is to make an image before installing the program to be tested and then if you decide you don't want to use it restore the image and it's totally gone. There are programs that will track registry and file changes (similar to Windows' System Restore) allowing you to roll-back and remove all changes without making an image but I trust the image route more.

 

seekforever, you speak complete sense, and I have actually been evaluating ATIH, Easeus, Macrium and IFW with exactly that in mind. The only problem is the 'forward hindsight' needed to determine which installs I might want to later totally remove. To do imaging before anything is installed is just too much....perhaps....

But I am now thinking bootitBM and the supplied IFD installed to the HD might be the nearest thing to a painless and quick imaging process. I certainly intend to only image the working OS from a booted alternative OS.

There are so many ways that can be done. Even just now, I realised that I could use BootitBM to install another OS (say Linux) and so have two OS's which could image each other with perfect safety.

 

I've had one of the popular registry cleaners destroy McAfee for me.

 

It indeed takes discipline to do an image beforehand when you want to get going and try out the new software and I admit I've done that and later wished I'd had done an image first!

Your comment about "later totally remove" is the fly in the ointment. Since reverting to an image at a much later time will remove the modifications you want to retain. In this situation a roll-back program where the registry entries are removed and files deleted may be a better idea but I can't speak to their effectiveness or their usage after a long period has elapsed. Have a look at Rollback RX and GoBack but I don't know if you can selectively remove one thing or you just reset the whole PC back to that point in time. Acronis had a "Try and Decide" feature for testing but I never used it. While I never had a problem restoring an archive with Acronis the never-ending bugs with each new release and a couple of other issues drove me away from it.

I can't argue about the comparative safety in imaging a static disk but I have used 3 products with live-imaging and have had no problems imaging while Windows is running. I would say the performance is usually higher as well. The ability to make an image without restarting with a different OS or USB/CD environment likely means an image will be made.

 

gbhall,

If you just want to manually see what Registry Entries were changed and then later manually check that they were uninstalled:
I sometimes use the "Registry Snapshot Utility" that comes with my Registry Cleaner (Registry First Aid) to take a Registry Snapshot just before Installing a Pgm and then take another Registry Snapshot immmediately after the Pgm Install. Then it has has an option to compare the 2 Registry Snapshots and show you what was changed in the Registry between the 2 snapshots.

Additional Tools of this type - Registry Before/After Snapshots were reviewed in below link:
http://www.raymond.cc/blog/tracking-registry-and-files-changes-when-installing-software-in-windows/