Will deleting (Default) entries in registry cause system instability?

2

1

What is the point of the (Default) registry items?

For example, in HKCU\Software\Microsoft\Windows\CurrentVersion\Run:

enter image description here

Is it okay if I delete the (Default) entry?

Will it cause system instability?

Pacerier

Posted 2011-10-14T12:01:52.147

Reputation: 22 232

Answers

5

It depends on which (Default) values you delete, as with any registry value / key / hive.

In addition to all the named values you can create underneath a registry key with the RegSetValueEx function, there is also the so-called default value which you obtain by passing NULL or a pointer to a null string as the lpValue. This default value is also the value set and retrieved when you call RegSetValue and RegQueryValue. What's the deal with this default value?

The original 16-bit registry didn't have named values. All it had were keys, and associated with each key was a single piece of data: a string. The functions that operated on this data were RegSetValue and RegQueryValue, which explains why those functions (1) don't have a lpValue parameter and (2) set and retrieve only string data. Because back in the 16-bit world, that's all you had.

In the conversion to Win32, the registry gained new capabilities, such as storing data in formats beyond simple strings, and storing multiple pieces of data under a single key, using a name to distinguish them. What used to be called simply "the value of a registry key" (for since there was only one, there was no need to give it a name) now goes by the special name the default value: It's the value whose name is null.

There's nothing particularly special about the default value aside from its unusual name. A named value need not exist, and if it exists, the data type could be anything. Similarly, the default value need not exist, and its type can be anything. At this point, it's just a value with a strange name.

MSDN Blogs - The Old New Thing - Why do registry keys have a default value?

Tamara Wijsman

Posted 2011-10-14T12:01:52.147

Reputation: 54 163

Nice link =D btw do you happen to know the purpose of the (default) key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run ? – Pacerier – 2011-10-14T12:50:38.687

@Pacerier: It has no effect there, given that it is excluded from enumeration. – Tamara Wijsman – 2011-10-14T12:59:37.780

@@TomWijsman ok cool – Pacerier – 2011-10-14T13:30:37.357

Like anything about Windows beneath the surface, the obligatory post from The Old New Thing. – surfasb – 2011-10-15T00:46:50.867

@surfasb: Don't make me replace it by a quote from the Windows Internals book. ^_^ – Tamara Wijsman – 2011-10-15T04:45:33.800

@TomWijsman: Now that is a book I wish I could convert into a searchable PDF. . . – surfasb – 2011-10-15T18:58:21.757

@TomWijsman: Whether HKLM\...\Run is any different, but this appears to be included in enumeration(?), appears in msconfig if a value is set and does run the assigned program on boot. Apparently certain malware assign values to the (Default). – MrWhite – 2012-07-21T11:15:03.460