q000075

What registry entries does the product use?

This article applies to: BlackICE Defender.

SUMMARY

This document lists the registry entries used by our products.

DETAILS

Note: Running "blackd remove" command from the command-line will remove the registry entries for you.

Windows NT

HKLM\SOFTWARE\Network ICE\BlackICE

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\blackd.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlackICE

This tells the "Add/Remove Programs" control panel how to delete the program.

HKLM\SYSTEM\CurrentControlSet\Services\BlackICE
HKLM\SYSTEM\CurrentControlSet\Services\black
HKLM\SYSTEM\CurrentControlSet\Services\BlackLoaded

The product contains some subservices which are controlled by these keys.

Win9x

HKLM\SOFTWARE\Network ICE\BlackICE

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\blackd.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlackICE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

The value "LoadBlackd" tells Win9x to run the background "blackd.exe" daemon even before somebody logs in.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

This double-checks to make sure "blackd.exe" is running whenever the user logs on. This is because sometimes Win9x kills programs started in RunServices when a user logs off.

HKLM\SYSTEM\CurrentControlSet\Services\BlackICE
HKLM\SYSTEM\CurrentControlSet\Services\BlackLoaded

Future

In the future, more keys will likely be added. This page will be updated with the details.

Start Menu

Note that whereas "blackd.exe" (the intrusion detection system) starts as a service, "blackice.exe" (the user interface) starts in the "Startup" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.

 
Keywords: registry 
Version:  all 
Fixed:    N/A 
Modified: 1999-11-10