Which reg keys to ignore for program installs? (regshot)

Discussion in 'Software' started by On edge, Mar 13, 2009.

  1. On edge

    On edge Corporal

    I want to use RegShot to create a comparison log for new program installations. If I later remove the program, I could then use the regshot log to make sure nothing was left behin (fwiw, I already use Revo Uninstaller). The problem is that there's always some reg activity that has nothing to do with the installation of a new program. Too much noise of this sort can make it hard to go over the comparison logs. Therefore, I'm wondering which registry keys can be safely left out of regshot comparisons to reduce noise without missing important changes?

    Currently my RegShot.ini looks like this:

    Which keys or directories is it safe to add to this type of software comparison log's ignore list?

    p.s. I have "Explorer" on the list for now because the Explorer keys pick up a lot of noise, but I don't think it's safe to ignore changes to them completely either, so I'll change that soon...
     
  2. foogoo

    foogoo Major "foogoo" Geek

    I tried that too, but like you said there are too many reg keys constantly being modded, so I found regfromapp over at Nirsoft.net (this guy is good!!!).
    Run regfromapp, under file select new process and it will monitor changes that app makes.
    I was going to make a youtube video of this app for people who need to archive apps they install, well it is a little more complicated & I don't want to give away the plot, so maybe someday I'll make them and post them.
     
  3. On edge

    On edge Corporal

    I'll check it out, but I would be a bit hesitant to rely on active monitoring because if there's a problem/crash, you will most likely be stuck with having to manually remove the failed installation, which is one of the scenarios when these comparison logs would come in handy.

    My plan is to reduce the noise in regshot logs by adding the noisy keys to the SkipRegKey list. I can also drop the deleted keys (not much I can do about them anyway). And I plan to write an AutoHotkey macro that could create a second log file with the current values for the keys in the regshot log. The idea would then be to first do a regular uninstall with Revo, followed by a check of what reg values were still left from the initial installation...

    That said, I'd be happy to see your youtube demonstration with regfromapp too - seems like a handy tool for portables as well...
     
  4. On edge

    On edge Corporal

    I've been playing around with RegFromApp. I added it to my FileMenu Tools, and launch it from there with cmd line: RegFromApp.exe /RunProcess "%FILEPATH1%" /AutoSave "Z:\_Backups\RegFromAppLogs\%FILETITLE1%_mod.reg" "Z:\_Backups\RegFromAppLogs\%FILETITLE1%_orig.reg", or I run it together with Sandboxie (same command as before, but preceded by C:\Program Files\Sandboxie\Start.exe). I.e. I sandbox the install but extract the recorded registry values before deciding whether to install it for real. (FILEPATH1, FILETITLE1,... are just built-in FileMenu Tools for the clicked file).

    In any case, RegFromApp.exe often fails to capture the action because - I assume - it only monitors the setup or install file I clicked on, but not other files activated by that first one. Is there a way to have it automatically monitor all new processes, or any process activated by the first one? Any other advice?

    As for RegShot, I still use it and like it, but I've been using AutoHotkey to cleanup the output.
     
  5. Cordialis

    Cordialis MajorGeek

  6. On edge

    On edge Corporal

    UPDATE:
    I posted this thread several months ago, but for anyone interested or with similar aspirations, here's what I'm currently doing for installing/uninstalling software.

    1. I use Sandboxie with SandboxDiff and Anti-Del add-ons to first install programs into a sandbox, to see where they would add files and registry values, and to try the programs out. If I don't like the program, I just empty the sandbox and it's gone completely. I also save the SandboxDiff files for uninstall references in case I keep the program. Sandbox installations work maybe 8 or 9 times out of 10 (not working = nothing bad, you just cannot run the program sandboxed).

    2. If I decide to install a program on my system proper, I still use RegShot, but I've written some AutoHotkey scripts to clean up the output.

    3. NirSoft's RegFromApp is also good for first runs. i.e. I start the program with it the first time I run it because that's when many of them write post-install settings into the registry.

    4. As for the keys/folders to exclude (my original query), I've attached the autohotkey script file I use to clean up noise. (%A_WinDir% = C:\WINDOWS, for example and so forth). It's just an example, obviously each user needs to customize their ignore list. I used regshot to take 'control shots' to see what values/files are frequently modified, or to which keys/folder additions are made when I don't install anything. And whenever I do use one of these logs to uninstall something, I see values that had nothing to do with the software, I add them to the list. (I have other AutoHotkey scripts to auto-check if the values still exist post uninstall, do searches based on time stamps (created), and display the output in treeview).

    BUT: My AutoHotkey scripts are still works in progress, and I'm still perfecting my system to monitor programs and such. I'm thinking of trying out VMware too.
     

    Attached Files:


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds