You are here

How can I be sure an app is not leaving stuff in my registry ?

14 posts / 0 new
Last post
billyMass
Offline
Last seen: 10 years 1 month ago
Joined: 2009-07-08 13:03
How can I be sure an app is not leaving stuff in my registry ?

hi

there's a lot of portable apps out there (not only in this site)...or so they claim to be.

one time after downloading and running a "portable" app from some other site (i think it was a .pdf reader) I closed the app, run regedit and searched for junk by the app's name.
I found some entries and I don't mean the "MRU" list.
I saw things in context menu...associated file types... that's NOT suppose to happen with a portable app !
that made me think: is there a way to make sure an app is not leaving stuff in my registry even though it calls itself "portable" ?

I hope you understand what I mean because it's really important to me.

thanks

John T. Haller
John T. Haller's picture
Offline
Last seen: 1 hour 6 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Regshot

You can use something like Regshot ( http://sourceforge.net/projects/regshot ) and snapshot the PC's registry and local hard drive to see what's up. It's one of the tools we use when developing apps and one our testers use to double-check the work.

There will always be some trace in the registry (MRU, random number generator, directx, etc) but we strive to eliminate all app-specific stuff and, technically, an app isn't following PortableApps.com Format if it leaves stuff like that behind. There will be things missed here and there (such as an outlier where an app only creates a local file under a very specific condition) but we generally fix them the release after someone reports it.

Sometimes, the impossible can become possible, if you're awesome!

billyMass
Offline
Last seen: 10 years 1 month ago
Joined: 2009-07-08 13:03
i'll take that advice even

i'll take that advice even though i'm sure there must more methods like one in real time like the one SpyBot is using, "TeaTimer".

here is by the way what I found in the registry for fileZilla:
Key name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList\b
value: FileZilla.exe

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList\a
value: FileZilla.exe
Key name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.log\OpenWithList\b
value: FileZilla.exe

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList\a
value: FileZilla.exe

key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log\a
value: C:\PortableApps\FileZillaPortable\Data\filezilla.log

key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\xml
value: C:\PortableApps\FileZillaPortable\Data\settings\sitemanager.xml

key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\xml
value: C:\PortableApps\FileZillaPortable\Data\settings\bookmarks.xml

is that normal for a portable app ?

qwertymodo
qwertymodo's picture
Offline
Last seen: 11 years 9 months ago
Joined: 2008-03-17 19:08
HKCU\Software\Microsoft\Windo

HKCU\Software\Microsoft\Windows\... is just internal Windows logging and stuff that does not affect the portability of a program and is generally ignored by the PAF spec.

Quamquam omniam nescio, nec nihil scio.

Chris Morgan
Chris Morgan's picture
Offline
Last seen: 8 years 10 months ago
Joined: 2007-04-15 21:08
No no no no no no no no no

Don't ever just ignore HKCU\Software\Microsoft\Windows. Just many things in it. In this instance, it looks like something needs cleaning up.

I am a Christian and a developer and moderator here.

“A soft answer turns away wrath, but a harsh word stirs up anger.” – Proverbs 15:1

Simeon
Simeon's picture
Offline
Last seen: 9 years 6 months ago
DeveloperTranslator
Joined: 2006-09-25 15:15
Really?

I always thought OpenSaveMRU's can be ignored...

"What about Love?" - "Overrated. Biochemically no different than eating large quantities of chocolate." - Al Pacino in The Devils Advocate

Chris Morgan
Chris Morgan's picture
Offline
Last seen: 8 years 10 months ago
Joined: 2007-04-15 21:08
Yes, but not others

System MRUs can be, but not the FileExts stuff. I'm not familiar with stuff in that spot, but it doesn't look good.

Ignoring the HKCU\...\Windows key outright is not wise.

One of these days I might take a look at the Regshot code and add in some sort of ignore list so more normal users can use it without panicking at the mess...

I am a Christian and a developer and moderator here.

“A soft answer turns away wrath, but a harsh word stirs up anger.” – Proverbs 15:1

Ed_P
Offline
Last seen: 5 years 6 months ago
Joined: 2007-02-19 09:09
Running app vs ended app

Some portable apps use the Registry just like regular Windows apps, but PA apps make an effort to remove the entries they add to the Registry when they are exited. Many non-PA portable apps make no effort at all to cleanup the changes they made to the hosts when they are done.

Is your TeaTimer output from a running app or an ended app?

Ed

billyMass
Offline
Last seen: 10 years 1 month ago
Joined: 2009-07-08 13:03
a running

a running app:
http://www.malwarehelp.org/how-to-enabledisable-spybot-teatimer.html

so it's not very effective in the case of a portable app that uses the registry while running and cleans it's shit when it ends.
like FireFox portable version.

NathanJ79
NathanJ79's picture
Offline
Last seen: 4 years 2 months ago
Joined: 2007-07-31 15:07
Plus

billyMassone time after downloading and running a "portable" app from some other site

In addition to the advice above, also be aware that not all portable applications from other sites are entirely legit, but aside from that and even if the app is "legal" (open source, or freeware with permission to distribute) the same care to ensure it's really portable might not have been put into making it.

Just wanted to add that since that point seems to have been overlooked by others.

crookadile
Offline
Last seen: 10 years 3 months ago
Joined: 2009-02-15 09:06
CCleaner

If anything is left over would using CCleaner remove it?

jamcomm
Offline
Last seen: 14 years 7 months ago
Joined: 2009-07-24 14:51
Uninstallers

Can't you download an "uninstaller" type program and see what that thinks?

IIRC, there used to be a lot of them - they run in the background, and when you install something they log what's changed by the installer.

Since they can't tell the difference between and installation program, and normal program, they should be able to tell you what registry settings have changed?

Chris Morgan
Chris Morgan's picture
Offline
Last seen: 8 years 10 months ago
Joined: 2007-04-15 21:08
RegShot

The aforementioned RegShot does that sort of thing, it's just it's more versatile. However, it only tells you what's done, it doesn't claim to be a full uninstaller. In my opinion, it's better than them for making portable apps.

I am a Christian and a developer and moderator here.

“A soft answer turns away wrath, but a harsh word stirs up anger.” – Proverbs 15:1

jamcomm
Offline
Last seen: 14 years 7 months ago
Joined: 2009-07-24 14:51
Unneeded functionality

That would make sense - there's a lot you just don't need in an uninstaller if you just want to find out what's going on e.g. the ability to uninstall is a bit pointless for just getting the information

Log in or register to post comments