Application/install monitoring utility with registry export

[dlimanov]

Maybe the Wilders' wisest can help me here. I am looking for a utility (a freeware, hopefully) that would monitor an installation or running a specific program (Windows Installer Cleanup Utility in my case) and records all of its actions (file, Registry, etc.), but most importantly will allow me to export Registry changes to a REG file that could then be run on another system.
So far the only program that I know that can do it is Total Uninstaller Pro, and I would gladly pay $40 fee for a registered version, but it's per-machine and I'm using VMs that get rebuilt hundred times over, so it does me no good. Revo Uninstaller in both Free and Pro versions doesn't have this, my other searches returned nothing either.
Any ideas? Thanks in advance!

[dlimanov]

-{ Quote: "have you tried total uninstall here is the link for the last freeware



http://www.321download.com/LastFreeware/page11.html#Total Uninstall" }-

I did use Total Uninstall Pro and it does what I need, but it's per-machine license, which doesn't work for me.

[Pedro]

Perhaps this?
http://www.nirsoft.net/utils/reg_file_from_application.html

[dlimanov]

-{ Quote: "Perhaps this?
http://www.nirsoft.net/utils/reg_file_from_application.html" }-

Pedro, this is awesome! I am going to test it right now, it might just do the trick! Any chance you know of similar tool that does the same on file level?
Thanks a million!

[dlimanov]

Spoke too soon, Windows Installer Cleanup Utility actually spawns up Msizap.exe, which is doing all the work. It's a daemon-like behavior, where Msizap.exe loads, does it magic and exits. Unfortunately, RegFromApp doesn't catch this second process invocation and doesn't log anything.
Damn it, I was all excited there!

[Pedro]

Try Installrite, until i remember some other one :) :
http://www.epsilonsquared.com/

It's freeware for personal use at least, but no idea on commercial usage. I belive it creates an .exe which works with files as well.

[Pedro]

Similar thread:
http://www.wilderssecurity.com/showthread.php?p=1591981

[dlimanov]

Hi Pedro,
Thanks for the pointers. Unfortunately, none of the programs in the other thread will export registry changes to REG. Some will export to TXT file, most won't export at all -- I've tried them all! :-)
RegFromApp looked excellent and I did get it to catch child MSZAP process, but it's too slow to catch ALL registry changes that are done by the raw MSZAP process to registry directly, it missed about half of reg entries Cleanup Utility removed.
So far looks like Total Uninstaller Pro is my only choice, unless others have any more ideas.
Thanks guys!

[Pedro]

Can i throw a few and you report back if it works for you? You got me interested, but i don't have time to test it.
http://www.majorgeeks.com/What_Changed_d5018.html

[2good]

the link I sent you is a freeware.

[dlimanov]

-{ Quote: "Can i throw a few and you report back if it works for you? You got me interested, but i don't have time to test it.
http://www.majorgeeks.com/What_Changed_d5018.html" }-

Yep, I tested this one as well: it also displays changes, but you can't export them to REG, so they can be tested on another machine.
Keep'em coming, I might have missed something. :-)

[dlimanov]

-{ Quote: "the link I sent you is a freeware." }-

I don't think I received anything. Was it a PM?

[2good]

here you go

http://www.321download.com/LastFreeware/page11.html#Total

[Pedro]

-{ Quote: "Yep, I tested this one as well: it also displays changes, but you can't export them to REG, so they can be tested on another machine.
Keep'em coming, I might have missed something. :-)" }-
One thing i'm thinking about is, you could email RegFromApp's author, Nir Sofer, and tell him your problem. I think he would be interested, and possibly enhancing the utility. That guy can code i kid you not!

[dlimanov]

-{ Quote: "here you go

http://www.321download.com/LastFreeware/page11.html#Total" }-

Thank you, 2good, but it looks like old version exports results in plain text only. It would've been OK for few keys, but I'm looking at few hundreds -- not something I can do by hand from TXT file.

[dlimanov]

-{ Quote: "One thing i'm thinking about is, you could email RegFromApp's author, Nir Sofer, and tell him your problem. I think he would be interested, and possibly enhancing the utility. That guy can code i kid you not!" }-

I will, but I actually need something resolved by Monday morning, hopefully, so time is of the essence.

[Pedro]

Regshot Unicode (http://regshot.ru/20/); Google translate (http://translate.google.com/translate?hl=en&sl=ru&tl=en&u=http%3A%2F%2Fregshot.ru%2F20%2F)

A forum discussion where they also mention another Regshot version by 'Paraglider'. But judging from the description, i would try Regshot Unicode first.
http://www.msfn.org/board/new-regshot-alike-tool-out-added-capabilities-t114616-pid-829176.html&#entry829176

The webpage is so obscure, and not written in english, that i used Virustotal on the file.

~ Snipped VirusTotal Link per Policy (http://www.wilderssecurity.com/showthread.php?t=180057) - Reporting Results 0/41 Would Have Been Enough ~

I don't have time to try it out and say anything really, and i don't know why this program isn't discussed that often.

[dlimanov]

-{ Quote: "Regshot Unicode (http://regshot.ru/20/); Google translate (http://translate.google.com/translate?hl=en&sl=ru&tl=en&u=http%3A%2F%2Fregshot.ru%2F20%2F)

A forum discussion where they also mention another Regshot version by 'Paraglider'. But judging from the description, i would try Regshot Unicode first.
http://www.msfn.org/board/new-regshot-alike-tool-out-added-capabilities-t114616-pid-829176.html&#entry829176

The webpage is so obscure, and not written in english, that i used Virustotal on the file.

~ Snipped VirusTotal Link per Policy (http://www.wilderssecurity.com/showthread.php?t=180057) - Reporting Results 0/41 Would Have Been Enough ~

I don't have time to try it out and say anything really, and i don't know why this program isn't discussed that often." }-

I guess it helps to understand Russian sometimes. This program is legit and totally awesome. It caught all reg changes by doing a comparo between two snapshots and created an undo/redo reg files for both.
My day is saved, I'm moving forward. Thanks a lot to everyone who responded, especially Pedro: you, sir, are amazing!

[Pedro]

Thank you for the kind words :)
I'm just a guy who likes to help when possible.
Glad you found it useful, i'm bookmarking it.

BTW, since you seem to speak russian, is the program free/open source like the original Regshot, or is it freeware only? Any details on licensing?

[dlimanov]

-{ Quote: "Thank you for the kind words :)
I'm just a guy who likes to help when possible.
Glad you found it useful, i'm bookmarking it.

BTW, since you seem to speak russian, is the program free/open source like the original Regshot, or is it freeware only? Any details on licensing?" }-

It's a free to use as far as I can see, not open source.

[Tarnak]

Just downloaded to see what this is all about...not sure how to use though. ;)

Looks interesting, nevertheless. See screenshot.

[tobacco]

-{ Quote: "I don't have time to try it out and say anything really" }-

For a guy who keeps saying no time to try them out, your sure here at Wilders alot! :P

[dlimanov]

-{ Quote: "Just downloaded to see what this is all about...not sure how to use though. ;)

Looks interesting, nevertheless. See screenshot." }-

You take a first registry snapshot, then a second and the program will generate a report for you and create two "redo" and "undo" text files that are really REG files that you can rename and either undo the action or redo it.

[Tarnak]

-{ Quote: "You take a first registry snapshot, then a second and the program will generate a report for you and create two "redo" and "undo" text files that are really REG files that you can rename and either undo the action or redo it." }-

Thanks...but am looking for a context, and an example where this utility could be useful. I just can't think of one off the top of my head.
;) :)

[SKA]

I cant see a download link for Regshot version 2.0 unicode on Google english translation pages- can anyone PM me the download link - thanks !

SKA

[Tarnak]

-{ Quote: "I cant see a download link for Regshot version 2.0 unicode on Google english translation pages- can anyone PM me the download link - thanks !

SKA" }-

See my PM.:)

[Pliskin]

-{ Quote: "Hi Pedro,
Thanks for the pointers. Unfortunately, none of the programs in the other thread will export registry changes to REG. Some will export to TXT file, most won't export at all -- I've tried them all! :-)" }-
InstallWatch (or InstallRite) can export registry changes to REG. You can use right click, or you can just click on that huge toolbar button "Export" which has registry icon.