Looking for pure "installation monitor" tool

Discussion in 'other anti-malware software' started by Joeythedude, Jun 30, 2009.

Thread Status:
Not open for further replies.
  1. Joeythedude

    Joeythedude Registered Member

    Joined:
    Apr 19, 2007
    Posts:
    519
    Thanks , will take a look at that.
     
  2. firzen771

    firzen771 Registered Member

    Joined:
    Oct 29, 2007
    Posts:
    4,815
    Location:
    Canada
    so how is better than ZSoft? their descriptions seem very similar? any technical details or anything?
     
  3. 1boss1

    1boss1 Registered Member

    Joined:
    Jun 26, 2009
    Posts:
    401
    Location:
    Australia
    Mainly more options, it's been months since i had ZSoft installed so my memory is hazy on specifics but at the time i had both installed side by side and came to the conclusion Total Uninstall was worth the cost.

    But beauty is in the eye of the beholder, so what i would personally do is install ZSoft then use it to monitor the install of Total Uninstall. This way if you don't consider spending the money is justified you can nuke Total Uninstall with ZSoft and you lose nothing. :)
     
  4. firzen771

    firzen771 Registered Member

    Joined:
    Oct 29, 2007
    Posts:
    4,815
    Location:
    Canada
    i dont really care for flashy with this, i just need to know that ZSoft will monitor an install completely and remove it completely. i just wish it was able to analyze already install programs some way :doubt:
     
  5. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,280
    Location:
    UK
    Total Uninstall can do this. The uninstall is not as complete as if Total Uninstall had been used to monitor the installation in the first place, but it still does a pretty good job and it will remove a number of file and registry items left behind by the program's own uninstaller.
     
  6. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,113
    Location:
    Sofa (left side)
    Revo Uninstaller can do this as well, though I'm not sure how well it compares to Total Uninstall. I previously used Total Uninstall but it tended to be a bit too thorough in removing all changes between snapshots, removing things I suspect were not directly related to the program install. I would be very wary about uninstalling any program based on a 'snapshot' approach.
     
  7. 1boss1

    1boss1 Registered Member

    Joined:
    Jun 26, 2009
    Posts:
    401
    Location:
    Australia
    Yes it can be very comprehensive, that's why i mentioned earlier to read the info regarding monitored installs before using it. There's 4 built in profiles for analysis, safe, normal, advanced and patch/update/plugin plus you can create your own and use the numerous sliders to adjust sensitivities of all the files/registry detection components.

    You can also exclude things permanently from detection/removal, basically background programs that may be active while you are doing an install like AV's, Firewalls, mouse drivers etc. Also you can run through a learning mode which helps the program learn your system, i guess similar to a HIPS learning/rules mode.

    But the basic rule of thumb is don't run needless programs in the background while monitoring an install, just your security software which you exclude and you will get a highly accurate snapshot of changes which in turn results in a perfect uninstall.

    So it does do very granular detection and removal, but some time/testing is needed to fully understand it's features and capabilities.
     
  8. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,113
    Location:
    Sofa (left side)
    I would also add that the version I used was a few years old and I see Total Uninstall has had a lot of development since then. It is indeed a powerful tool and bearing in mind your comments I think I'll take it for another spin and this time read the manual properly :)
     
  9. firzen771

    firzen771 Registered Member

    Joined:
    Oct 29, 2007
    Posts:
    4,815
    Location:
    Canada
    im testing out Total Uninstall, seems good at first glance.
     
  10. majoMo

    majoMo Registered Member

    Joined:
    Aug 31, 2007
    Posts:
    994
    ZSoft Beta does this yet.

    I use it instead similar Revo feature. And of course their excellent analyzed log (snapshot based) to do a complete uninstall.
     
  11. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,280
    Location:
    UK
    From my own experience, I suggest that when using Total Uninstall to uninstall a program that was installed using a monitored install, you aways first use the program's own uninstaller and just use Total Uninstall with the "clean up" profile afterwards to get rid of any remnants not removed by the uninstaller. It's much safer and less likely to lead to problems.

    Using Total Uninstall with the "total uninstall" profile to reverse all of the incremental changes recorded between two snapshots as an alternative to using the program's own uninstaller is not guaranteed to work, especially with programs that have a complex installation sequence.
     
  12. firzen771

    firzen771 Registered Member

    Joined:
    Oct 29, 2007
    Posts:
    4,815
    Location:
    Canada
    ill remember that.
     
  13. Lebowsky

    Lebowsky Registered Member

    Joined:
    Dec 3, 2004
    Posts:
    161
    thanks for all the suggestions!
     
  14. DOSawaits

    DOSawaits Registered Member

    Joined:
    Dec 11, 2008
    Posts:
    469
    Location:
    Belgium
    I would also recommend Total Uninstall 5. Does a perfect job at catching any changes during an install, even when a reboot is required in between.

    But you must also be careful, configure it to run the program's own uninstall first, and then first check out what's left behind, and delete the stuff you know is from the install itself by your own, ( right-click leftovers, and choose "Delete completely").

    NEVER do a fully automated uninstall, cause whatever may be happening behind your back installing a program, being it your Anti-Virus that updated silently, or whatever windows component, you could end up with a pretty fu**ed-up system afterward.

    So, my way of uninstalling, via Total Uninstall, run first program's own uninstaller, and then remove the rest manually from within TU.
     
  15. sun88

    sun88 Registered Member

    Joined:
    Aug 27, 2009
    Posts:
    69
    Interesting thread since it turns out that Total Uninstall is a "pure installation monitor tool", but it's not recommended to be used to uninstall applications. I hope I don't forget that last part.
     
  16. DOSawaits

    DOSawaits Registered Member

    Joined:
    Dec 11, 2008
    Posts:
    469
    Location:
    Belgium
    Well, the problem ain't that Total Uninstall doesn't do a great job, but just like any others it works with snapshots, If you do your Pre-Install snapshot, then install your program, and then wait a bit too long before doing your Post-Install snapshot, some other stuff could got done on your system, for example, Windows Update having updated stuff, or virusscanner was busy updating signatures, with lots of services doing stuff constantly behind your back, etc....

    Therefor my recommendation to always check what TU would recommend to remove after the program's main uninstaller finished. You should do so with any installation monitor, since your whole c:\ drive and registry is checked for changes, and no single monitor has that special magic skill to recognize what program made what specific changes.

    If correctly configured, the uninstall procedure within TU will first run the program's own uninstaller if present, and then present you with what's still left, you have the choice to keep or delete what's still left.

    Anyway, my recommendation still stands, allthough not free, Total Uninstall is by for the most clever, thorough one of them all.
     
    Last edited: Sep 22, 2009
  17. 1boss1

    1boss1 Registered Member

    Joined:
    Jun 26, 2009
    Posts:
    401
    Location:
    Australia
    The OP asked for a pure installation monitor then stated in the first post "Then I could take a look at it , and if I didn't like the look of it , rollback the entire install."

    Total Uninstall does exactly this, as for not using it to uninstall applications.. Well "everything" i uninstall i use it, it gets rid if the entire application and it's associated files without issue and does an impressive job.

    But i took the time out to learn it's features and capabilities, because indeed you can remove things which you didn't intend with the advanced "Monitored" component.
     
  18. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,113
    Location:
    Sofa (left side)
    Having taken another look at Total Uninstall I think my recommendation is similar to others. TU is great for monitoring the install so you can see exactly what is being installed, but for uninstalling I would only recommend using first the programs own uninstall application and then using TU for clean-up. This can be configured as the default method in TU. However, I would also add that you should only uninstall the program using the "Monitored Progams" approach (even if you are launching the programs built in uninstall first and then using TU for cleanup) where there have been no reboots required during the install or will be required during the uninstall process. If a reboot has taken place then there is all sorts of entries in the snapshot that are not related to the program install and you could cause some damage as files/registry entries are removed and added back in during the uninstall.
     
  19. virtumonde

    virtumonde Registered Member

    Joined:
    Jan 18, 2008
    Posts:
    504
  20. 1boss1

    1boss1 Registered Member

    Joined:
    Jun 26, 2009
    Posts:
    401
    Location:
    Australia
    Yes it's easy to wind up with unrelated entries in a snapshot, for example i just monitored the install of eWallet from BitsduJour because i'm thinking of buying it (virtumonde's fault for sending me there :)).

    I intentionally left Outlook running, and hit Send/Receive during eWallet's install:

    eWallet.png

    As you can see, it captured my Outlook and Archive .pst files because they had "activity" during the install. This could wind up toasting over 1GB of emails if i wasn't careful. But it's easy to exclude it from the log, or add it to the scan exclude list so it never gets in the road again. Here you can see i've added the Agnitum folder so it can stay active but won't get caught up in the logs.

    eWallet2.png

    Now regarding reboot installs/captures you can make TU "learn" what goes on at reboot by doing a training reboot so it knows what's normal and what to ignore. Then when you install a program that needs a reboot, TU can spot the differences and generate a good log of just the program.

    Everyone's system is different from the moment we start adding programs/files and changing settings, so any installation monitor will probably catch unrelated stuff so it needs to be taught a little.

    As i mentioned before, the rule of thumb is have the bare minimum software running when monitoring an install. Shut down browsers, chat programs and yes Outlook lol. Just leave you security software running, and have it fully excluded (both filesystem and registry) and you will get accurate results.
     
  21. majoMo

    majoMo Registered Member

    Joined:
    Aug 31, 2007
    Posts:
    994
    I use ZSoft with installations that need to reboot and never had such annoyance.

    Like say TU'developer:

    Background changes that are caught in the install log are not so dangerous as you may think.
    There is about changed files that TU don't uninstall anyway and modified registry values that you can be sure will not crash any program if will be restored to a value that was before.​

    To use the Ignore List is adviced. E.g. I'm using WinPatrol real time and I set their registry entries to Ignore List.

    I also use firstly own uninstall application and then using ZSoft for clean-up with their analyzed log. ZSoft'developer adviced that also.
     
  22. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,280
    Location:
    UK
    The reason for not doing a "total uninstall" to reverse the incremental changes tracked between snapshots has little to do with unwanted background noise captured during the monitoring. As other people have pointed out, changes that are not part of the installation can easily be deleted from the installation log before uninstalling and excluded from future scans.

    The fact is that the installation process can't always be accurately modelled by comparing before and after snapshots. For example, suppose you apply an operating system or program upgrade that starts off by backing up a number of executables and DLL's into a backup folder. In order to uninstall the upgrade later and revert to the previous version those files will have to be restored from the backup folder. Total Uninstall will log the fact that a new folder was created during the installation. If you do a "total uninstall" it will simply reverse the change and delete the backup folder containing files that need to be recovered, resulting in a complete mess and possibly an unbootable system.

    The bottom line is that while Total Uninstall can reverse changes to the registry, it can't always reverse the file system back to the state it was in prior to the install. That's why I recommend always using the program's own uninstaller first then using Total Uninstall in clean-up mode to get rid of the remants left behind. Only the program's own uninstaller knows what has to be done to uninstall a program. A snapshot monitor, however sophisticated, will sometimes get it wrong.

    I've used Total Uninstall ever since Version 3 and I think it's a great program, but I only use it in clean-up mode for safety. There are no disadvantages to using it this way as it still does an excellent job of removing all leftover traces, without the risk of breaking anything.
     
  23. sun88

    sun88 Registered Member

    Joined:
    Aug 27, 2009
    Posts:
    69
    pegr: Thanks for that lucid description.
     
  24. LockBox

    LockBox Registered Member

    Joined:
    Nov 20, 2004
    Posts:
    2,328
    Location:
    Here, There and Everywhere
    One tool is best if you're monitoring the initial install, another (Revo) is better if the initial install was not monitored.

    One reason to use the program's own uninstaller first is it doesn't allow their uninstaller to rewrite anything into the registry. Of course, it goes without saying that using a program's uninstaller only, leaves all kinds of things on your system. Especially if it was trialware.



    edited stupid grammatical error
     
    Last edited: Sep 22, 2009
  25. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,280
    Location:
    UK
    Glad you found it useful. :)

    Regards
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.