Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

How does an Installer/Uninstaller Work?


  • Please log in to reply
6 replies to this topic

#1 JJ2K

JJ2K

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Local time:04:22 AM

Posted 16 March 2009 - 02:57 PM

Hi,

Am I correct in saying, when you launch a setup/installer all it does is plonk files in various locations on your P.C, and add keys to the registry?

So in theory, if an uninstaller wasn't supplied with a program, would deleting all traces and keys I could find relating to the program have the same effect?

Or does an uninstaller/installer do something special and is not as simple as I think?

Is there a way to look into the code of an installer/uninstaller file to see what it does?

It's just i've got some stupid programs like "packard bell info centre", "iwf presentation", which have no uninstaller and I want them gone!!

BC AdBot (Login to Remove)

 


#2 darkdays

darkdays

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 16 March 2009 - 04:35 PM

I may be new here but I have some experience with manually uninstalling programs. An installer basically writes files to the necessary areas on your hard disk and writes registry values to make windows let it work such as adding to startup and other things to help it operate and work with windows. So basically you were correct about the installer and uninstaller. An uninstaller is used to make it easy and fast on people to remove programs and all of its components (even though some have poor uninstallers and leave traces scattered around your registry). As far as I know an uninstaller doesn't do anything "special". If you want to uninstall them manually you should probably find out if its safe to or not and then search through all your files and registry (google it. Might specify ALL its files) and delete everything. I hope that helps you some.

#3 JJ2K

JJ2K
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Local time:04:22 AM

Posted 17 March 2009 - 10:37 AM

Thanks darkdays, it helps a lot.

So basically installers and uninstallers are sort of like a zipped file. So theoratically if somebody placed the files in the right locations and created the same registry keys (assuming they knew where) they could install a program without an installer?

Is there a way to read the code inside an installer and uninstaller, so I could understand better how they work? Like say open in notepad..

Hm so how does this sound for removing a program where an uninstaller is not present:

- Delete the folder, and do a search for the product to see if it has files in other locations.

- Look for registry keys in Software folders relating to the product. Where are other common places for a piece of software to create registry keys in the registry or could it be anywhere?

And that's pretty much it.

#4 darkdays

darkdays

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 17 March 2009 - 03:56 PM

I am not sure if you can strip down the code of an installer/uninstaller. I know it's possible somehow since people are able to crack programs and their installers, but how to do that I do not know.

Yes, basically you find the folders on your hard disk and delete them, find the registry key entries by using regedit and navigating to HKEY_CURRENT_USER then drop down the Software section by clicking the arrow. The registry entry should be here with a folder that will have a name such as the program. Delete it but be careful not to delete any important data since the registry is the main thing windows runs off of. If it's not there you can go to the microsoft drop down button in the software section and find it there. Furthermore you can search through the Windows drop down button located in the Microsoft section, but if it is here (which I doubt) then make sure that your system does not depend on the program.

Also check the HKEY_LOCAL_MACHINE section for the program. The entries will be located in the same folders as under HKEY_CURRENT_USER.

If the programs were added to startup then follow the instructions for HKEY_CURRENT_USER until you're at the Microsoft section. Drop down the CurrentVersion folder and SELECT the Run folder. The startups for just the current user are here. It is possible that it is started up from the same location under HKEY_LOCAL MACHINE.

If any file extensions were associated with the program then you can go to the HKEY_CLASSES_ROOT drop down section and search for file extensions. For example .mp3 and it's itunes. You would go to .mp3 and drop down the section. Then search the folders (only 3 or so here) and delete the itunes part which in your case you would do whatever program you are uninstalling.

It is also possible that the program might be under HKEY_USERS in which case you would drop down the .DEFAULT folder and go into software again.

As far as I know this is the way to completely delete a program from windows. If any info is incorrect or unclear then let me know.

#5 Stang777

Stang777

    Just Hoping To Help


  • Members
  • 1,821 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:03:22 AM

Posted 17 March 2009 - 04:09 PM

If you are going to do this, make sure you have a recent system restore point or backup of the registry, using something other than the regedit to back it up, before you make any changes, just in case.

Also, are you sure they are not in add/remove programs?
Have you tried using a program like revo to uninstall them?

Edited by Stang777, 17 March 2009 - 04:12 PM.


#6 JJ2K

JJ2K
  • Topic Starter

  • Members
  • 162 posts
  • OFFLINE
  •  
  • Local time:04:22 AM

Posted 18 March 2009 - 03:30 PM

Thanks darkdays and Stang, i'll be sure to perform backups just incase.

Hm for one of the programs in question I found a log file called ST6UNST, which sounds like an uninstall, but it's a log file. Here's its contents:

%% PLEASE DO NOT MODIFY OR DELETE THIS FILE! %%
%% This file contains information about the installation of an application. %%
%% It will be used to automatically remove all application components from your computer if you choose to do so. %%


NOTE: Beginning of the bootstrapper section

CONFIG: Title: "IWF - Internet Safety Presentation"

ACTION: RegKey: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion", "SharedDLLs"

ACTION: SystemFile: "C:\WINDOWS\system32\VB6STKIT.DLL"
(File currently on disk was already up to date)

ACTION: SystemFile: "C:\WINDOWS\system32\COMCAT.DLL"
(File currently on disk was already up to date)

ACTION: SystemFile: "C:\WINDOWS\system32\STDOLE2.TLB"
(File currently on disk was already up to date)

ACTION: SystemFile: "C:\WINDOWS\system32\ASYCFILT.DLL"
(File currently on disk was already up to date)

ACTION: SystemFile: "C:\WINDOWS\system32\OLEPRO32.DLL"
(File currently on disk was already up to date)

ACTION: SystemFile: "C:\WINDOWS\system32\OLEAUT32.DLL"
(File currently on disk was already up to date)

ACTION: SystemFile: "C:\WINDOWS\system32\MSVBVM60.DLL"
(File currently on disk was already up to date)

ACTION: DllSelfRegister: "C:\WINDOWS\SYSTEM32\COMCAT.DLL"

ACTION: TLBRegister: "C:\WINDOWS\SYSTEM32\STDOLE2.TLB"

ACTION: DllSelfRegister: "C:\WINDOWS\SYSTEM32\OLEPRO32.DLL"

ACTION: DllSelfRegister: "C:\WINDOWS\SYSTEM32\OLEAUT32.DLL"

ACTION: DllSelfRegister: "C:\WINDOWS\SYSTEM32\MSVBVM60.DLL"

NOTE: End of the bootstrapper section

NOTE: Now spawning the main Setup program 'Setup1.exe'....

ACTION: CreateDir: "C:\Program Files\IWF"

ACTION: CreateDir: "C:\Documents and Settings\nec\Start Menu\Programs\IWF - Internet Safety Presentation"

ACTION: PrivateFile: "C:\Program Files\IWF\Dixons_IWF_Printable.doc"
(File was not found or was an older version -- new file copied)

ACTION: PrivateFile: "C:\Program Files\IWF\open-word.exe"
(File was not found or was an older version -- new file copied)

ACTION: SharedFile: "C:\WINDOWS\System32\IWF-Demo.exe"
(File was not found or was an older version -- new file copied)

ACTION: PrivateFile: "C:\Program Files\IWF\IWF-Presentation.exe"
(File was not found or was an older version -- new file copied)

ACTION: ShellLink: "IWF - Internet Safety Presentation", "IWF Presentation"

ACTION: ShellLink: "IWF - Internet Safety Presentation", "Printable Version"

ACTION: RegKey: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion", "App Paths\IWF-Presentation.exe"

ACTION: RegValue: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IWF-Presentation.exe", ""


It seems like an uninstall but it's only a log file. It does say "automatically" but how do I activate it. Might head over to the Packard Bell forums and ask as they plonked it on my computer.

#7 Romeo29

Romeo29

    Learning To Bleep


  • BC Advisor
  • 3,194 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:04:22 AM

Posted 18 March 2009 - 06:50 PM

It is a VB6 program. The setup, most probably, was created using a file redistribution utility that came with VB6. I dont have VB6 anymore, and its been many years since I used it, so I cannt give you details. But normally this kind of setup creates st6unst.exe in C:\Windows if not already or not new version. It creates st6unst.log file in the setup folder in the C:\Program Files.

Normal command it passes for uninstalling (as far as I remember)

c:\windows\St6unst.exe -n "C:\Program Files\(app)\St6unst.log" -f -q

Passing the log file path and name as parameter.

More Information:
http://support.microsoft.com/kb/182470

Edited by Romeo29, 18 March 2009 - 06:56 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users