U3 USB sticks are a good example the programs on them just run from the file system.Īs noted, most good applications can be found via their uninstall registry key though. In fact, many applications do not need to be installed at all.
In this direction, there's no real limit of what the user can run, unless prevented by system policies.Īn application does not need to have any registry entry.
We may also have to scan the disks, and network disks, and anything the user downloads, and world-accessible Windows shares in the Internet (yes, such things exist legitimately - \\\tools comes to mind). Note: As Ensink says, "installed" is a bit of a vague concept - are we trying to find what the user could run? Some software doesn't even write to the Registry at all: search for "portable apps" to see apps that have been specifically modified to run directly from media (CD/USB) and not to leave any traces on the computer. If you're a member of the group Administrators, you can check the HKEY_USERS hive - each user's HKCU actually resides there (you'll need to know the user SID, or go through all of them). If you want to be sure, check the filesystem to see if the application still exists where its registry entries say it is. These are the most important keys however, contents of the registry do not have to represent the installed software exactly - maybe the application was installed once, but then was manually deleted, or maybe the uninstaller didn't remove all traces of it. Many (most?) applications also add their uninstall entries to HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\, but again, not all applications do this. HKLM\Software\Microsoft\Internet Explorer) may be the most common, but that's just a convention, not a law of nature. User-specific settings should be written to HKCU\Software, machine-specific settings to HKLM\Software.
0 kommentar(er)
