Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - Brown Sugar

Pages: 1 [2]
General Support / Re: Safe to edit zulog and delete Reg deleteds?
« on: May 01, 2007, 08:43:42 am »
I guess even if the streams are added back, a good Registry Cleaner will delete them when the registry is scanned.
I've used Regseeker but I think it's too agressive.  I had to reinstall Lotus 123 because it deleted an important string that must have had something to do with running a dll or exe file.

Do you have any recommendations regarding registry cleaners?

If I use the ignore list function, won't I have to answer yes or no to every string?

General Support / Safe to edit zulog and delete Reg deleteds?
« on: April 30, 2007, 08:21:47 pm »
When I check the zulog file, I usually see MRU streams in the reg deleted area which match similar strings in the reg added area.
Doesn't this mean that those strings will be added back when uninstalling?  Aren't those strings unnecessary?  I've edited the zulog file before and deleted all references to reg deleted MRU streams, then uninstalled with no problem

In addition, I sometimes find a load of keys similar to this in the reg deleted area.  I think this string is from a Zone Alarm system check and probably should remain deleted. 

REG DELETED!   HKU   S-1-5-21-329068152-1060284298-842925xxx-xxxx\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints\Q\_DriveFlags
This is from a Spyware Terminator zulog file and for that program the system has to be rebooted.  (I replaced actual numbers with x's).

I also see items called "Perflib data counts" which are probably related to Zone Alarm.

There are also such items as:

REG DELETED!   HKLM   SOFTWARE\Zone Labs\ZoneAlarm   ProgramSecuredCount   int:
REG DELETED!   HKLM   SOFTWARE\Microsoft\Cryptography\RNG   Seed   

along with references to updated programs.

Won't they be added back to the registry when uninstalling and is it really necessary that they should be added back? 

Most of the time, when I analyze the "reg deleted" area, it appears that most of the strings should remain deleted.

General Support / Re: Suggestions for analysis of add-ons?
« on: March 09, 2007, 04:34:27 pm »
If you really want to analyze plug-ins in Winamp I think the best(/most convenient) thing would be to analyze once for a group of plug-ins (as you suggest)...

Personally I think it's over-kill to analyze stuff like that, but that is probably me being naive ::)

There are times when these plug-ins cause dll conflicts, and rather than use Regseeker to search for their strings, it would be easier to use Zsoft Uninstaller to delete all of them.  Secondly, there might be strings that you can't search for because they might be placed in tough to find places. 

In addition, some of these plug-ins can add items to the precious system32 subdirectory.

General Support / Suggestions for analysis of add-ons?
« on: March 08, 2007, 06:22:13 pm »
After I install a program like Winamp, I like to install many plug-ins.

What would be the best way to analyze the installation of these so that one doesn't spend a great amount of time analyzing the installs?

I was thinking of installing several at a time if they're small, and then naming the zulog file so that I'll know that several comprise the install.

Feature Requests / Re: Automate ZSoft Uninstaller "analyze"
« on: March 08, 2007, 06:17:14 pm »
What can be done for programs that have auto updates?  I don't expect to analyze Microsoft updates, but our firewalls, antispyware and AV programs sometimes install upgraded engines in addition to their signature files. 

Would you suggest altering the configuration so that the program only notifies of an update rather than automatically installs it?
In some cases, this would necessitate going to their website and manually downloading/installing the update files.

My feeling is that when it comes it security programs, further installation analysis would be too time consuming.
If we can't trust those programs, what can we trust?!   :-\

1) From what I've been told here before, the deleted registry strings are added back when the uninstall procedure is selected.
When I check my zulog file using notepad, I usually notice many mru streams and zone alarm references.
In addition, if a program requires a restart to finish the analysis, there's a good chance that an autostart program like Ccleaner or MRU blaster will remove temp files and registry strings.  Uninstall will then complete the analysis and reflect that these files and strings have been deleted.

The files won't be added back because they're gone, but won't the registry strings be recreated?  Regardless, will Zsoft issue a message that the uninstall wasn't totally completed if this is the case?

What I usually do is edit the zulog file and remove the strings referring to deleted mru streams.

2) Other deleted registry strings I find:

REG DELETED!   HKLM   SOFTWARE\Zone Labs\ZoneAlarm   ProgramSecuredCount   int:325

REG DELETED!   HKLM   SOFTWARE\Microsoft\Cryptography\RNG   Seed  (with a huge string following this key)

Do these really need to be added back?

3) Perflib files

Files such as these are created and show up in the zulog files:

FILE ADDED!   E:\WINNT\system32\Perflib_Perfdata_510.dat

According to:

The %SystemRoot%\System32\Perflib_Perfdataxxx.dat files are created by the System Monitor. When you shutdown normally, the file should be deleted.

If you have an abormal shutdown, these files can become orphaned, and accumulate on your computer.
Under some yet to be determined circumstances, these files can become orphaned during normal operation.
The best way to remove these files is to add a command in a logon script:
del /q %SystemRoot%\System32\Perflib_Perfdata*.dat

Since these are usually deleted upon shutdown, they will never be found by Zsoft Uninstaller, thus resulting in a program alert that all files could not be deleted.  Correct?

Some more info:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

The Perflib subkey stores configuration data for the Windows Performance
Library, which collects and organizes data for performance tools, such as
System Monitor.

In addition to entries, the Perflib subkey contains a Language-code subkey
for each spoken language you configure for Windows 2000. The Language-code
subkey stores performance counter names and their descriptions in the
specified language. The Language-code subkey is named for the language code
for that language. For example, the counters and descriptions for the
English language are stored in a subkey named 009, the language code for
English (United States).

General Support / Re: Uninstalling
« on: March 08, 2007, 05:44:53 pm »
This is why I'm recommending this program to many of my friends.  Unfortunately, most don't understand how important the registry is (and the majority of those have never even used a regedit command!).

The SIW program gives some excellent information, but what do you think could be the ramifications of the "trace" string?

What usually alarms me is when I load a program and some time later, I see my Zone Alarm icon start flashing.   Then I either check the Zone Alarm program tab or top right icons to see what's active,  do a netstat command or open TCPview.   Usually, the program authors tell you that the program is set to check for updates and that you can configure your firewall to prevent it, but I always am suspicious of those things.

In some instances, I'll receive a message to the effect that Zsoft couldn't remove everything and will try again the next time I run uninstall.
However, when I do a sample search for files and strings, they've been deleted.  Obviously, I can't check every one.  Uninstall will give me the same message every time subsequent time I run it for that same uninstalled program.

Could it be that there were temp files analyzed by Zsoft that were subsequently cleaned by a program such as CCleaner, and Zsoft is still looking to delete them because they're still listed in the zulog file?

Would it be possible in future versions to summarize what files and strings the program thinks couldn't be deleted?

Administrator - you might also like to know the program is discussed very favorably in the CCleaner forums.
Others have mentioned this same problem:


Bugs / 2.3.3 had a taskbar version error
« on: February 20, 2007, 08:43:24 pm »
Is this corrected on the new version?

Version 2.3.3. showed this in the taskbar:

General Support / Upgrading
« on: February 20, 2007, 08:37:20 pm »
If I install, v 2.3.4, do I have to uninstall v. 2.3.3, or can I just install it right over the old version?

Bugs / Re: Installed programs menu and Uninstall option problems
« on: February 20, 2007, 08:35:37 pm »
Sorry it took so long to reply, but I didn't want to respond until I had time to recreate the problem and load Screenhunter so that I could attach small image files.

I'm happy to report that I couldn't recreate the problem with uninstalling even though I chose not to. 
My system was running slow at the time (I've noticed that Zsoft sometimes uses 70% even when idle.  Is there an issue with certain AV scanners and Zsoft?) and the uninstalling problem could have been due to a delay after pressing a button 2x.

From what I now understand, if I click on the top menu Uninstall button, that starts the MS uninstaller, but if I right click and choose uninstall, that's a Zsoft uninstall.   Is that correct?

I'm looking forward to loading the upgrade.   Thanks for a great program.

Bugs / Re: v2.3.4 Issue with Analyze
« on: February 12, 2007, 07:04:19 am »
Is there a version 2.3.4?  I'm posting this 4 months after the first post in this thread, and the latest version I see right now is 2.3.3.

Bugs / Installed programs menu and Uninstall option problems
« on: February 12, 2007, 06:59:29 am »
I'm using version 2.3.3 on a Windows 2000 Pro OS.  I was looking to find your three box confirmation that one must select before uninstalling, so I right clicked on a program using the "Installed Programs" tab, chose the "uninstall" option, and then selected "No" when I was asked if I wanted to uninstall. 

1) Happily, the program didn't uninstall, but the ".zulog file disappeared from my Uninstaller\Logs subdirectory, as did the selection for it in the "Analyzed Programs" tab.  It still appeared in the "Installed Programs" tab, though!

Even though the program correctly DID NOT uninstall from my programs partition, a message appears in the Info Box that states:

XXXX Program should now be uninstalled.  The list has been updated.

The program is still listed in the "Installed Programs" tab, but not on the "Analyzed Programs" tab.

2) Most of the time, the Uninstall box on the upper left doesn't work when I click it.  Right clicking with the mouse and choosing uninstall seems to be the way to handle an uninstall.

3) To test the Uninstall button, I just chose to uninstall Winrar by using the Uninstall button.  A message appeared that said that Windows is waiting for Microsoft Framework 1.1 to finish.  Suddenly, an OS message appeared that asked me if I wanted to delete MS Net Framework 1.1 Hotfix?!  Naturally, I chose "no" but this message still appeared, even though the program thankfully wasn't uninstalled:

I didn't even use Zsoft to install Net Framework!
There must be a conflict with the program and Net Framework.

I know that you use XP to test the program, but can you see if you can duplicate the uninstaller problems when choosing "no" after selecting "Uninstall".

Pages: 1 [2]