Introduction

InstallSpy v2
November 2003

What does it do?

InstallySpy monitors your computer for changes to the registry and file system, and can also monitor shell notification events, e.g. network drive added, media inserted, etc. It can be used, for example, to:

  • Record what is changed when a program is installed. This can be useful to check if an installation is changing files you don't want changed, or tweaking your registry, e.g. changing your Internet Explorer home page.
  • Record what is changed when a program is executed. For example, you can record what files a program is changing while it is running.
  • Record what is changed when a program is uninstalled.
  • Record what processes are running before and after.
  • Warn you when important registry keys or values are changed, e.g. Internet Explorer home page.
  • Identify files that should be deleted when uninstalling a program.

Basically, InstallSpy will tell you what has changed between two points in time. It is useful both for end-users and developers. A developer can use the program to check that an installation is correct, for example. It is highly configurable, and the results can be filtered. The end-report is a HTML report.

OK, so how do I use it?

Proceed to the tutorial !

What is in this new version?

Click here for a list of changes, improvements, and bug fixes.

How much does it cost?

InstallSpy is 100% freeware and there is no need to register. It is not limited in any way. It is not adware, malware, or shareware. However, if you would like to donate to costs of running the web-site please do!

InstallSpy
(c) Michael J. Leaver, 2003 (MJLeaver@email.com )
All Rights Reserved.
http://www.mjleaver.com/


Tutorial 1

InstallSpy
Tutorial Part 1

When you run InstallSpy for the first time it will check that you are using a supported operating system, e.g. Windows XP. If you are not then you will see an error message telling you so. If your operating system is supported, then you will see this dialog box:

After clicking OK, you are given the chance to change the program settings:

For more information on these settings, see the Configuration section. Basically, these settings define what changes to your computer InstallSpy will record. Although it may be tempting to record everything it is recommended that you use the default settings, otherwise you will be overwhelmed with information.

Click OK to save these settings and proceed to part 2 of this tutorial.

Return to the Introduction


Tutorial 2

InstallSpy
Tutorial Part 2

This is the main screen of InstallSpy:

At the top of the screen is the main menu:

The Settings menu lets you define what changes InstallSpy should record, and also change the filter settings. Filters allow you to remove information from results, for example filter out recycle bin changes. For more information on the Report Settings , see the Configuration section. For the various filtering options, see the Filtering section.

The Report menu allows you to view a report you have created during this session. When clicked, it will run your default web browser and display the report. Reports are in HTML format, and saved as InstallSpyReport.html and stored in the same directory as the InstallSpy executable. The directory to save reports to can be changed (see the Configuration section). The Report menu can also be used to free the memory used by the report.

Let's begin using InstallSpy! Proceed to part 3 of this tutorial .


Tutorial 3

InstallSpy
Tutorial Part 3

When you use InstallSpy, there are several steps that you must go through, in order, one-by-one (you can skip some steps, and even automate the whole process, but to help you understand how InstallSpy works we will go through each step). Once you have completed a step you click the Yes button to proceed to the next step. The first step is to stop or pause any other programs that you have running:

Why do this? Because InstallSpy records the changes made by any and all programs, not just a specific program. It is not possible to detect which program made a change. You do not need to stop and close all programs and services, just those that are likely to change files or update the registry. If you know which changes those programs make you can actually leave them running and simply filter out the changes they make. For the various filtering options, see the Filtering section.

The file-open button (to the right of the Yes button) let's you specify exactly which program you want to watch. For more information see the Monitor Program section. To follow this tutorial, do not click this button.

Click Yes once you completed this step. The next step is to prepare the program or installation whose changes you want to record:

If, for example, you are going to install a program then you would now insert its installation CD. As the description says, do not install or run the program yet. Once you are ready to install or run the program, click Yes to proceed to the next step:

InstallSpy will now scan your registry & files and take a snapshot of their state. This could take from a few seconds to a few minutes, depending upon which parts of the registry and filesystem you want to detect for changes, how big your registry is, how many files you have, and how fast your computer is. On a typical Windows XP computer, and with the default settings, there are around 100,000 registry keys to scan. In the bottom left of the main window you can see the progress of the scan:

Once it has completed, you are automatically moved onto step 4:

Simply click Yes and then run, install, etc. the program whose changes you want to record. You are moved onto step 5:

Note that you can minimize InstallSpy at any time into the tray of Windows to avoid cluttering up your desktop:

Simply double-click the InstalSpy icon to restore the program to the desktop. Once you have finished installing or running your program, click Yes. Note that it is recommended that you wait a few moments before moving to the next step as sometimes installations don't actually complete immediately. You are now moved onto step 6:

InstallSpy will now scan your registry & files and compare them to the snapshot taken in step 3. This step will take slightly longer to complete than step 3 because it must both scan the registry & files and compare them to the registry & files before your program was installed or run. As with step 3, the progress can be seen in the bottom left of the window.

Once this step is complete, the report is compiled and automatically displayed in your browser. Congratulations! You now have a report of what changes were made to your system.

You may now want to filter out some of the information in that report. Proceed to the Filtering section of this help file for more information.


Configuration

To change the settings for InstallSpy, select the Settings menu item from the Settings menu on the main screen. The settings screen will appear:

There are four main types of changes the InstallSpy can record:

  1. Shell Events: These are events sent to the shell (Explorer in Windows) to tell it when to update the desktop (which is also Explorer) or any open Explorer windows. For example, if the Recycle Bin icon needs to be changed because it has just been emptied, then a System image changed event is recorded.
  2. Registry changes: Many programs in Windows, including Windows itself, store their settings in the registry. The registry is split into several sections, e.g. settings that apply to all users, settings for the computer itself, etc.
  3. File system changes: InstallSpy can watch for changes to files or directories, for an entire drive or just within certain directories. By defeault, all hard-drives (and partitions) are watched. File watching is only supported on Windows 2003, XP, 2000, and NT4. File scanning is supported on all versions of Windows. InstallSpy can also report on how much disk space was lost (or gained) on all hard drives.
  4. Processes: A snapshot is taken of what processes are running before and after. This includes information on each process, such as its priority and number of threads.

You can also access the filtering settings by clicking the Filter button. See the Filter section for more information on filtering, as that is not covered here.

Note that you can use a pop-up menu (right-click anywhere on the window) to clear or set all of the check-boxes and also revert to the default settings:

Shell Event Notifications

Note that these events are only recorded when they affect a file or directory that is open in explorer, e.g. the desktop, a file saved on the desktop, a folder open in an Explorer window, etc

Event | Description
File type assocation change | The default program used to open file of a certain type, e.g. Microsoft Word documents, has been changed.
File or folder attributes changed | Note that it appears that this event is never sent by Windows.
Non-folder (e.g. file) created | A file has been created in a folder open in an Explorer window.
Non-folder (e.g. file) deleted | A file has been deleted in a folder open in an Explorer window.
Drive added | For example, a new network drive has been mapped.
Drive added, shell needs to create new window | For example, a new network drive has been mapped. Note there is no point recording this event.
Drive removed | For example, a new network drive has been disconnected.
Media inserted, e.g. CD | For example, a new CD or DVD has been put into the CD/DVD drive.
Media removed | For example, the CD or DVD has been taken out of the CD/DVD drive.
Disconnected from a server | Recorded when you have completely disconnected from a Windows server. Note the author has been unable to reproduce this event.
Folder being shared | A folder has been shared on the network.
Folder stopped being shared | A folder has stopped being shared.
Folder renamed | A folder has been renamed.
Non-folder (e.g. file) renamed | A file has been renamed.
Folder deleted | A folder has been deleted.
Folder created | A new folder has been created.
Folder contents changed | The contents of a folder has been changed, for example, a file in a folder being shown in an Explorer window has been changed.
System image changed | A system image has changed, e.g. the Recyclye Bin has been emptied.
Non-folder (e.g. file) changed | A file has been changed.

It is recommended that the default settings are used.

Registry Changes

The registry stores settings for many of the programs installed in Windows, including settings for Windows itself, specific users, all users, etc. For more information on what these root keys are used for see this Microsoft web page .

Root Key | Description
HKEY_LOCAL_MACHINE | This root key stores all the settings that apply to the computer. Note that only an Administrator can changes these settings.
HKEY_USERS | This root key stores all the settings that apply to all the users of the computer.
HKEY_CURRENT_USER | This root key stores all the settings that apply to the current user only. It is a sub-key of HKEY_USERS .
HKEY_CURRENT_CONFIG | Contains information about the hardware profile used by the local computer at system startup. It is a sub-key of HKEY_LOCAL_MACHINE .
HKEY_CLASSES_ROOT | The information stored here ensures that the correct program opens when you open a file by using Windows Explorer. It is a sub-key of HKEY_LOCAL_MACHINE .

As you can see, some of the keys are actually sub-keys of other keys. So, if you select HKEY_LOCAL_MACHINE then you will also be monitoring HKEY_CURRENT_CONFIG and HKEY_CLASSES_ROOT. If you select HKEY_USERS you will also be monitoring HKEY_CURRENT_USER. Therefore, selecting both HKEY_LOCAL_MACHINE and HKEY_USERS will record all changes made to the registry.

It is recommended that the default settings are used, i.e. select just HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.

Note that InstallSpy can be configured to automatically alert you when certain registry keys or values are changed. For example, some adware programs may change your Internet Explorer home page without your consent. See the Registry Warnings section for more information.

File Watch

File watching is only supported on Windows 2003, XP, 2000, and NT 4.

InstallSpy can watch for any type of change made to any file or directory. It can watch entire drives or just certain directories.

File Setting | Description
Files created, deleted, or renamed | A file has been created, deleted, or renamed.
Directories created, deleted, or renamed | A directory has been created, deleted, or renamed.
File or directory attributes changed | A file or directories attributes have been changed, e.g. directory hidden.
File size changed | A files size has been changed.
File or directory creation date changed | A file or directories creation date has been changed.
File or directory last write date changed | A file or directories last modification date has been changed.
File or directory security attributes changed | A file or directories security attributes have been changed, e.g. the owner has changed.
File or directory last access date changed | A file or directories last access date has been changed. This is only valid on NTFS formatted drives.

It is highly recommended that the default settings are used, otherwise duplicate information may be recorded. For example, if a file is modified then three events could be recorded (file size changed, file last write date changed, file last access date changed).

Enabling File or directory last access date changed may result in a large report. If you want to see what files a program is reading, then it may be better to enable just this setting.

Because of a limitation in Windows, InstallSpy cannot record the exact event that occurred. This table below shows what these settings are actually recorded as in the report:

File Setting | Recorded In Report As
Files created, deleted, or renamed | Created, Deleted, or Renamed (depending on action)
Directories created, deleted, or renamed | Created, Deleted, or Renamed (depending on action)
File or directory attributes changed | Modified
File size changed | Modified
File or directory creation date changed | Modified
File or directory last write date changed | Modified
File or directory security attributes changed | Modified
File or directory last access date changed | Modified

So from the report it would not be possible to distinguish between a file size change or a file attributes change, for example. To know exactly which setting changed you would need to select just that setting. Future versions of InstallSpy may be able to bypass this limitation.

By default, InstallSpy will record file system changes made to any directory or file on any hard drive in the computer. This can be changed by clicking the Paths to watch/scan button:

You can add directories by clicking the Add Directory button, and delete directories from the list by clicking the Delete Directory button. Note that sub-directories and their contents will also be scanned, so for example, if you add the directory C:\WINDOWS then all the files and sub-directories (and their files and sub-directories etc.) will be scanned for changes.

As an alternative to File Watching, you can use File Scanning (you can also use both at the same time).

File Scanning

Unlike File Watching, File Scanning can be used on all versions of Windows. It can be used with File Watching, or as an alternative.

File Scanning works by taking a snapshot of selected files and directories before and after, then comparing the lists to find the differences. It works the same way as detecting registry changes. Hashing can be used to guarantee detection of file changes. It computes a unique hash value based on the contents of a file - there is a choice of MD5 or SHA-1 hashing. Note that hashing is extremely slow and should only be used when the number of files being scanned is small. Also hashing cannot compute hash values on open files.

The directories to be scanned can be changed by clicking on the Paths to watch/scan button. The same paths are used for file watching and scanning.

What are the main differences between file watching and file scanning?

  • File Watching only works on Windows 2003, XP, 2000, and NT 4. File Scanning works on all versions of Windows.
  • File Watching is quicker than File Scanning.
  • File Watching can record multiple events on the same file, e.g. modified, deleted, created, etc. File Scanning can only detect a single change to a file, e.g. modified or deleted or creted

Process Watch

InstallSpy can keep track of what processes are running and start automatically when certain programs are run.

If Run InstallSpy on Windows startup is checked then InstallSpy will start when Windows is started. It will start minimized (to the tray area next to the clock). Starting InstallSpy with Windows is useful for when you want InstallSpy to run automatically whenever certain programs are run.

If you want InstallSpy to start automatically if a program is run you must enable Prompt me to record changes when these programs are run and add the names of the programs. For example:

So if a program named either install.exe or setup.exe is run, InstallSpy will prompt you automatically:

As soon as the program exits, InstallSpy will stop recording the changes and display the report.

Report

By default, reports are called InstallSpy.html and saved in the same directory as the InstallSpy executable. This can be changed:

You can also prefix the filename with the date & time the report was produced.

Misc.

You can skip some of the steps and also remove the disk usage from the report.


Filtering

Filtering allows you to remove information from the report. Sometimes a report will contain details that you do not care about, e.g. recycle bin, DHCP refreshes by Windows itself, etc. These is background noise. But you may also want to filter to zoom on on a particular type of change, for example. Whatever the reason, there are numerous ways to filter the results.

Filter Settings is the main filtering screen that allows access to all the filtering methods, e.g. Filter Directories, Filter Keys, etc. The other filtering menu items allow you to go directly to those filter settings. Filter settings are saved.

After you have changed the filter values, click the View Report menu item to view the filtered report.

You can change the filtering values however you wish - it will not actually delete anything from the report. For example, you could filter out all the registry changes, display the filtered report, then decide you do want to view the registry changes and unfilter them.

Shell Events

From this screen you can change filter settings out shell events:

If an item is checked (ticked), then results of that type will be displayed . For example, if you uncheck (untick) the File type assocation change checkbox then those events will not be listed in the report.

Registry

The registry changes can be filtered:

By clicking the Keys to ignore button you can filter out specific keys and values (this screen can be also accessed from the main menu):

You can filter out any registry key (including its sub-keys and values). Simply type in the key and press Enter or click the Add button. Notice that the key does not start with HKEY_LOCAL_MACHINE, for example. The key will be filtered out from all root keys.

To delete a key, click on it to select it and press Delete. You can select multiple keys using the Shift and Ctrl keys. When a key is checked (ticked) it will be filtered out. A pop-up menu is available by right-clicking the mouse:

By clicking the Values to ignore button registry values can also be filtered out (this screen can also be accessed from the main menu):

The screen can be used the same as filter keys, except in this case it is filtering specific registry values.

Files

You can filter out file watch and/or scan results.

Specific directories can be filtered out by clicking the Directories to ignore button (this screen can also be accessed from the main menu):

Note that it also filters out the directories sub-directories and all its files. It is used in the same way as the key and values filter screens, except you can also click the ... button to select a directory:

Specific files can be filtered out by clicking the Files to ignore button (this screen can also be accessed from the main menu):

It is used in the same way as the directory filter screen. Click the ... button to select a files to filter out:

Note that you can select multiple files.


Registry Warnings

There is a file called InstallSpy.ini in the InstallSpy installation directory. This file defines changes to which registry keys and/or values will cause a warning message is displayed. For example, if the Internet Explorer home page is changed then a warning message can be displayed:

The warning is displayed if the key or value is changed, deleted, or created. Note that a warning will be given even if the key or value has been filtered out. You will be able to see the old and new value, and if it was deleted or created, in the report.


Monitor Program

There are three ways of creating a report:

  1. By manually clicking the Yes button to move from step-to-step. This is useful to record all system changes for a certain amount of time, i.e. all changes between the time step 3 finishes and step 6 starts. You can also start recording changes by selecting Start Recording from the pop-up menu while InstallSpy is minimized to the tray.
  2. InstallSpy can start automatically when certain programs are run. It will stop recording changes as soon as that program exits.
  3. At step 1 or 2 you can instruct InstallSpy to record all changes while a certain program is run. Note that you can also choose the program via the pop-up menu (Run Program) while InstallSpy is minimized to the tray:

Before reaching step 3, you can monitor a program either by selecting Run Program from the pop-up menu while InstallSpy is in the tray, or clicking the file-open button next to the Yes button in steps 1 or 2. Once you select a program, InstallSpy automatically moves onto step 3, runs the selected program, minimizes, and moves to step 5. It will record the changes once either the program exits, you manually move onto the next step (by clicking the Yes button), or you select Stop Recording from the pop-up menu while InstallSpy is minimized to the tray.


Donate

InstallSpy v2
November 2003

InstallSpy is completely free. It is not shareware. You can use it without cost for as long as you wish.

However, if you would like to make a contribution to help keep this software, and the web-site, maintained then please click the PayPal icon below (it requires a connection to the Internet).

Thankyou!


Changes

InstallSpy Changes

Version 2 (November 2003)

  • Uses less memory, and reports can be freed to reduce memory usage
  • Now works on all version of Windows
  • Can detect more types of file-system changes
  • Uses MD5 and SHA1 hashing to detect file changes
  • Can auto-scan when certain programs (user definable) are started, e.g. setup.exe
  • Can run on Windows startup
  • User can select directory to store report in, and report can be prefixed with date & time
  • Program to monitor can be run from InstallSpy directly
  • More types of bad registry changes are caught by default
  • Report contains more details, e.g. processes and disk usage
  • Minor bug fixes and other user interface improvements

Version 1 (October 2003)

  • Original version