0
0
I have a program that I want to automate the uninstallation of, and the Control Panel lists the program and lets me run its uninstaller. It's worth mentioning that the program I want to uninstall would likely be considered to be a driver.
When I look under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall there aren't any keys related to the program. I have a test VM with only the program in question installed, so it's very easy to manually check each entry and verify that it is not present.
I know since the Control Panel is able to show it, Windows must know about it somehow.
I installed procmon and saved a log of the installation process. It captured over 2M events, but filtering by the installer process and "operation begins with Reg", I pared that down to 1701 events. I've tried to search through these, and I don't see anything that looks like what I want, although it's extremely possible that I just missed it, 1701 events is still a lot to go through.
Is there any additional filter that I can apply to try to find where it writes its uninstall string? Or is there somewhere else I should look in the registry since it's a driver?
Is there any other way I might get the uninstall string automatically? I don't really care about using the Registry specifically, although it does seem to be the best option.
TechnoSam
Posted 2019-09-03T22:25:52.490
Reputation: 115
1
Did you checked the 32 bit registry path ? https://superuser.com/a/1287510/471143
– Hans Hubert Vogts – 2019-09-04T20:13:53.690@HansHubertVogts Thank you, that did it! For what it's worth, the actual key I uncovered was not logged by procmon, so I would have never found it that way. Not sure what I would have done if it wasn't here. – TechnoSam – 2019-09-05T17:46:57.863