Manually Removing a Windows XP Application
If you found this page, I’m going to assume that you have a problem
with a particular piece of software and you’d like to remove it from
your system. I’m also going to assume you’re familiar with Windows
Explorer, RegEdit, and the dangers of deleting something when you don’t
know what it is. If you don’t know these things, or are in the least
uncomfortable doing something that could seriously mess up your
computer, please don’t attempt to do what you read about here.
The
right way to remove it is to go to the Start Menu, to Control Panel, to
Add or Remove Programs, select “Change or Remove Programs”,
locate the program in the list, and click the “Remove”
button.
Sometimes, though, an application simply refuses to
uninstall when you want it to. In those cases, you will need to remove
it manually. Some people will tell you that it is enough to simply
delete the program’s files from “C:\Program Files” and move
on. In a very small number of cases (maybe 1 in 50) that might be true,
but most programs’ installers make any number of changes, such
as:
- Create a directory under “C:\Program Files”
named to match the application and/or its manufacturer, then fill it
with additional files and subdirectories. - Create a directory
somewhere other than “C:\Program Files” (such as one directly
under “C:\” and populate that with files and
subdirectories. - Place files and subdirectories under
“C:\Documents and Settings\All Users” and “C:\Documents
and Settings\Default User” to ensure that all users of a computer
can see that the program is available for use, to store temporary data
files, etc. - Place files in “C:\Windows\All Users” to
make them available to all users. - Create or modify one or more
INI files on the system. - Add an entry to the Registry to tell
the “Add or Remove Programs” control panel where to find the
application’s uninstaller. - Add entries to the Registry to tell
the Windows Explorer to associate this application with specific kinds
of files (e.g., “.doc” to Microsoft Word, as well as
“.rtf”). - Add entries to the Registry that store the
application’s preferences, such as what font you like to use in an
editor, where you last saved a file, where to place the application’s
window on the screen, etc. - Add DLLs and other files to the
Windows directory.
The installer might do other things,
depending on what kind of an installer it is. For example, a screen
saver installer might put some “.SCR” files in
“C:\Windows\system32″. A device driver installer might put
items in the System Tray (which it does by creating Registry entries). A
resume package might add templates to Microsoft Word
directories.
Because of all this variation, there’s no single set
of instructions I can give you that will get every file an application
might have installed 100% of the time. However, if you follow the
instructions I provide later in this article, you have a good chance of
being able to remove the bulk of the application. If you want to get rid
of ALL of it, one thing that might work for you is to follow my
instructions, then try reinstalling the application and using its own
uninstaller to remove it. That would theoretically get everything you
missed. (I have to warn you that some applications’ uninstallers don’t
remove everything they installed, either because they’re trying to keep
you from losing data you created yourself, because they’re buggy and
incomplete, or because they are cautious and trying to leave behind
files that other applications from the same manufacturer might be
using.)
One of the best ways to remove a particular application manually, if
you can do this, is to go to another machine that doesn’t have the
application installed. Install a tool like Epsilon Squared’s
InstallWatch Pro, take snapshot of the system, install the application
on it, then have InstallWatch analyze what the application’s installer
did to the computer. Using that information, you should be able to
manually remove it from the first computer and (hopefully) automatically
remove it from the second. But a second computer isn’t an option for
everyone. In these cases, you need to do some detective work to try to
figure out what an application might have installed on your system.
SUSPECT #1: An Installer Log File
One easy
way to determine what you need to do to uninstall an application is to
look for a log file it might have created during installation. For
example, Netopia’s Timbuktu Pro creates this log file (stored in
C:\Windows) during installation (some lines have been trimmed from the
file to keep the length of this article down):
06/29/2004 12:02:58 Beginning
installation of Netopia RC components.
06/29/2004 12:02:58 Microsoft
Windows 2000 version 5.1 Service Pack 1 (Build 2600)
06/29/2004 12:02:58
Installing on Windows NT.
06/29/2004 12:02:58 RC Component Logging
enabled.
06/29/2004 12:02:58 Remote Control component can
install.
06/29/2004 12:02:58 RC Log: Directory created,
“C:\WINNT\NetopiaRC”.
06/29/2004 12:02:58 RC Log: Directory created,
“C:\WINNT\TEMP\RCInstBk”.
06/29/2004 12:02:58 RC Log: Client
registered, “{43232EF0-DFA2-11d1-81F0-0000C54A2684}”.
06/29/2004
12:02:58 RC Log: Update successful, Version1 registry settings.
06/29/2004
12:02:58 RC Log: Version updated.
06/29/2004 12:02:58 RC Log: File
copy successful, “Tb2RCInst.dll” from C:\PROGRA~1\TIMBUK~1 to
C:\WINNT\NetopiaRC.
06/29/2004 12:02:58 RC Log: File deleted,
“C:\WINNT\NetopiaRC\Tb2RC.dll”.
06/29/2004 12:02:58 RC Log: File
extract successful, Tb2RC.dll to C:\WINNT\NetopiaRC.
.
.
.
06/29/2004 12:02:58
Copying [c:\progra~1\timbuk~1\tb2rcplayback.dll] to [c:\program
files\common files\netopia\tb2rcplayback.dll]
06/29/2004 12:02:58 Successfully
copied [c:\progra~1\timbuk~1\tb2rcplayback.dll] to [c:\program
files\common files\netopia\tb2rcplayback.dll]
06/29/2004 12:02:58 New Ref count
[2]
06/29/2004 12:02:58 Registered
Tb2RCPlayback.dll
06/29/2004 12:02:58 Closing log
file.
As you can see, this log gives you a pretty good
indication of where this installed stored files on this PC. It doesn’t
tell us what Registry entries it might have made, but it does provide a
very good picture of the files it installed. Unfortunately, not every
installer generates a nice, readable log file like this
one.
SUSPECT #2: Uninstaller Data
Another
good source of information is the data that the application’s own
uninstaller (if it has one) uses to perform the removal of the software.
While this data can sometimes be encrypted or compressed such that it’s
not “human readable”, often there is information we can glean
from it to help us more fully remove an application. For example, when I
looked in the directory with the freeware program Audacity, I found a
file named “unins000.exe” and a matching file named
“unins000.dat” which I guessed was the data file telling the
uninstaller how to remove Audacity. I opened this file in WordPad and
looked to see what plain text I could find in it. I found the
following:
The top portion of this list is all the files and
directories created by the installer application. The bottom portion,
starting with the “.AUP” line, tells me all the Registry
entries the installer created. If I removed those files and Registry
entries, I’d have gotten most (if not all) of Audacity
removed.
SUSPECT #3: The Installer
Itself
Installations from CD-ROM, DVD, and certain other
locations will often contain more than one file. In these cases, you’ll
see something like a “SETUP.EXE” file combined with a bunch of
other files, with extensions like “INI”, “CAB”,
“INS”, “MST”, and the like. Opening these files in
NotePad or WordPad can sometimes yield the uninstall information you
need. For example, consider this excerpt from the INF file from a Voodoo
Banshee video card:
; banshee.inf
;
; Installation inf for the 3Dfx
Interactive, Inc. Voodoo Banshee graphics adapter.
;
.
.
.
ClassGUID={4D36E968-E325-11CE-BFC1-08002BE10318}
Class=Display
DriverVer=06/06/2001,5.01.2001
[DestinationDirs]
DefaultDestDir = 11
banshee.Miniport = 12 ; drivers
banshee.Display = 11 ;
system32
.
.
.
;
; File sections
;
[banshee.Miniport]
banshee.sys
[banshee.Display]
banshee.dll
;
; Service Installation
;
.
.
.
[banshee_Service_Inst]
ServiceType = 1 ;
SERVICE_KERNEL_DRIVER
StartType = 1 ; SERVICE_SYSTEM_START
ErrorControl = 0 ; SERVICE_ERROR_IGNORE
LoadOrderGroup = Video
ServiceBinary =
%12%\banshee.sys
[banshee_EventLog_Inst]
AddReg =
banshee_EventLog_AddReg
[banshee_EventLog_AddReg]
HKR,,EventMessageFile,0×00020000,”%SystemRoot%\System32\IoLogMsg.dll;%SystemRoot%\System32\drivers\banshee.sys”
HKR,,TypesSupported,0×00010001,7
;
; General config
information
;
[banshee.GeneralConfigData]
MaximumDeviceMemoryConfiguration=68
;
; Software
Installation
;
[banshee.SoftwareSettings]
AddReg =
banshee_SoftwareDeviceSettings
DelReg =
banshee_DeleteSWSettings
[banshee_SoftwareDeviceSettings]
HKR,,
InstalledDisplayDrivers, %REG_MULTI_SZ%, banshee
HKR,, UseNonBIOSModeSet,
%REG_DWORD%, 1
HKR,, VgaCompatible, %REG_DWORD%, 0
HKR,,
CapabilityOverride, %REG_DWORD%, 0
[banshee_DeleteSWSettings]
HKR,,”GraphicsClocking”
HKR,,”MemClocking”
HKLM,”SOFTWARE\Microsoft\Windows
NT\CurrentVersion\OpenGLDrivers”,3Dfx
What can we
learn from this particular file? From “[Destination Dirs]” we
see that this driver installs files in the Windows “system32″
and “drivers” directories. From the “File section”
we can see that the driver includes two files, “banshee.sys”
and “banshee.dll”. From the lines beginning with the letters
“HK” (e.g., “HKLM, SOFTWARE\Microsoft\Windows
NT…”) we see that the installer creates 9 Registry entries and
what the names of those entries are (e.g.,
“GraphicsClocking”). Theoretically, by deleting this INF file,
the “banshee.sys” file, the “banshee.dll” file, and
the Registry entries specified here, we should completely remove the
driver for this video card.
Seeking and Destroying an
Application’s Components
But what if none of this applies
to the application you’re having a problem with? Let’s say you don’t
have the original install directory, the application didn’t come with an
uninstaller (or its data files are compressed), and you can’t find any
files that give you a clue where this application is stored. How can you
remove it?
Answering the following questions will get you started
on the right track:
- Does this application appear in the Start
Menu? If so, it probably has some shortcuts in the following locations
that you’ll need to remove:C:\Documents and Settings\All Users\Start
Menu\Programs\ - Does this application place anything
in the System Tray down near the clock in the Task Bar or does it start
up automatically when you boot Windows? If so, it probably has Registry
entries located here:HKLM\Software\Microsoft\Windows\CurrentVersion\Run
- If the application boots at startup and you don’t find
any Registry entries, it probably has something in the Startup
directory, located here:C:\Documents and Settings\<your
account>\Start Menu\Programs\Startup
C:\Documents and
Settings\All Users\Start Menu\Programs\Startup - Does
this application have a particular file type associated with it? For
instance, if you click on a “.doc” file, Microsoft Word will
automatically launch to open it if Word is installed. Acrobat Reader
will launch if you double-click a “.PDF” file. If the
application has files associated with it, there will very likely be
Registry entries under “HKEY_CLASSES_ROOT” and
“HKEY_LOCAL_MACHINE\Software\Classes” that map those file
extensions to the application. You should be able to find them by doing
a “find” in RegEdit for that extension. - Most
applications have files stored under “C:\Program Files” or in a directory
at “C:\” whose name resembles that of the manufacturer or the
application, such as “C:\Program Files\Adobe\Reader“. One
way to find out where a program’s files are stored is to click the Start
menu and make your way to the icon you would use to launch the
application. Instead of left-clicking on it to launch it, you should
right-click it and choose Properties. You’ll see a window like the
following, which tells you where the application is located:
- Some applications place screensavers in “C:\Windows\system32“.
These are files whose names generally end in “.SCR”. - Some applications place template files in the Microsoft
Office applications’ directories. The default location for those
template files is:C:\Program Files\Microsoft
Office\Templates(but they could be stored in other
places and you may have to search for those by looking for the files’
extensions, such as “.DOT” for Microsoft Word template
files) - Most applications have a Registry entry to tell
Windows where to find their uninstallers. This entry can be located
at:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- If the application involves device drivers of some
sort, you can usually uninstall those through the Device Manager. If you
need to remove them manually, the Device Manager can tell you where
those driver files are stored. Go to Start, Control Panel, then System,
then Hardware, and click “Device Manager”. Locate the device
in the list, right-click it, and choose Properties from the list. In the
Properties window, click the “Driver” tab, then the
“Driver Details” button. This will display a list of files
used by the driver, similar to the following:
- If the application adds sounds that become part of the
Windows environment (e.g., play when you login, logout, start up, shut
down, receive mail, etc.), not just sounds that play within the
application itself, you may find those at:C:\Windows\Media
- If you’ve launched the application in the past, there
is probably a Prefetch record for it located in the C:\Windows\Prefetch directory. While
you’re at it, you might as well delete those files, too. - Some applications store things in directories under
“C:\Windows“. These usually match the
name of the application or manufacturer (e.g., Netopia’s Timbuktu Pro
software creates a directory named “NetopiaRC” under the
Windows directory). - Some applications create
“.log” files in C:\Windows during their initial
installation or their normal operation. The log file might be created
elsewhere on the system. Searching by the application or manufacturer
name could help you find it. - Some applications create
“.ini” files in C:\Windows during their initial installation
or normal operation. These usually have names that match the application
(e.g., excel.ini, the device (e.g., vgacard.ini), or the functionality (e.g.,
network.ini). - Some applications place files in “C:\Program Files\Common Files” or
“C:\Program Files\Shared
Files“. Be careful deleting these, however, as multiple
applications might use the same files. If you delete them
indiscriminately, you may find that other applications stop working. - Some applications modify INF files on the system, usually NOT
the ones found in “C:\Windows\Inf” but those found
elsewhere. If you do a search for all “*.INF” files on your PC
and quickly scan through the contents of these files, you may identify
text that looks like it was added by the application you’re
removing.
The application you’re hoping to remove may do
some or all of the above. I suppose it’s possible that it does none of
these, though that would be extremely unlikely. If you remove all the
files, folders, and matching Registry entries you find using the list
above from the system, there is very little likelihood that any part of
that application remains on your system.