TC7.5b2 writes to registry and...

The behaviour described in the bug report is either by design, or would be far too complex/time-consuming to be changed

Moderators: white, Hacker, petermad, Stefan2

Post Reply
User avatar
artt
Junior Member
Junior Member
Posts: 50
Joined: 2009-05-03, 07:03 UTC

TC7.5b2 writes to registry and...

Post by *artt »

Hi and Thank you very much for Total Commander!

I just tried TC7.5 beta 2 and found that it writes to windows registry and creates an empty folder outside it's folder!

Procedure:
- I Download TCb2 and extract(not install) all files folders to a temp dir.
- I Create "c:\TotalCommander" folder and move all files from temp dir to this folder except language files that moved to "c:\TotalCommander\language".
- I Create an empty file "c:\TotalCommander\wincmd.ini" (i didn't use my old wincmd.ini file in order to make a fresh install)
- I Run "Total Uninstall - martau com" and take a system snapshot.
- I Run [C:\TOTALCMD\totalcmd.exe /i="C:\TOTALCMD\wincmd.ini" /f="C:\TOTALCMD\wcx_ftp.ini" /l="C:" /r="C:"]
- I used TC for about half an hour, create some buttons, configure appearance, fonts, etc.
- I Exit TC and let "Total Uninstall" to found system changes.

Total Uninstall show me next system changes:
- New folder created "C:\Documents and Settings\Administrator\Local Settings\Application Data\GHISLER" (empty).
- Registry changes:

Code: Select all

REGEDIT4

; Generated by Total Uninstall


[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdConnected]
@="Connected (FTP)"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdCopyComplete]
@="Copy/Move complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdDeleteComplete]
@="Delete complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdPackComplete]
@="Pack complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdSearchComplete]
@="Search complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdTransferComplete]
@="Transfer complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdUnpackComplete]
@="Unpack complete"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd]
@="Total Commander"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdConnected]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdCopyComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdDeleteComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdPackComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdSearchComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdTransferComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdUnpackComplete]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}]
"BarSize"=hex:CC,00,00,00,00,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant]
"Actor"="c:\\windows\\srchasst\\chars\\rover.acs"
"UsageCount"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\fa0]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\fa1]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\fa2]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\fa4]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\fa5]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\fa6]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\fa8]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\fa9]

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\Tips\SrchAssCtl\faa]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"b"="C:\\TOTALCMD\\LIBRARY\\SETUP\\DEFAULT.BAR"
"MRUList"="ba"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\BAR]
"a"="C:\\TOTALCMD\\LIBRARY\\SETUP\\DEFAULT.BAR"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BAR]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BAR\OpenWithList]
"a"="totalcmd.exe"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini\OpenWithList]
"a"="NOTEPAD.EXE"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini\OpenWithProgids]
"inifile"=hex(0):

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009050320090504]
"CacheLimit"=dword:00002000
"CacheOptions"=dword:0000000B
"CachePath"=hex(2):25,55,53,45,52,50,52,4F,46,49,4C,45,25,5C,4C,6F,63,61,6C,20,\
  53,65,74,74,69,6E,67,73,5C,48,69,73,74,6F,72,79,5C,48,69,73,74,6F,72,79,2E,\
  49,45,35,5C,4D,53,48,69,73,74,30,31,32,30,30,39,30,35,30,33,32,30,30,39,30,\
  35,30,34,00
"CachePrefix"=":2009050320090504: "
"CacheRepair"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{2559A1F4-21D7-11D4-BDAF-00C04F60B9F0} {000214E6-0000-0000-C000-000000000046} 0x401"=hex:00,\
  00,00,00,31,00,36,00,32,46,1F,C0,B6,CB,C9,01

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318}\0015\GlobalSettings\Cmplx\Node001]
"Chan000"=dword:FFDE0438
"Chan001"=dword:FFDE0438
"Chan002"=dword:FFDE0438
"Chan003"=dword:FFDE0438
"Chan004"=dword:FFDE0438
"Chan005"=dword:FFDE0438
"Chan006"=dword:FFDE0438
"Chan007"=dword:FFDE0438
- Why the above folder created outside of TC folder?
- What all these registry changes are about?
- I used to use TC from my flash drive (portable) and i didn't detect older TC versions to make any system changes to systems that i pluged my flash drive and run it!

PLEASE KEEP TC PORTABLE


OPR=Windows XP Pro Eng SP3, RAM=2GB, CPU=P4 3Gh dual core
regards

artt
Top
User avatar
sqa_wizard
Power Member
Power Member
Posts: 3864
Joined: 2003-02-06, 11:41 UTC
Location: Germany

Post by *sqa_wizard »

- Why the above folder created outside of TC folder?
This folder will store your thumbnails created by TC.

Set by menu: Configuration - Options - Operation - Thumbnails
Just clear field "Database Location" to disable caching.

... or set wincmd.ini entry manually: ThumbsLocation=
#5767 Personal license
Top
User avatar
karlchen
Power Member
Power Member
Posts: 4603
Joined: 2003-02-06, 22:23 UTC
Location: Germany

Post by *karlchen »

Hello, artt.
- What all these registry changes are about?
All of the registry entries which "Total Uninstall" recorded have been created by Windows itself, none of them has been created by Total Commander.
<corrected>
Not true, please, see Lefteous's post and here.
</corrected>

Maybe you get an idea now how many details Windows will record automatically whenever you use any application, no matter which one.

"Total Uninstall" like any snapshot utility just takes a snapshot before an installation and compares it to a second snapshot taken after the installation and displays the differences. "Total Uninstall" very obviously has got no idea whatsoever who is responsible for the changes which it finds.

Total Commander 7.50 PB2 is as portable as any previous T.C. version.

Kind regards,
Karl
--
Could a moderator, please, move this thread to the normal Total Commander (English), because no bug has been reported at all, in particular none which affects T.C. 7.50 PB2. :wink:
Last edited by karlchen on 2009-05-03, 14:12 UTC, edited 1 time in total.
Top
User avatar
Lefteous
Power Member
Power Member
Posts: 9535
Joined: 2003-02-09, 01:18 UTC
Location: Germany
Contact:
Contact Lefteous

Post by *Lefteous »

The HKEY_CURRENT_USER\AppEvents\* registry keys are created by TC to assign audio files to certain program events like "search complete". I'm not sure if there is another way to handle such events as using the mechanism provided by Windows.
Top
User avatar
karlchen
Power Member
Power Member
Posts: 4603
Joined: 2003-02-06, 22:23 UTC
Location: Germany

Post by *karlchen »

Hi, Lefteous.
The HKEY_CURRENT_USER\AppEvents\* registry keys are created by TC to assign audio files to certain program events like "search complete". I'm not sure if there is another way to handle such events as using the mechanism provided by Windows.
Ok, you have caught me red- handed or Total Commander rather. :lol:
Yet, it does not do so here, because no sounds have been assigned to any T.C. actions here.
Moreover, any old T.C. version would have created the same registry entries as well. So this has not changed in T.C. 7.50 PB2. And it does not constitute a bug.
T.C. has never been designed to be a stealth application which does not leave behind any traces on a Windows system. It can be used as a portable application very easily. But depending on what you do it will leave behind traces on a Windows system. This has always been the case, at least ever since 1998 (v3.53).

Cheers,
Karl
Top
User avatar
karlchen
Power Member
Power Member
Posts: 4603
Joined: 2003-02-06, 22:23 UTC
Location: Germany

Post by *karlchen »

Hi, artt.

To be precise:
[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdConnected]
@="Connected (FTP)"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdCopyComplete]
@="Copy/Move complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdDeleteComplete]
@="Delete complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdPackComplete]
@="Pack complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdSearchComplete]
@="Search complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdTransferComplete]
@="Transfer complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdUnpackComplete]
@="Unpack complete"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd]
@="Total Commander"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdConnected]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdCopyComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdDeleteComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdPackComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdSearchComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdTransferComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdUnpackComplete]
These registry keys have been created by Total Commander, because you assigned sounds to particular events. Any Total Commander version prior to v7.50 PB2 would have created / modified the same registry keys, in case you had assigned sounds to particular T.C. events.

The following registry keys have been created / modified by Windows itself, because you have used Total Commander and performed some actions with the help of Total Commander.
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"b"="C:\\TOTALCMD\\LIBRARY\\SETUP\\DEFAULT.BAR"
"MRUList"="ba"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\BAR]
"a"="C:\\TOTALCMD\\LIBRARY\\SETUP\\DEFAULT.BAR"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BAR]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BAR\OpenWithList]
"a"="totalcmd.exe"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini\OpenWithList]
"a"="NOTEPAD.EXE"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini\OpenWithProgids]
"inifile"=hex(0):

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
The same registry keys would have been created / modified by Windows in case you had performed the same steps using any other Total Commander version as well.

The following registry keys do not hold any reference to Total Commander at all. The first one very obviously has been caused by Internet Explorer. The rest: I do not know.
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009050320090504]
"CacheLimit"=dword:00002000
"CacheOptions"=dword:0000000B
"CachePath"=hex(2):25,55,53,45,52,50,52,4F,46,49,4C,45,25,5C,4C,6F,63,61,6C,20,\
53,65,74,74,69,6E,67,73,5C,48,69,73,74,6F,72,79,5C,48,69,73,74,6F,72,79,2E,\
49,45,35,5C,4D,53,48,69,73,74,30,31,32,30,30,39,30,35,30,33,32,30,30,39,30,\
35,30,34,00
"CachePrefix"=":2009050320090504: "
"CacheRepair"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{2559A1F4-21D7-11D4-BDAF-00C04F60B9F0} {000214E6-0000-0000-C000-000000000046} 0x401"=hex:00,\
00,00,00,31,00,36,00,32,46,1F,C0,B6,CB,C9,01

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318}\0015\GlobalSettings\Cmplx\Node001]
"Chan000"=dword:FFDE0438
"Chan001"=dword:FFDE0438
"Chan002"=dword:FFDE0438
"Chan003"=dword:FFDE0438
"Chan004"=dword:FFDE0438
"Chan005"=dword:FFDE0438
"Chan006"=dword:FFDE0438
"Chan007"=dword:FFDE0438
If you really want to find out which files and folders and which registry keys are created / modified by Total Commander, you may have to use a programme like Sysinternals Process Monitor which monitors filesystem and registry activities in real time.

Still I insist that T.C. 7.50 PB2 is as portable and leaves behind as many or as little traces on a Windows XP system as any previous T.C. version.

Cheers,
Karl
Top
User avatar
Lefteous
Power Member
Power Member
Posts: 9535
Joined: 2003-02-09, 01:18 UTC
Location: Germany
Contact:
Contact Lefteous

Post by *Lefteous »

A great way to stop Windows writing anything related to associations is to create a new internal associations covering all files (*.*) link them to the internal Lister and then don't execute anythng related to Windows associations like "open with". This *.* associations will lead to a kind of learning mode. You can start creating portabel associations from scratch without being irritated by existing Windows associations.
Top
User avatar
artt
Junior Member
Junior Member
Posts: 50
Joined: 2009-05-03, 07:03 UTC

Post by *artt »

Thank you all for the information.

Note please that, as i said, i am already using TC (v7.04a and other versions before this) every day and these registry keys are all new. They were created Only by v7.5b2 and not by any previous version.

Of course these registry keys are not affecting TC's portability, but i show them created, i thought that something went wrong (it is a beta version) and i wanted to report what i found.

Cheers
artt
Top
User avatar
artt
Junior Member
Junior Member
Posts: 50
Joined: 2009-05-03, 07:03 UTC

Post by *artt »

ok i found it!

According to Lefteous and karlchen info:
[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdConnected]
@="Connected (FTP)"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdCopyComplete]
@="Copy/Move complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdDeleteComplete]
@="Delete complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdPackComplete]
@="Pack complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdSearchComplete]
@="Search complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdTransferComplete]
@="Transfer complete"

[HKEY_CURRENT_USER\AppEvents\EventLabels\WincmdUnpackComplete]
@="Unpack complete"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd]
@="Total Commander"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdConnected]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdCopyComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdDeleteComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdPackComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdSearchComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdTransferComplete]

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Wincmd\WincmdUnpackComplete]
These registry keys have been created by Total Commander, because you assigned sounds to particular events.
I found that these key were created when i click on button "Configuration/Options/Misc./[Custom Sounds] configure".
A window "Sounds and Audio Devices Properties" opened and although i didn't change something in it, these key were created.

Thank you all for your help
Regards

artt
Top
User avatar
ghisler(Author)
Site Admin
Site Admin
Posts: 48088
Joined: 2003-02-04, 09:46 UTC
Location: Switzerland
Contact:
Contact ghisler(Author)

Post by *ghisler(Author) »

I found that these key were created when i click on button "Configuration/Options/Misc./[Custom Sounds] configure".
A window "Sounds and Audio Devices Properties" opened and although i didn't change something in it, these key were created.
Indeed the keys are only created when you use that option, so you can use the usual Explorer tool to change the sounds. The sounds will of course be specific to that user account (non-portable).
Author of Total Commander
https://www.ghisler.com
Top
User avatar
artt
Junior Member
Junior Member
Posts: 50
Joined: 2009-05-03, 07:03 UTC

Post by *artt »

I see - Thank you ghisler.

Regards
artt
Top
Post Reply

Return to “TC Behaviour which will not be changed”