[5T8]

Hello,

I am a new user to TU, i monitored some installations with TU 5.4.2 but found they all include data from my security programs. See this screenshot for what i mean:

http://i30.tinypic.com/a4xwr6.jpg

All the stuff boxed in red belongs to Norton 2010 and Outpost Pro Firewall and are not part of the monitored "IcoFX" program.

If i uninstall "IcoFX" will it also remove the parts of my security software and break it?

Thanks!

[Mr.B]

yes will be removed if you dont exclude\remove items from your log
best practice is not to run other programs at all while monitoring,
undesired items & values will be captured and it will be a mess sorting such logs.
preferrably exclude captured system items as well on a fresh machine.

tu would be the first item to install on a fresh pc & will help greatly keeping your pc top notch
also read up a little in the manual so you dont break your os-installation

[5T8]

Ahh ha, thank you very much for your reply Mr.B it's much appreciated

Yes i have a new OS installed (well an 8yo XP SP3) but just freshly re-installed last week, it has very little software besides Windows Updates and Service Packs plus my security software. That's what prompted me to buy TU, to keep it good from the beginning. But i didn't monitor my security software, i wanted to get that on before downloading anything.

I read the manual and all made sense except for this issue. This bit confused me a little:

Shared files
· Shared files are used to store program code or data that is supposed to be shared between two or more programs. The installers define a counter in registry to keep track of the number of programs that uses the same shared file.
· Installers increment the shared file counter. Uninstallers decrease the counter for each uninstalled program that uses that shared file. The zero value for counter indicate that the file is no longer used and can be removed from system.
· Like any uninstaller program Total Uninstall decrements the shared file counter and suggest to remove the shared files if the counter reach zero.
· The shared files are always deleted to Recycle Bin.

I was not sure if TU would know those files in my screenshot were shared with other programs and skip them, or ask me what to do... Or just zap them. I feared the worst, and it seems i made a wise decision.

Somehow i think using monitored is not a good idea for me, i see registry entries for my mouse drivers amongst other things in the monitored log of all programs. Also disabling my security software when installing random things off the net is something i don't want to do.. That's when i need it most.

How about if.. I uninstall all my security software and mouse driver, install TU then reinstall the security software and mouse driver through TU as monitored.. Would TU then know and exclude these log entries from all future monitored programs?

Thanks again for any help, i'd love to get this working right because the Monitored feature is the main reason i bought TU.

[Mr.B]

im always using monitored mode because reflects\restores changes to registry to mention one of it´s advantages
put security software in resume\or exit, shutdown any other software that you fear may end up in tu´s log
consider disabling inet while monitoring thus keeping items\values away from undesired network connections

items still occuring not being relevant to install´s, either remove from log or add to exclusion and they wont appear again

stick with monitored mode hence analyzed mode will not fetch everything,
monitored mode will fetch\clean & restore

it may seems like a painful procedure, but once you get used to tu it goes very quickly
from full logs you can cleanup undesired shortcuts\files\folders, export registry settings from software and save for later use etc
monitored mode gives a much greater payoff

[5T8]

I'm very greatfull for your help Mr.B

The trouble with disconnecting from the net is many malware can reside in RAM, or on the file system and and check for connectivity before sending the payload, or do it at reboot or shutdown, install hidden drivers etc as you install the real program. A lot of damage can be done when installing things, you must be careful.

items still occuring not being relevant to install´s, either remove from log or add to exclusion and they wont appear again

stick with monitored mode hence analyzed mode will not fetch everything,
monitored mode will fetch\clean & restore

it may seems like a painful procedure, but once you get used to tu it goes very quickly
from full logs you can cleanup undesired shortcuts\files\folders, export registry settings from software and save for later use etc
monitored mode gives a much greater payoff

That's perfect! Your comment about "add exclusion" just led me to find that option i didn't realize it existed. Now that's the ideal solution, i don't have to disable security and i can "teach" TU.

For anyone wondering the same i have done a screenshot. Install a monitored program, then expand and view all it's files. Find unwanted files from security programs etc, follow it up to it's parent folder and exclude the parent folder. Here i have added the main "Norton" folder to scan exclusion:



Note, don't go to high and exclude "Program Files", "Application Data" or any main files like that. Doing this has taught TU to ignore the "Norton" folder, and the files under it.

Thanks Mr.B for this solution it works perfect.

[uninstaller]

Note that Total Uninstall doesn't restore modified files. So even if in the log appears some antivirus related files as modified these will not be touched on uninstall. However, using exclude/ignore lists will make the install logs more clean.