Finding all installed programs from the registry

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   Hi Guys,

Basically I am writing a vb.net program that finds all installed programs on a PC, exactly like Add/Remove Programs does.
So I thought all I would need to do is loop through the keys in HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall and that would be it... unfortunately not, that only gets about half of the programs installed on my PC.

From using Process Monitor to watch which registry keys Add/Remove Programs accesses, I have found that I need to look at several other keys as well.... and after playing around with this for a while I have got it to work pretty much exactly like Add/Remove Programs but it still has the odd problem where it will get say 1 more program than Add/Remove Programs does. On my Windows 7 PC my code always picks up Microsoft Choice Guard as a program, where as Add/Remove Programs does not show it. On my Windows XP test machine it picks up just one random Windows Update, which obviously Add/Remove Programs does not show unless you have the Show Updates thing ticked. I have got my code to check the ReleaseType value in each key to see if it is "Hotfix", "Update Rollup", "Service Pack" etc but the window update my program is showing does not have the ReleaseType value at all anyway :( 

So basically, I'm just wondering if there is anyone out there with a good understanding of how add/remove programs does its thing that might be able to help me out a bit?

If you want to see my VB.NET code then let me know but here is the basic logic of my program:

1. Loop through all subkeys in HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

2. For each subkey, do the following:
--Check to see if the SystemComponent value exists and is set to 1 - if it is then move on to the next subkey
--Check to see if the WindowsInstaller value exists and is set to 1 - if it is then move on to next subkey
--Check to see if the UninstallString value exists - if it does not then move on to next subkey
--Check the ReleaseType value, if it is hotix or service pack etc then move on to next subkey
--Check the ParentKeyName value, if it exists then move on to next subkey
--Check to see if the DisplayName value exists - if it does then add this name to our list of installed programs

3. Repeat this same process for all subkeys in HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall if it exists.

4. Loop through all users in HKEY_USERS and for each one, loop through the subkeys in HKU\USER-SID-HERE\Software\Microsoft\Windows\CurrentVersion\Uninstall and do the exact same thing described in step 2

5. Whilst looping through all users in HKEY_USERS, also check HKU\USER-SID-HERE\Software\Microsoft\Installer\Products and for each subkey in there do the following:
--Check to see if a subkey with the same GUID name exists in HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\USER-SID-HERE\Products - if it does then check to see if the SystemComponent value in the InstallProperties subkey is set to 1 - if it is then move on to the next subkey
--Read the ProductName value and add it to our list of installed programs

6. Loop through all subkeys in HKLM\Software\Classes\Installer\Products and for each one do the following:
--Check to see if a subkey with the same GUID name exists in HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products - if it doesnt then move on to the next subkey
--Check the SystemComponent value is not set to 1 - if it is set to 1 then move on to next subkey
--Check the WindowsInstaller value exists and is set to 1 - if it is not then move to next subkey
--Read the ProductName value and add it to our list of installed programs

THE END 

Anyone see anything I am missing or doing wrong? Like I said, this works fairly well but just seems to show one or two programs that Add/Remove Programs does not for some reason...
One thing I am also particularly struggling with is how Windows determines whether an installed program is an update or not. If it has the ReleaseType value or ParentKeyName set then its easy to tell but if not then I dont understand how it knows its not just another normal program..

Thanks!
Chris