Add/remove program or Uninstall log files of Windows XP

Posted on 2011-10-23
Medium Priority
Last Modified: 2012-05-12

When a software is uninstalled using the uninstaller that comes with it or using
"Add/Remove Programs" from Control Panel, which are the logfiles which log
down the uninstallation ? (ie indicating date/time of uninstallation & who did it)?

Pls provide the exact logfile name(s) & the folder(s) it's located
Question by:sunhux
  • 4
  • 2
  • 2

Accepted Solution

raysonlee earned 660 total points
ID: 37015914
Depends on the software you are uninstalling, it may have it's own log file. However there isn't any centralized log in XP for recording that. You can use third party solution if you want to keep a log though.

Author Comment

ID: 37016076

Can you provide an example, say I'm uninstalling MS Office 2003, what is its logfile
name & in which folder it's located?

Author Comment

ID: 37016135

I just used "Add/Remove Programs" to uninstall "FIle Scavenger" & the following
logs are today's date.  Any chance one of them would have logged down the

10/24/2011  09:24 AM               120 asl.092416_24Oct11.log
10/24/2011  11:59 AM            66,843 updater.log
10/24/2011  11:59 AM            47,364 aumLib.log
10/24/2011  01:30 PM             1,589 WCESCOMM.LOG
10/24/2011  01:30 PM           964,339 WCESLog.log
10/24/2011  01:46 PM         1,025,888 WCESMgr.log
10/24/2011  01:08 PM           635,472 eps.log
10/24/2011  09:16 AM           159,397 EPSDriver.log
10/24/2011  09:16 AM             2,495 SMax.log
10/24/2011  01:41 PM         1,196,184 ssapi.log
10/24/2011  01:41 PM            36,723 Conn_20111024.log
10/24/2011  09:08 AM           766,294 engine.log
10/24/2011  09:17 AM           425,253 rr.log
10/24/2011  09:08 AM                 0 0.log
10/24/2011  09:07 AM               159 wiadebug.log
10/24/2011  09:07 AM                50 wiaservc.log
10/24/2011  01:43 PM         1,628,672 WindowsUpdate.log
10/24/2011  09:07 AM                 0 PASSWD.LOG
10/24/2011  12:52 PM            42,690 userenv.log
10/24/2011  09:07 AM           833,004 tvDebug.log
10/24/2011  01:04 PM           589,382 ReportingEvents.log
10/24/2011  01:47 PM           131,072 edb.log
10/24/2011  11:53 AM         2,114,688 TPAPSLOG.LOG
10/24/2011  11:37 AM           798,336 TPHDLOG0.LOG
10/24/2011  09:07 AM            11,034 FrameWork.log
10/24/2011  01:48 PM            18,952 wbemcore.log
10/24/2011  09:17 AM             7,764 wbemess.log
10/24/2011  09:11 AM            23,281 wmiprov.log
10/24/2011  01:00 PM             1,812 MSI631dc.LOG
Cyber Threats to Small Businesses (Part 1)

This past May, Webroot surveyed more than 600 IT decision-makers at medium-sized companies to see how these small businesses perceived new threats facing their organizations.  Read what Webroot CISO, Gary Hayslip, has to say about the survey in part 1 of this 2-part blog series.

LVL 93

Assisted Solution

nobus earned 660 total points
ID: 37016349
In case the program was uninstalled using Microsoft Installer you will find events from source "MsiInstaller".
in registry, look in  Local User_Software

also :  http://forum.codecall.net/c-c/20055-log-when-programs-installed-uninstalled.html
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Uninstall
There will be a series of entries like {C048FF98-29A3-8F10-19EA840218C2}. For each of these entries, you can read the subkey DisplayName to get the user-readable name of the program such as "Adobe Reader 9.0".
Other subkeys of interest:
 ModifyPath - contains path to the program that allows you to modify the installation, such as enabling plugins, etc.
 UninstallString - contains the command to uninstall the program.
Be sure to check these strings before you execute them, as they may be null or contain values like "Not Available."

you can also use a nother uninstaller  : REVO : http://www.revouninstaller.com/      

Assisted Solution

raysonlee earned 660 total points
ID: 37016392
Try Total Uninstall from http://www.martau.com. It records down all changes during uninstall.
LVL 93

Assisted Solution

nobus earned 660 total points
ID: 37017166
Revo is 30 day FREE - and afaik better than normal uninstallers ; but i don't know (never checked) if it records the uninstalls

Author Comment

ID: 37035811

> also :  http://forum.codecall.net/c-c/20055-log-when-programs-installed-uninstalled.html
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Uninstall
> There will be a series of entries like {C048FF98-29A3-8F10-19EA840218C2}. For each of these
> entries, you can read the subkey DisplayName

So the above entries only give an indication that a program was previously there &
was uninstalled but not the actual logs/date of when it was uninstalled?  These entries
will remain there permanently or they can be removed?

Author Closing Comment

ID: 37166675

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
It’s been over a month into 2017, and there is already a sophisticated Gmail phishing email making it rounds. New techniques and tactics, have given hackers a way to authentically impersonate your contacts.How it Works The attack works by targeti…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question