False positives - Version installed is not correct

[RabbitWolf]

Hi,

I am a long time Sumo user and a new user to UCheck (Premium) 5.0.4.0.

One problem I have found is that the program doesn't find the actual version of an installed program. It thinks a previous version is installed. For example, UCheck reports that I have HWiNFO64 V7.40 installed with a new version, 7.64 available. However, I have version 7.64 installed. I have found this problem with a number of my programs.

Question, is UCheck using the version reported in the Programs and Features - Uninstall or change a program list as the installed version? If so, this is the problem. If a program has an update feature that updates the program for the user, it does not always update the version reported in the registry. The actual .exe version needs to be checked.

Also, I get false positives for Mozilla Firefox and Mozilla Thunderbird because of how they are listed in the Programs and Features - Uninstall or change a program list as shown in the attachment.

Thank You,
Tracy

[shoek]

Completely agree... checking the EXE is necessary to compete with the completeness and accuracy that SUMo had.
App updates often do not completely update their HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall entry in the registry and therefore can only be relied upon as a secondary source.

[Curson]

Hi RabbitWolf, shoek,

Welcome to Adlice.com Forum.

Yes, at the moment only the Uninstall Registry key is checked.
EXE version information is not 100% reliable either. We are thinking of combining both sources.

Tracy, am I right to assume that you have both Firefox stable and ESR installed ? Same for Thunderbird ?
Could you please attach UCheck latest scan report with your next reply ?

Regards.

[RabbitWolf]

Hi Curson,

I only have the standard versions of Firefox and Thunderbird installed. I have attached my scan report.

Thank You,
Tracy

[Curson]

Hi Tracy,

Code: [Select]

C:\Comm\Internet\Mozilla Firefox
C:\Comm\Internet\Mozilla Thunderbird
Are these portable versions ?

Regards.

[dking02]

You seem to have a very strange installation of these older versions of HWINFO64, Firefox and Thunderbird. These old 64-bit versions are shown below located in non-standard folders (C:\System, C:\Comm) rather than in Program Files. These old versions appear to date from Feb 2023. Are the files for the old versions still present in the stated locations on the C: drive? Someone went to some effort to set up separate folders for System, Comm, Multimedia, Software, Reference, etc. on the C: drive. Were these old versions "installed" as portable programs? Normally, a portable program would not have an uninstall entry in the registry or a separate uninstall executable.

All three programs are fully supported as installed UCheck-compatible programs (not as community programs or portable programs). UCheck is picking up the entry for the old version in the registry and correctly identifying that there is a later update. You indicate the new version is already installed on your machine. Presumably this is the second entry shown in your screenshot from Programs & Features. Is there a second uninstall entry in the registry for the updated version of these programs? Where is the new installation located, C: or D: \Program Files?

--

Code: [Select]

User: RabbitWolf

HWiNFO64 Version 7.40 (64-bit), version 7.40
  [+] Available Version        : 7.64
  [+] Size                     : 7.82 MB
  [+] Wow6432                  : No
  [+] Portable                 : No
  [+] update_location          : C:\System\HWiNFO64\

Mozilla Firefox (x64 en-US) (64-bit), version 108.0.2
  [+] Available Version        : 119.0.1
  [+] Size                     : 212 MB
  [+] Wow6432                  : No
  [+] Portable                 : No
  [+] update_location          : C:\Comm\Internet\Mozilla Firefox

Mozilla Thunderbird (x64 en-US) (64-bit), version 115.0
  [+] Available Version        : 115.4.2
  [+] Size                     : 238 MB
  [+] Wow6432                  : No
  [+] Portable                 : No
  [+] update_location          : C:\Comm\Internet\Mozilla Thunderbird

---

HWiNFO64 Version 7.40 (64 bits), version 7.40
  [+] Uninstall           : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HWiNFO64_is1
  [+] Location            : C:\System\HWiNFO64\

Mozilla Firefox (x64 en-US) (64 bits), version 108.0.2
  [+] Uninstall           : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 108.0.2 (x64 en-US)
  [+] Location            : C:\Comm\Internet\Mozilla Firefox

Mozilla Thunderbird (x64 en-US) (64 bits), version 115.0
  [+] Uninstall           : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 115.0 (x64 en-US)
  [+] Location            : C:\Comm\Internet\Mozilla Thunderbird[/tt]



[RabbitWolf]

Hi Curson,

No, these are not portable versions.

Tracy

[RabbitWolf]

Hi dking02,

I install most of my programs to non-standard folders. The old versions are not installed. The second entries are, in fact, for the updated versions. The updated versions are installed in the same location as the original version. Nothing is installed in \Program Files. The programs are installed in the reported directories and have only been installed to these directories.

Tracy

[dking02]

It appears that the uninstall data for the old version is still present in the registry which would explain why Programs & Features shows entries for both old an new versions and why UCheck detects that an update is needed.

If both versions are present in the registry and showing in Programs & Features but the new version is the one actually installed in the same location, I would try uninstalling the old version by right-clicking on it in Programs and Features to see if tht removes its entry and then reinstall the new version (since files may have been deleted by the uninstall). An alternative would be to go into the registry and delete the uinstall entry for the old version shown below.

Experiment with HWINFO64 first as a test case since it is a very simple install.

You might also first try looking at the uninstall data for HWINFO64 (and other affected programs) in the registry using the NirSoft utility "UninstallView" to verify that there are two entries. UninstallView is available for download at:https://www.nirsoft.net/utils/uninstall_view.html. It is portable so all you have to do is cclick on its .exe file and it will display a detailed view of the uninstall data for all installed programs.

HWiNFO64 Version 7.40 (64 bits), version 7.40
Uninstall: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HWiNFO64_is1
Location: C:\System\HWiNFO64\

[Curson]

Hi,

As dking02 said, it seems the uninstall data for the old versions is still present in the Registry.
Please excute the following Registry fix to solve this.

Code: [Select]

Windows Registry Editor Version 5.00

[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 108.0.2 (x64 en-US)]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 115.0 (x64 en-US)]
However, the key for HWiNFO64 seems to not have been updated at all.

Regards.