Archived from groups: microsoft.public.windowsme.general (
More info?)
hkey_local_machine\system\current control set\control\session
manager\checkbadapps
This appears to be a list of applications which Windows checks for and
finding
these entries does not mean that these applications ever existed on the
subject
computer.
Some of the applications found in this registry key are:
Shred.exe
Wipeinfo.exe
Secure.exe
http://archives.neohapsis.com/archives/sf/forensics/2003-q3/0023.html
------
On some win98 installations, there are 2 SessionManager keys so you have to
choose the one that contains the keys AppPatches, CheckBadApps and
CheckVerDLLs.
http://forums.infoprosjoint.net/archive/index.php/t-129
------
Session Manager subkey w/wo space
Through an apparent design bug (or else interesting "feature"), you are
likely to have two separate Session Manager subkeys in your registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager, and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager,
the difference being the presence or absence of a space between the words
"Session" and "Manager".
The original subkey -- the one with a space -- contains system start-up
information such as environment variables and cache size. We plan to cover
this in more detail in a future tip.
The one without a space contains one or more "CheckBadApps" subkeys, and
these are used for the detection of non-compliant applications. It is a
matter of opinion whether this should be classified as system start-up
information as well.
No fix is recommended.
http://www.pittresearch.com/networks/NTtips.html#tip017
------
**** You should not edit or remove any part of this key. jem.
--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you:
http://www.dts-L.org/goodpost.htm
In Memorium: Alex Nichol
http://www.microsoft.com/windowsxp/expertzone/meetexperts/nichol.mspx
Your cooperation is very appreciated.
------
"AAH" <aah@chakcomnet.net> wrote in message
news:eZD851seFHA.3880@tk2msftngp13.phx.gbl...
>
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\CheckBadA
> pps
>
> Under CheckBadApps there are quite a lot DOS and windows mixture of files.
> Quite a few do not appear to be on hd.
> Are these files are leftover by the various applications which has been
> un-installed and if so, is it safe to remove these ones.
> Thanks.
>
>