Does anyone know of a decent freeware piece of software for tracking all (file/registry etc) changes that a piece of software makes during installation and hopefully one that allows all changes to be reversed (perhaps asking too much).

Also, I'm late to the bandwagon with Win 7, but my 64 bit Professional version seems to be using 1.2GB of 8GB total ram sitting there doing nothing (haven't installed anything yet). This seems absurd, is there any way to reduce ram usage?.

I just installed the same version, and after installing firewall, AV and everything else I consider necessary, and changed all settings the way I wanted, it used 470 MB and 36 processes.
But I can't see why yours uses 1200 MB, that's insane if you haven't installed anything.

Now before some someone says "RAM is supposed to be used, unused RAM doesn't give you anything, RAM is cheap blabla", let me say this:
RAM usage isn't the issue primarily, but it's an indication of programs and processes running in the background that makes the computer less responsive.
For the same reason, people do clean installs on new computers.

I've seen new laptops having 90 processes from the start, now that's retarded. All those utilities and help functions only makes the computer slower, and usually replaces functions that you either don't need, or are already present in Windows. That computer didn't work with WLAN, and I couldn't install a bluetooth device, until I did a reinstall.

1 - Open task monitor and check the number of processes running in the lower left corner. Anything over 45 is abnormal if you really haven't installed ANYTHING.

2 - Open start menu and type msconfig and then enter. Open the Autostart tab. How many programs are listed?

3 - Did you perform a clean install, or did you upgrade, leaving all programs from your old installation?

There used to be a bunch of sharewares who did that. PC Mag had a program called InControl or InCtrl. Some of them used to be good at reversing changes.
Now I'd probably use Microsoft's tools (they've bought SysInternals). What's the name of the main tool which logs activity? Process Monitor I think. There are others. But I don't think they're much if any good at reversing changes.
Windows is so complicated now, with so many poorly documented nooks and crannies. Nothing will track every possible change. You'll have to run several programs if you want more comprehensive coverage.
I'd use a backup for reversing changes. Windows keeps getting fatter but hardware gets faster even quicker and you can restore a image fairly quickly now. Even better: simply run the software you want to "cancel" in a throwaway copy of a VM.

Win 7 doesn't reserve that much RAM for itself. It can run on 512M if you've got an old box or if you're cheap. You're making loads of RAM available so it's using it (better than letting it go to waste). But it'll let a program that actually needs the RAM use it. If you want to know how much RAM Windows actually takes up, you'll have to be more discriminating in choosing what values to watch.

Mats, you're probably not looking at the right value either. I know Windows doesn't make it easy but it's obviously not using 470M. Maybe that's your firewall, AV and so on. But I doubt it. 470 M is more reasonable than 1.2G but still excessive. There are several ways to use RAM and not all are indicative of programs running in the background. It could simply be used as cache. Sometimes Windows reports RAM allocation rather than usage. The only time you should have free RAM is if the system has just unloaded a lot of stuff from RAM (because you've deleted files, closed a heavy application, unmounted a partition or something).

Well I know that, I could get overly technical and refer to sysinternals programs, but what's the point?
I'm simply talking about what the task manager tells me in this situation, which isn't what Windows uses only, and I never said it was.

But if I use VM, I have to install/run a whole operating system in a VM just to run applications in a VM, no?. Is there any way to run just applications in a VM on top of non-VM OS. How are others who install/uninstall a lot of different software keeping their system as it was prior to install/uninstalls (rather than just reg cleaners, uninstallers which sometimes leave things changed).

OK, so what should I be looking at/for then?.

Mats:
The task manager has several values, none of which are very useful or easy to interpret. I don't know how you could guess much about what's running on a system without looking at the "processes" tab.
In any case comparisons are pointless since you don't know what value the OP is looking at. And we don't know what you're talking about either.

Gangrel:
I think Win 7's resource monitor has an easy to understand visualization of memory usage with meaningful values you can quote.

Yeah, using a VM is cumbersome. Plus you may not be allowed to do so without having an extra Windows license!
I think most people have either given up on installing random software or given up on keeping their system unchanged. You could try the old sharewares (it works well for the registry but you'll need to have a backup and restore files manually), limited priviledges or some kind of sandboxing. But I think you'd be fighting a losing battle. VMs are the future.
If you care to fiddle with this stuff, it's not too hard to backup and restore system files, the registry and so on from another operating system. It's faster than to backup/restore whole partitions. But if you want to reverse changing without shutting Windows down, you'll have to depend on Microsoft tools like Shadow Copy (is that the proper name?) and so on. I wouldn't bet on your success but you can try. The registry is probably going to be the easiest thing to restore (as I mentionned above).
Other operating systems are also the only thing you can trust if you're going to run untrustworthy software. It seems rootkits exist on Windows too so you're never know for sure that everything has been cleaned from within the potentially altered OS

Stop making things up. I'm not guessing anything, I'm looking at the value that has a graph. There are better ways to check RAM usage, like I said.

Mats: What you say about RAM isn't true anymore in Win 7 because of superfetch. Superfetch will vary it's RAM usage depending on how much you have and how much is needed. If you have a lot of RAM it will take a lot at startup until something else needs it. If you don't have much RAM it will take less. It also will make your computer MORE responsive, not less as you claim. This has been backed up in many benchmarks. The only thing making your computer less responsive is the stuff you installed after Windows.

If you have a good SSD you can turn off superfetch and probably not notice, but it's not hurting anything and will still help if you have mechanical drives as well.

No you're wrong, I'm obviously not not talking about the RAM used by superfetch/cache since that's not the value in the graph.
What superfetch uses makes the system more responsive, like you say.

Umm, NO. The RAM used by superfetch is separate from cache and IS included in the memory graph in task manager.

I just tried it on one of my systems here. Stopping the superfetch service dropped the memory graph in task manager by almost 500 MB.

What's the graph about anyway? I haven't looked at it in 7 but it used to be entitled PF usage in XP. It wasn't about RAM exactly and definitely not about "PF usage" in spite of the title! It was more like commit charge but he numbers didn't add up. The resource monitor in W7 is a massive improvement in user-friendly memory reporting if you ask me.

I tried the same, it dropped 20 MB. I thought that was very little so I tried another computer, but that one only dropped 50 MB. I expected a lot more.

How much RAM do you have, how much were other apps using, are you using readyboost and do you have an SSD? All of those can vary how much RAM superfetch will try to use. More RAM will make it use more. Memory usage from applications, readyboost and SSDs will make it use less.

You said you normally install third party AV and firewalls, that alone can put a lot of memory pressure on a system with out tonnes of RAM.

3 GB on both, no readyboost and no SSD, haven't used many programs since boot, especially not memory hungry ones.

What you are seeing is about right then, given your memory and use of third party AV. AV can really kill superfech. All the extra I/O from the AV "tricks" superfetch into leaving the memory for regular cache.

My test was on a system with 8 GB, a few apps open and no AV.

Thanks for the tip!

Does MSE have the same effect on superfetch?

Superfetch should be turned off for SSD drives only, not the whole system (assuming you have some regular disk drives other than SSD). I used the Intel SSD Tool Box to turn it off on my SSD drive.

On my 8GB system Windows 7 Prof system, with IE and Outlook open,the system is using 1.5 GB of memory, but 1.2 GB of that is used for file system caching, which will be returned for use if needed by programs. File system caching is not exactly the same as superfetch, although superfetched files can be placed in file system cache.

I would say MSE has less effect than more bloated AV software, but I've never done a direct comparison. I do not run AV on my personal systems*, but I recommend MSE for those who want / need AV because it has a much lower performance impact than most others.

* Before anyone calls me out on this, I've been running with no AV since before Windows existed. I've never gotten a virus I did not put there myself. I've also won a few hundred $ in bets from those who didn't believe my systems could be clean.

Memory used by regular cache is not counted in the memory graph in task manager, but superfetch memory is. It's quite unlikely that you are only using 300 MB for Win 7 plus your apps.

If I'm remembering correctly, Superfetch only puts it's data into regular cache once it is actually used. For example, superfetch might pre-load Firefox for you into it's own memory (counted by task manager). Once you launch Firefox it transfers that data to the regular cache (not counted by task manager).

Oh I believe you, AV isn't a must have, at least not if you know what you're doing.

I've been using Comodo for a few years and find it pretty good in many ways, but recently I switched to MSE when I reinstalled with W7SP1.
The [GRAPH] runs a bit higher now, not that I care about it. Both works fine, no resource hogs AFAIK.

Could you just come up with OS restore points? Obviously this does not work if you need to install A, then install B, then remove A whilst keeping B.

What's wrong with installing an OS in a VM?

Is this for dev purposes, or just installing 3rd party applications (home use?)?

A registry changelog is an interesting idea. But if you have snapshot X, and incremental snapshots Y and Z, you couldn't necessarily apply X -> Z if Y and Z both relied on an identical change (ie shared registry keys whose values were not changed in Z)

The OS restore point idea doesn't work for the reason you've stated. OS in VM is not an option, because firstly I want to run Win 7 (which would need another license, presumably), would waste a lot of ram and certain parts of the OS wouldn't be able to interact with native hardware.

This just for home use, I tend to try a lot of software out, then decide whether to keep or ditch it. All that takes it's toll on Windows, the whole installing/uninstalling thing really should be more seperated from the essentials of the OS, I'm told this is the case with Linux.

I think what I'll do is install anything I'm not sure about inside Sandboxie and keep a sandbox for each program/set of programs. This seems the only way to natively access hardware of the system, whilst keep that ability to completely return system to how it was previous.

You can write misbehaved apps for any OS. There are Windows programs which install and uninstall cleanly and some you don't even need to install. It's been a long time since I've used a Windows application which made a mess there was a real point in cleaning up. Sure, back in the day, you could even end up with a broken OS which wouldn't boot by installing a simple program. It's a very different picture now.
The most common software distribution methods are cleaner and much more secure on most free operating systems than Windows but if you install or run random pieces of software you're also going to run into problems.
Even if you're discriminating, contrary to what you've been told, important parts of the OS sometimes depends on the same components as applications. This shouldn't be a problem but in practice it can be especially with a "stable enterprise" OS (read: based on old code) which is not designed to let you upgrade these components or to provide different versions to some applications. The easiest solution is again VMs. At least with free operating systems you usually don't need to pay extra to run VMs.

But if I use VM, I have to install/run a whole operating system in a VM just to run applications in a VM, no?. Is there any way to run just applications in a VM on top of non-VM OS. How are others who insta

he OS restore point idea doesn't work for the reason you've stated. OS in VM is not an option, because firstly I want to run Win 7 (which would need another license, presumably), would waste a lot of ram and certain parts of the OS wouldn't be able to interact with native hardware