I would like to know what MSI installed a given dll or exe on my system. I know that Windows fixes deleted files if they belong to an installed package. Can I query that information without actually deleting the file? Is there a tool or Win32 API to check what package a file belongs to?
Asked
Active
Viewed 1.1k times
2 Answers
10
It appears like there might be a way after all! I recently discovered registry entries for files installed by Windows Installers under the following subtree:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData
I wrote a small Python script to lookup the installer for a file using the information stored there:
> python windows-installer-file-search.py opus.dll
File: C:\Program Files (x86)\Mumble\opus.dll
Product: Mumble 1.2.13
Install user: S-1-5-18
Cached installer: C:\Windows\Installer\2f6b072.msi
It is available here: https://github.com/Zero3/windows-installer-file-search
Zero3
- 800
7
If you are okay with just finding plausible needles in the haystack, this quick and dirty abuse of 7-Zip will work:
7z.exe l -an -air!C:\Windows\Installer\*.msi > needlelist.txt
Then open needlelist.txt in any text editor, search for needlename.dll and you will find the corresponding .msi package in the listings generated by 7-Zip.
(Note: This method is 'dirty' because it just tells you which .msi packages that contains a file named needlename.dll. But it is probably fine for most use cases.)
Zero3
- 800