>> I bet you're using something similar. Any (safe, lol) recommendation in this respect?
Quite right, and yes indeed.
My favorite (and likely the one you had) is <a href=http://www.pcmag.com/article2/0,1759,25475,00.asp target=ctrl>InCtrl5</a>, a PC Magazine utility that is and was free and freely downloadable for years (I have the zip if anyone wants it). Another fine one I've used is <a href=http://www.geocities.com/ggmartau/ target=tun>Total Uninstall</a>, which is reliable and free.
The software works by taking a snaphot of your registry and hard drive contents before and after you run software, then reports the changes made to your system. You can track every registry and file addition, change or deletion, which is very powerful information. Generally they only report information, leaving it up to you to take corrective action when needed, though Total Uninstall has the option to undo the changes made to your system. I suspect there are similar tools available in commercial security-suite products, but I'm not familar with any.
These tools can be time consuming to run but well worth the trouble. I never run software, even ones made in this community, without scanning it's every move, and I have tracked quite a few outrageous moves made by supposedly trustworthy software. I tracked the single most destructive act ever done to my computer with InCtrl5, by reviewing the report weeks after the damage was done (it was from someone in this community in fact, using a very bad installer).
The key is making multiple reports, one when you install, then one when you first run the program. A program's first run is often the most revealing, a time when things can get extracted and added to your system. Some programs deserve a report for their second or third runs. Finally, you can get a report after an uninstall, and compare it to the previous reports to see what was missed. Another key is to not do or run anything unnecessary while taking your snapshots, so the report doesn't get flooded with things it shouldn't.
Also, remember this game?
http://forum.mtm2.com/viewtopic.php?t=2240
It contained one of the most outrageous bits of "foistware" I've experienced, like a trojan it installed device drivers without warning, secretly, during the program's first run, and left them them there after the game was uninstalled. I'd bet anyone who loaded the game still has them in memory now.
Files:
windows\system\ntkernel.vxd
windows\system32\drivers\prohlp02.sys
windows\system32\drivers\prodrv06.sys
Keys:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\ntkernel
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\prohlp02
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\prodrv06
It's part of a third-party anti-copying technology that infiltrates systems and is well known to cause many problems for people. I'd forgotten about it until now, after getting quite steamed about it when I first discovered it.