Previous Topic: Signature Scanning for Virtual ApplicationsNext Topic: Discovery of Unknown Virtual Application Images


Scanning ThinApp Patches and Upgrades

ThinApp patches and upgrades work by not replacing the original .exe but by adding a new main container. When the original is run, it searches for any newer containers and uses the newest one instead, completely disregarding its own contents.

For example, given the following ThinApp packages:

Since the original ThinApp package will always run the latest upgrade (unless the upgrade packages are removed from that directory), the signature scan will only detect the latest version of the ThinApp package.