Microsoft Veteran Explains How Windows 95 Detected Installers

Windows 95 installer detection relied on a surprisingly simple method: checking whether a program looked like a setup file based on its name or location.

Microsoft veteran Raymond Chen shared the historical detail, explaining how Windows 95 tried to protect critical system components from buggy installers that could overwrite them with older or broken versions.

Windows 95 Had to Guess Which Programs Were Installers

Windows 95 already included protections to stop app installers from downgrading important system files. The harder problem was deciding when those protections should activate.

The operating system needed to know whether the running program was actually an installer, setup utility, or something else. Since many installers did not clearly identify themselves through modern metadata, Microsoft used a heuristic system.

That meant Windows 95 made an educated guess based on the executable name.

File Names Were the First Clue

According to Chen, Windows 95 checked whether the running program’s name included installer-related words.

If the executable name contained terms like setup, installer, or inst, Windows 95 treated it as a likely installer. The system also checked localized installer-related words, so the detection could work in different languages.

Windows 95 Also Checked the File Path

If the executable name did not contain an installer-related word, Windows 95 used a fallback method.

The system checked the folder path leading to the executable. If the word setup appeared somewhere in that path, Windows 95 assumed the program might still be part of an installer.

For example, a program running from a setup folder could trigger the same protection even if the executable itself had a less obvious name.

The goal was not perfect detection. Microsoft needed a practical way to catch common installer behavior without requiring every developer to follow a new standard.

Some File Checks Happened After Restart

Windows 95 did not always check protected files immediately.

Many installers at the time could not replace certain files while Windows was running. Some setup programs would close Windows, return to MS-DOS, run a batch file, modify system files, and then restart Windows.

Because of that workflow, Windows 95 sometimes had to wait until the next startup before checking whether a protected system file had changed.

That wasn’t always how it worked. Chen noted that multimedia driver installations using INF files were handled differently. He indicated that the team behind that part of Windows likely had an exception, enabling those checks to run while Windows was still active.

Raymond Chen Has Shared Other Windows 95 Stories

This is not the first time Chen has shared unusual details from the Windows 95 era.

He previously explained how Windows 95 testing once broke a cash register. He also detailed how the operating system had a system for repairing protected files after app installations modified them.

The installer detection story shows how Windows 95 solved real compatibility problems with practical tricks. Instead of relying on perfect installer identification, Microsoft used file names, folder paths, delayed checks, and special-case handling to protect system files from poorly behaved setup programs.