Windows 10 Search Ghost Items

Imgur: The magic of the Internet

After uninstalling programs from windows 10 and deleting any associated files and links, the items persist in my windows 10 quick search menu. (Is there an official name for this feature?)

Does anybody know where these values are stored? For example, are they stored in the registry, an a database flat file somewhere, as a file in a directory?

I've searched my whole PC and cannot find files that reference the names of ghost items still showing.

Clicking on the ghost item does nothing and I see no way to remove it.

Hello 2allmyhaters and welcome to TF ,
Please try this. It will probably sort your issue: Rebuild Search Index in Windows 10

What's up with the odd username? I don't hate you.

After rebuilding the index, the items still show.

Now here is what I have done, I've removed all "included locations" I can, rebuilt the index again, and I still see the items.

The 2 directories I am forced to index are "Start Menu" and "Startup".

I've deleted all files in both of those directories, rebuilt the index again, and the ghost items still show.

It shows "10 items indexed" even though both folders are empty, but I don't think those 10 items are the ghost items I'm seeing.

I've even used sysinternals process monitor to find any queries to files with the name of the ghost files showing, but nothing shows, which means windows is making no calls to CreateFile() on the "file" or "app" listed, it's just a text reference either obfuscated in the registry or hidden in a file somewhere.

Does somebody know where this information is being retrieved from?

2allmyhaters,
Thanks for the update. I'll have to ponder over this unless someone else has some ideas before.

I've created a new folder to test the indexer, and created a shortcut inside of it.
The indexer picked up the shortcut and after I deleted the shortcut file, it no longer displayed it in results.
This is the behaviour I should expect.

After searching my entire PC, both hard disks, and mass storage devices, there are 0 file results for at least one of the ghost items displayed (including any partial match).

This means the indexer is pulling this information from some kind of cache that contains invalid results, besides the obvious indexed items cache, assuming "rebuild cache" actually creates a clean slate.

Locating the source of these results will likely require some in-depth reverse engineering of the windows search indexer and related routines. This may violate the EULA for windows but is possibly the only way to find this bug.


If I find anything and do solve this I will post why this is happening here.

Download Agent Ransack and search for the shortcut names it's finding and should not be.

Search for the partial shortcut name excluding any extensions.

Using the official widows file API I traversed all of my HDDs and storage devices and used a case insensitive partial comparison and no such file exists that the search item refers to.

One thing to note, these ghost items are explicitly catagorized as "apps".

2allmyhaters said:

Using the official widows file API I traversed all of my HDDs and storage devices and used a case insensitive partial comparison and no such file exists that the search item refers to.

One thing to note, these ghost items are explicitly catagorized as "apps".

I don't know how that works compared to Agent Ransack for searching. You can also trying hunting in the registry I suppose.

Huh? Is that a bot?


I don't know what Agent Ransack is but if it's a program for windows then it uses the windows API as its underlying function to traverse the hard disk anyway.

After doing a memory dump for SearchApp.exe, I found a non-unicode string referencing one of the ghost files in the data.


Are there any windows developers here who could look in the source code to see where SearchApp.exe fetches information from when aggregating the search item list?