Ask Toolbar (and other such)

[mLipok]

On various occasions, my clients are installed various additives such as:

Ask Toolbar

Ask Toolbar Updater

McAfee Security Scan Plus

McAfee SiteAdvisor

 

and the like.

 

Does anyone have an idea for detecting whether these apps to have installed, and to automate the uninstall these applications.

[guinness]

Using the registry, FileExists() on the program file directory.

[JLogan3o13]

A lot of toolbars don't write a hex key into the Uninstall key in the registry (see below), and so are not always caught if you do a RegKeyEnum. You may have to resort to a filesearch if this is the case.

[mLipok]

Man looking and gets lost.

As usual, the best solutions are the simplest ones.

 

Thanks

mlipok

[JamesA]

A lot of toolbars don't write a hex key into the Uninstall key in the registry ...

 

But they do write to other locations. Try searching at

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar

and also at

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

[MHz]

A concept I used long ago, now I now refuse to use software that does this as you just promote their behavior, is to create a file with the same name as the pest installation folder. This is a prevention and not a cure. So if it creates a folder named "C:PFgarbage", excuse my abbreviations, Use FileOpen to open a extensionless filename to that path. Install the software and the toolbars, spyware fail to install as you have a lock on their install path and so they fail and then use FileClose at finish of install. This works with scripted installs as you know the behavior of these pests before hand. Perhaps they have caught on now though I give them a wave goodbye now.

[ripdad]

McAfee comes in though Adobe updates. That includes flash.

Ask Toolbar normally comes in through Avira, but others have used that toolbar also.

They tout that Ask is safer to use with their software.

They each give the option, at "manual install", to allow install or not.

I personally don't allow any software to "automatically install" anything when updating.

And as hard as it is to do, because it breaks my heart -- I disable all their updating schemes.

Even giggles, with their Two running services. I guess one keeps an eye on the other.

Actually it's fairly simple. Just set "read only" permissions to keys like BHO's.

If they can't write to their install key's - they will abort it.

Same goes for Firefox extensions. Just set the extension folder permissions to "read only".

If they can't write to the folder, they can't install.

If I'm setting folder permissions that way - I will remove all users, except "everyone".

Then set "everyone" Read.

Edited November 2, 2013 by ripdad

[gruntydatsun]

Some of the software that bundles this pc equivalent of scrotum warts is unavoidable.  Flash, Acrobat and Java all bundle this stuff plus formerly reputable sites like softpedia etc.  Search online for manual removal (more like manual evacuation), see how that applies to your problem and branch out our search from there.  This problem is a very fast moving target though so it might be less traumatic for you to download malware bytes or this will become an ongoing area of effort.