Uninstalling "Junkware" - Use the uninstaller or just nuke?

Discuss Malware removal, techniques, trends, etc. and repairing Windows after removal.
Forum rules
1. Try to give more than you take, when possible.
2. Don't be a prick.

Uninstalling "Junkware" - Use the uninstaller or just nuke?

Postby netmonk » Thu Sep 25, 2014 9:47 am

I'm in the process of trying to automate some of the virus removal / junkware removal tasks in my shop and the main part of the process that's slowing down the streamlined "automation" is uninstalling the junkware/toolbars. Is it REALLY necessary to use their built-in uninstallers and go through that entire process, or is it safe to simply delete the files/folder and registry keys (when found), kill any related startup processes, and just use the standard malware removal tools to remove all other entries from the computer? I mean, if I remove startup entries and at least the majority of the files and registry entries, I cannot see any reason why it would be a problem?

I know it sounds like I'm being a lazy tech, but honestly is there any legitimate reason why this would be a bad idea?

Thanks in advance!
netmonk
 
Posts: 8
Joined: Wed Sep 11, 2013 10:18 pm

Re: Uninstalling "Junkware" - Use the uninstaller or just nu

Postby EagleTech » Thu Sep 25, 2014 3:18 pm

Are these things that dUninstaller doesn't get? Also, if you haven't yet, check out AdwCleaner.

My only concern about nuking things is that if you don't get every little scrap you may end up with issues.
User avatar
EagleTech
 
Posts: 159
Joined: Thu Mar 21, 2013 6:15 pm
Location: IL, USA

Re: Uninstalling "Junkware" - Use the uninstaller or just nu

Postby netmonk » Thu Sep 25, 2014 10:33 pm

EagleTech wrote:Are these things that dUninstaller doesn't get? Also, if you haven't yet, check out AdwCleaner.

My only concern about nuking things is that if you don't get every little scrap you may end up with issues.
It's not that dUninstaller does not, or will not, get them, it's just that I'm not convinced that "uninstalling" the junkware programs is completely necessary.

If you watch the un-installation process on most of these small junkware programs and/or toolbars, they simply remove 1-2 .exe files, several other small (non .exe) files, and several registry entries. If I ran my arsenal of malware removal tools in succession that remove 98% of these files and registry entries, to the point that they do not auto-run or have a way to execute at all, then why worry with the small remainders? The malware removal programs typically remove the .exe files and the majority of the remaining files/folders/registry entries. And if you include something like StartUpLite (or even a manual check with Autoruns), it would stop it from even executing on boot.

I know it seems like a lazy, half-assed tactic of removing malware, but I'm starting to feel like if the .exe files and majority of everything else is removed and the backbone of the program is broken, why even bother removing the other remaining files / registry entries if they cannot do anything to harm the computer?

Here is the line up, in sequential order, of the malware removal programs that I currently use:

Killemall
TDSSKiller
RogueKiller
CCleaner
Malwarebytes
HitmanPro (sometimes)
JRT
AdwCleaner
StartupLite
Autoruns (sometimes)

I've even thought about throwing in SuperAntiSpyware in there as well, but it seems a bit overkill. I do about 5-15 virus cleanups a day and the above playlist of tools seems to do the trick. In some stubborn cases, like an "FBI Virus" variant, I'll use HitmanPro's kickstart USB to get things going. But, I digress.

Anyway, if anyone else has some good reasons not to just simply nuke the program startup and / or program folder, please chime in.

Thanks!
netmonk
 
Posts: 8
Joined: Wed Sep 11, 2013 10:18 pm

Re: Uninstalling "Junkware" - Use the uninstaller or just nu

Postby Nick » Fri Sep 26, 2014 1:22 pm

I personally have mixed feelings and it really depends on what it is. Some things I might not uninstall if I suspect the uninstall process is going to do something to further the reason why I was removing it in the first place. On the other hand, the actual program installer is usually the closest thing to getting all scraps of that app up -- if the developers put in the tiny fraction of extra time to do it right and cleanup everything. Obviously this amounts to believing that the app is good enough to assume that.

I really like the approach of Revo - uninstall the app using the intended process, then scan for leftovers. only rip it out manually when step one fails. I have considered adding such functionality to dUninstaller, but the potential for unintentionally marking the wrong items for deletion is very real. That and I'm so busy...

On the other hand, to be perfectly honest, it really doesn't matter if you leave "leftovers" if you've done your job properly then they are harmless and won't impact the performance of the system or the user experience in any way just by simply existing there, not being used by anything... deep removal attempts and post-removal scans should only be necessary when you are attempting to fix a problem with that app that warrants a completely clean installation, and you're never trying to do that with junkware.

the only issue with the above philosophy is if some of the leftovers from the junkware (or worse 'ware) is detected by anti-whatever applications and flagged to the user, misrepresenting the actual potential for damage and confusing the user.

For that last reason, personally no matter what I do, just as a general rule of thumb, at the least I will scan a customer's system with their own anti-xxx apps (in addition to whatever I used.) I do it before finishing work on the system just to ensure that a customer won't be confused later on about something that may pop up in a scan.
Author of d7x and other PC technician's tools. http://www.d7xTech.com

Image
User avatar
Nick
Site Admin
 
Posts: 2755
Joined: Mon Nov 19, 2012 7:54 pm

Re: Uninstalling "Junkware" - Use the uninstaller or just nu

Postby Xander » Sat Sep 27, 2014 3:21 pm

netmonk wrote:And if you include something like StartUpLite (or even a manual check with Autoruns), it would stop it from even executing on boot.
Just so you know, StartupLite only looks at -common- softwares that can be taken off the autostart list. It never touches things like GPS software or toolbarry stuff.
User avatar
Xander
 
Posts: 662
Joined: Fri Feb 08, 2013 6:08 pm
Location: Near Niagara Falls


Return to Malware Removal