HELP! program keeps re-adding HKLM\...\Run and shell hooks every few weeks

Aditza · 2017-11-18T15:20:07.000Z

Hello, i have a problem:

Can Avast prevent unwanted registry entries from being added such as my case below?

every 2 weeks or so a program spams the registry and re-adds a TON of spam hooks under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run and other similar locations, even going so far as to add unwanted shell overlay icons in Windows Explorer and a (useless) auto-starting service that starts with LocalSystem privileges.

Every time they do this I have to manually scrub these entries out of the registry using Sysinternals’ Autoruns and I have to repeat the scrub operation on multiple computers (my desktop and my laptop). Even if i disable those registry entries (and the service) their program runs normally and doesn’t have any issues in operation, so they are not really needed for me.

The program doesn’t have ANY settings or other preferences to turn off this behaviour and it’s been literally YEARS now that users have complained to the developers about this behaviour and they ignore us on purpose - I know I have complained to them ever since June 2014.

Except of uninstalling and stopping the use of their software, what options are there for blocking or automatically cleaning up the crap left by their updater program in the registry?
Can Avast help here?

Asyn · 2017-11-18T15:31:18.000Z

Test the file at VT (https://www.virustotal.com) and post the link to the result here.

Aditza · 2017-11-18T15:35:13.000Z

already did… they have millions of users of the software worldwide so they wouldn’t risk making it into a virus… it’s just a VERY ANNOYING “feature” of their program.

Screenshot is attached below

the boxes unchecked are from the previous version that i had disabled manually
the checked boxes are the entries newly added by their updater.

they have the same dates because Sysinternals Autoruns uses the timestamp of the file itself for that date there.

Asyn · 2017-11-18T15:36:32.000Z

Aditza post:3:

already did…

As said, post the link to the result here.

Aditza · 2017-11-18T15:44:43.000Z

the useless service executable:
https://www.virustotal.com/en/file/9a0c9402160ec30e506f6af0a4eb790724728e7c55bb3b8b7d6d1e3b19a4dfa4/analysis/1511019690/

the main exe file:
https://www.virustotal.com/en/file/6643055a63d04db94413cfe4d49bcfc9e9dfb10be5e09dc44d8ba56124362bdd/analysis/1511019641/

x64 shell overlay hook:
https://www.virustotal.com/en/file/7a5bad33d37b0c5e60e67e321e8ded61207d66812c2367dfd63cba9a59db5848/analysis/1511019801/

x86 shell overlay hook
https://www.virustotal.com/en/file/22dccbe049db923f9899263d123064ce70ee90181655e795ea35f1ed09d63675/analysis/1511019857/

Asyn · 2017-11-18T15:48:30.000Z

Nothing much Avast can do here, you could try CCleaner to clean the registry.

Aditza · 2017-11-18T15:51:32.000Z

it’s not a case of cleaning, more of unwanted software functionality.

I want to only start Dropbox manually from a desktop shortcut and not have it start with the system or as a service (and not have it load additional shell hooks when it runs) - it works just fine this way.

Asyn · 2017-11-18T15:59:43.000Z

Aditza post:1:

The program doesn’t have ANY settings or other preferences to turn off this behaviour and it’s been literally YEARS now that users have complained to the developers about this behaviour and they ignore us on purpose - I know I have complained to them ever since June 2014.

If the devs aren’t able/willing to fix it (since 2014), best to get rid of it…

Aditza · 2017-11-18T16:14:49.000Z

Asyn post:8:

If the devs aren’t able/willing to fix it (since 2014), best to get rid of it…

my problem is that i have found no easy alternative that reliably preserves the file names, I use Dropbox to sync my World of Warcraft saved files between my desktop and my laptop.

Dropbox preserves file names and in case of a conflict will preserve the file name for the newer file and will rename the OLDER files.

Google Drive (recently renamed as Backup as Sync) does the opposite - it keeps the older file named as-is and will rename the NEWER file - and it tends to detect conflicts if you as much as sneeze at it - it will immediately stop syncing the proper file and will create a renamed file, appending “(1)” or other numbers to the file name.

Google’s approach might be OK for documents but is a total train wreck when you consider the case of LUA script programs (such as WoW uses to save data). These scripts MUST have a very precise file name or WoW hits the fan.

When i used Google Drive for syncing WoW saves i was having random weird missing data, old WoW savedata making a comeback or other such things - and in the end i found it was directly caused by the way that Google was creating surprise random additional files instead of preserving the proper file name for LUA scripts.

Asyn · 2017-11-18T17:09:33.000Z

Sorry, I’m no gamer but can’t you just save it on an USB stick…?

bob3160 · 2017-11-18T18:11:23.000Z

Have you tried OneDrive ???

Aditza · 2017-11-18T19:22:06.000Z

when i start it, Dropbox acts as a real-time backup of the save game files on the main computer too… and i also have a habit of making weekly 7zip snapshot archives of the WoW save data - those will get synced over to the laptop too… so messing around with usb drives would be an inconvenience. (have some usb drives too… but i don’t use them much these days except for installing win10 from them)

Onedrive: haven’t tried it. Back in 2014 i discovered that Dropbox was behaving much better than Google Drive at preserving file name integrity and i stuck with it… even if it has that annoying registry behaviour.

Announcements