Can an app be blocked from re-installing ?

chuckp · 12 Apr 2018

Apps "Allentown.exe" "Sumo.exe" "Bakersfield.exe" keep re-installing on my laptop. They keep showing up in Task Manager, sometimes several times at once. I end task and if I'm quick enough I can delete them. The next time I'm online they're all back. One of them tries to play internet commercials but they're choppy. I want to find out if there is a way to keep these apps from coming back. Does anyone know anything about these apps? I'm sure they loaded with another app. The only thing I've add in the last week was Wondershare Filmora. I tried system restore and they were gone but came back. Thanks for your time reading my rambling post.

Bastet · 13 Apr 2018

Are these apps which you’ve originally downloaded or did they just appear?
Did you download the Wondershare program from the official website?
Tbh they sound like pups so you’ll have to run Malwarebytes, ESET online scanner & AdwCleaner.

MBAM: Free Cyber Security & Anti-Malware Software | Malwarebytes

Eset: http://www.eset.com/us/online-scanner/

Adwcleaner: Downloads - AdwCleaner - ToolsLib

chuckp · 13 Apr 2018

They came from the wild blue. Wondershare came from the publisher's site.

Bree · 13 Apr 2018

chuckp said:

They came from the wild blue...

All the more likely to be PUPs then. Have you run the suggested scans yet? I'd start with AdwCleaner...

TairikuOkami · 14 Apr 2018

You can block them from running, at least until you figure out, how to get rid of them.

Run CMD and copy/paste:

Code:

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "Allentown.exe" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "Sumo.exe" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "3" /t REG_SZ /d "Bakersfield.exe" /f

chuckp · 14 Apr 2018

Thank you TairikuOkami That was exactly what I needed.