1

I installed a software and it automatically installed another software along with the desired one. Therefore I uninstalled it using Control Panel\All Control Panel Items\Programs and Features.

But still I am seeing traces of that software. It leaves behind directories in C:\Program Files (x86),
C:\ProgramData, and C:\Users\AGN\AppData\Local. I deleted the related directories.

  1. In my current situaiton, how do I uninstall every trace/file/dir the program left behind?

  2. What should I do to sandbox software I dont trust when installing it, to avoid problems like this in the future?

3

Unless you do a forensic analysis of every change the program makes on install and updates you can't be sure its uninstaller removes everything. There's file creations, dll registrations, registry changes and start up config changes amongst other changes that an application installation can perform. You can't even search for changes as the malicious programs can hide these actions by using names unrelated to the program you installed. You could rollback to a restore point but that is impractical given you may want to uninstall apps at any point.

You can sandbox with virtualisation, that's not just restricted virtual machines but you also use containerisation like Docker. Set up a container with the application and dependencies you need and delete the container and image when you are done.

1

The way to remediate unwanted software varies depending on the nature of the unwanted software. Unwanted enterprise software versus PUPs versus malware remediation differs.

From your description, I'm going to assume that the software that you removed was a PUP.

This isn't software that's explicitly malicious, it's just "unwanted". Typically, running the uninstaller is enough to remove the active components in the software.

The best way to remove the software entirely, including old registry entries, folders, environmental variables, and so on, is to obtain a list of all system changes that the PUP makes on installation. Search the name of the software and locate a removal list. Often, you can find a list of all changes that a program makes when it is installed. (FN 1) Then, you can undo them manually.

The alternative is to run software designed to remove unwanted software. Many anti-malware vendors offer a product for free. If you search for "pup removal tool" you should get multiple options. Naturally, you want to examine the vendor offering the software to make sure it is legitimate offering, and not more adware masquerading as anti-malware. Typically these tools can remove PUPs and avoid the need to reformat your machine.

Other, more extreme measures are always an option - as others have said, you can rollback restore points, or reformat the entire operating system. Typically this isn't necessary with PUPs.


Footnotes:

  1. If you cannot find a remediation list, you will need to forensically generate one, manually. Fist you will need to generate a clean state system, install the unwanted software, then compare the current system state with the pre-installation state. There are many tools to help you do this, most of which are a part of a good malware forensics suite. (PUP's aren't necessarily malware, but malware forensics uses the same tools and skills as non-malware program forensics.) This is a long and arduous process, and is outside the scope of this question to cover in depth. See additional reading for resources on learning this process.

Additional resources:

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software by Michael Sikorski and Andrew Honig

Flare VM - an example of a malware analysis tool suite.

0

If I install without sandboxing then how to uninstall whatever trace/file/dir it leaves behind

You can't, as simple as that. This would be equal to checking every byte on your hard disk(s) + bios + everything if it it because of the bad program or not.

Just "nuke from orbit", as they say: If you need to make sure that everything of it is gone, wipe everything and make a clean install. For this, it doesn't matter if it is a badly written program or malware. Depending on how serious it is, throwing the computer away (mainboard etc.) is included in the process.

What should I do to sandboxing a software which I dont trust?

Don't execute it, period.

And yes, VMs etc. provide a certain level of protection, but not perfect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.