Secret Foistware Blocker in Windows 10

Category: Security , Windows

Defender, the security software built into Windows 10, has a hidden setting that will block installation of programs that try to install themselves during another program’s installation. This feature is the answer to one of my most fervent tech prayers! I also have a solution for people still using Windows 7 or 8. Here's what you need to know...

How to Block Unwanted Software

When I download and install a “free” program, I need the concentration of a brain surgeon. That’s because many free programs try all sorts of tricks to install other programs that come along with the free program’s installation file. I’m sure you know what I am talking about, but here is a clear-cut example:

The installer app of ImgBurn, a free optical disk burning program contains “InstallCore,” a program that tries to install additional software on your PC as you click through the ImgBurn installation screens. The PUA (Potentially Unwanted Apps) may or may not be things that you want or need. InstallCore inserts into ImgBurn’s installation screens tiny check-boxes already checked, which purportedly represents your conscious decision to allow the PUAs to be installed.

This dirty trick works on many people who don’t pay close attention to all of the tiny print, icons, check-boxes, “Install” buttons, and other distractions that appear during the installation of ImgBurn, and many other freebies. The more unwanted "foistware" that gets installed, the more money the authors of the software make. It’s an evil, underhanded tactic that should be stopped.

stop foistware

I've been warning AskBob readers about foistware for at least 5 years, but the problem is not going away. So it's up to you to be aware, diligent, and equipped with the proper tools to prevent the installation of unwanted (and potentially malicious) software on your computer.

If you have Windows 10, you can configure Windows 10 Defender to block most apps that try to install themselves during another app’s installation. With this option enabled, you will (for example) get ImgBurn and nothing else. You can start ImgBurn’s installer and not have to watch it like a hawk, reading every character and inspecting every box or button that appears.

The trick is a registry modification. If the thought of tinkering with your system’s registry dismays you, I have you covered with a .REG file that automatically does the necessary without error.

If you know how to use the REGEDIT registry editing utility, open it and navigate to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

Under Windows Defender create a new DWORD named PUAProtection (if it does not yet exist). Set the value of PUAProtection to 1 to enable blocking of Potentially Unwanted Apps (PUA). (A value of 0 will disable blocking.)

Reboot the computer to let the changes take effect. If you don’t want to mess with REGEDIT, just right-click to download this .reg file, and then click "Save link as..." Enable_Windows_Defender_PUA_protection.reg.

After downloading the .reg file, double-click it to apply the registry changes. Then restart the computer to let the changes take effect.

Pass the Caveat, Please

Microsoft’s tech support note on this obscure feature of Defender explains that blocked apps are placed in the quarantine section so they won't run. BUT… there are some exceptions.

The tech support note goes on to say: "PUAs are blocked when a user attempts to download or install the detected file, and if the file meets one of the following conditions: The file is being scanned from the browser; The file is in a folder with "downloads" in the path; The file is in a folder with "temp" in the path; The file is on the user's Desktop; The file does not meet one of these conditions and is not under %programfiles%, %appdata%, or %windows%. "

So if a PUA is a new one that Defender does not yet know about, or if it is not in any of the locations specified above, it will slip past this PUAProtection. But PUAProtection should catch most of the pesky toolbars, weather apps, and other junkware that useful free apps try to foist onto users.

Also important to note is that Defender defers to any third-party anti-malware program you may be running, so this junkware protection is inoperative unless Defender is your only security suite.

Another Option to Block Foistware

SO… if you're not running Windows 10, or you don't feel like fiddling with your Windows registry, or you are running Windows 10 with a third-party security tool such as AVG, Avast, Avira, Bitdefender, etc., then you will need another tool to block unwanted software.

In my article, Finally: The End of Next, Next, Next… I discuss a nifty free service called Ninite, which makes it easy to safely install new software, and keep it all up to date.

Ninite lets you choose from a menu of about 100 popular free software titles (including ImgBurn), bundles them up into a single download, and installs them with a single click. Ninite will automatically say no to toolbars and extra junk, and will not bother you with any questions during the installations. It also skips any reboot requests from installers. For security, Ninite downloads each app from the publisher's official site, and verifies the digital signatures.

Your thoughts on this topic are welcome. Post your comment or question below...

 
Ask Your Computer or Internet Question

  (Enter your question in the box above.)

It's Guaranteed to Make You Smarter...

AskBob Updates: Boost your Internet IQ & solve computer problems.
Get your FREE Subscription!


Email:

Check out other articles in this category:



Link to this article from your site or blog. Just copy and paste from this box:

This article was posted by on 15 Aug 2018


For Fun: Buy Bob a Snickers.

Prev Article:
[ALERT] The Video Blackmail Scam

The Top Twenty
Next Article:
[DEAL TIME] Back to School Laptops

Most recent comments on "Secret Foistware Blocker in Windows 10"

(See all 23 comments for this article.)

Posted by:

Victor Sperber
15 Aug 2018

This is very unclear.

The tech support note goes on to say: "PUAs are blocked when a user attempts to download or install the detected file, and if the file meets one of the following conditions: The file is being scanned from the browser; The file is in a folder with "downloads" in the path; The file is in a folder with "temp" in the path; The file is on the user's Desktop;

The file does not meet one of these conditions and is not under %programfiles%, %appdata%, or %windows%. "

Is it blocked?


Posted by:

John
15 Aug 2018

Excellent article Bob! In addition to Ninite, I also have Unchecky which is pretty meticulous regarding PUA's. Keep up the great work.


Posted by:

Danny G
15 Aug 2018

Unchecky does a good job
https://unchecky.com/


Posted by:

Russ
15 Aug 2018

When I right click the supposed reg file in your article, I get an mp3 file. Sorry Bob, your link does not work.

I'd love to get this and could actually edit the registry to do so, but I've got 9 Windows 10 computers and do not wish to take the time to do for each. Your reg file would be so much easier … if it was actually a reg file.


Posted by:

Mikey
15 Aug 2018

Excellent article, Bob. I'll be sharing this for sure!


Posted by:

Mikey
15 Aug 2018

Excellent article, Bob. I'll be sharing this for sure!


Posted by:

Jeffrey
15 Aug 2018

I subscribe to PC-Matic; Since it operates off a "White List", doesn't PC-Matic software automatically block the 'hitchhiker' programs, i.e. PUA's?


Posted by:

Chuck Meyer
15 Aug 2018

Regarding Foistware Blocker: In the registry there is an additional folder under the Windows Defender folder called Policy Manager. Should the key be in that folder????


Posted by:

Glenn
15 Aug 2018

Bob, a lot of opportunities to download something unwanted on your pages also.


Posted by:

Herb
15 Aug 2018

Bob - Great article again! I really admire your ability to stay up-to-date on all things tech-related and share it with others.
John - Thanks for the heads up on Unchecky. I got it and will see how well it works on the next software install.


Posted by:

Rad
15 Aug 2018

Ok, I downloaded your "reg" file. It seems to be an mp3, but somebody below said to change the mps to reg. I did that and I installed it. I then rebooted and attempted to install Auslogics Reg Defrag, an installer that I know has "foistware".

I executed Reg Defrag and after uninstalling the "previous" version, I found a recommendation to install "Sheild Defense Ad Blocker" to Chrome. I had to uncheck the box and click on "Decline" to not install it. I was then offered Auslogics "Boost Speed", No check boxes, but I did have to click on "Decline". And then I was offered Auslogics "Driver Updates". Again I had to click on "Decline" finally, I was able to install Reg Defrag cleanly.

So, apparently the reg edit doesn't work on everything. Keep your eyes open. It is a dangerous world out there.


Posted by:

Rad
15 Aug 2018

Ok, I downloaded your "reg" file. It seems to be an mp3, but somebody below said to change the mps to reg. I did that and I installed it. I then rebooted and attempted to install Auslogics Reg Defrag, an installer that I know has "foistware".

I executed Reg Defrag and after uninstalling the "previous" version, I found a recommendation to install "Sheild Defense Ad Blocker" to Chrome. I had to uncheck the box and click on "Decline" to not install it. I was then offered Auslogics "Boost Speed", No check boxes, but I did have to click on "Decline". And then I was offered Auslogics "Driver Updates". Again I had to click on "Decline" finally, I was able to install Reg Defrag cleanly.

So, apparently the reg edit doesn't work on everything. Keep your eyes open. It is a dangerous world out there.


Posted by:

top squirrel
15 Aug 2018

Ninite is not "new." I've been using it for years.
Also try "Filehippo." Both do the same good things.
Both of these zap foistware as well as avoid a lot of other nasty stuff.
Never heard of "unchecky."
Thanks for the tip.
Before I knew about Ninite (et al) I just unchecked the boxes as applicable. Not too difficult.
Anybody who can't bear all that heavy work involved in (un)checking the boxes that are prechecked deserves all the foistware and toolbars he'd get.

Sometimes I fantasize there is a rule out there that says before you can click on "finish" you are compelled to click on a box they must put there which tells you how many extraneous pieces of software you have allowed on, gives their names and notifies you they will be installed if you don't go back and uncheck them. Something like the warnings they put on cigarette packages.


Posted by:

Bob K
15 Aug 2018

Author: Also important to note is that Defender defers to any third-party anti-malware program you may be running, so this junkware protection is inoperative unless Defender is your only security suite.

----------------------------------

This warning should have come prior to instruction on how to edit one's register.
Also, as one member mentioned already, Unchecky does a great job, and it works with all software.

Bob K.


Posted by:

Henry
16 Aug 2018

You lost me at: "If you know how to use the REGEDIT registry editing utility...."
WAY too techie for me 😒


Posted by:

Wild Bill
16 Aug 2018

I also recommend using Unchecky. It is quite effective at catching and unchecking the little boxes although it does not get them all (Avast trying to install Chrome browser, for instance).
So, keep an eye open while installing software, as always.


Posted by:

Richard
16 Aug 2018

Another helpful tool is Eulalyzer. This is free for personal or educational use (donations welcome). You cut/paste/target the EULA text into the program and it will highlight "clauses" you may be interested in. For example it will show if the programme is really free, restrictions on use and do forth. If it's in the EULA text it can also show that other programmes may additionally be installed/offered.


Posted by:

Sharon
16 Aug 2018

When I right click the supposed reg file in your article, I get an mp3 file. Sorry Bob, your link does not work.


Posted by:

bb
16 Aug 2018

If you consider yourself a geek: Consider Chocolately instead of Ninite. 5,939 programs supported, not just the ~90 that Ninite does.

But ... well ... it's geeky!


Posted by:

PAT
16 Aug 2018

HI BOB....I'M LOOKING FOR A TWITTER BUTTON TO TWEET YOUR STUFF. I DON'T FIND ONE...BOO HOO.
PAT RUTTER


There's more reader feedback... See all 23 comments for this article.

Post your Comments, Questions or Suggestions

*     *     (* = Required field)

    (Your email address will not be published)
(you may use HTML tags for style)

YES... spelling, punctuation, grammar and proper use of UPPER/lower case are important! Comments of a political nature are discouraged. Please limit your remarks to 3-4 paragraphs. If you want to see your comment posted, pay attention to these items.

All comments are reviewed, and may be edited or removed at the discretion of the moderator.

NOTE: Please, post comments on this article ONLY.
If you want to ask a question click here.

Free Tech Support -- Ask Bob Rankin
RSS   Add to My Yahoo!   Feedburner Feed
Subscribe to AskBobRankin Updates: Free Newsletter
Copyright © 2005 - Bob Rankin - All Rights Reserved
Privacy Policy -- See my profile on Google.


Article information: AskBobRankin -- Secret Foistware Blocker in Windows 10 (Posted: 15 Aug 2018)
Source: https://askbobrankin.com/secret_foistware_blocker_in_windows_10.html
Copyright © 2005 - Bob Rankin - All Rights Reserved