Any time I see a Microsoft link with a cheeky title, I assume it’s a great Raymond Chen deep dive. Haven’t been wrong yet!
Hah, I had the same experience. Saw microsoft.com and thought "it's gonna be a Raymond, I can feel it"
Any sufficiently advanced uninstaller is indistinguishable from malware
11–20 of 556 posts
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#12Installing / uninstalling / updating software should be a service provided by the OS. Letting vendors do it themselves just gives them an opportunity to mess it up, and they frequently do.
[deleted]
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#13interesting investigation and js. Though I'm wondering why does windows rely on the software to uninstall itself?
historically all windows software has either been unzipped into a folder or installed using an installer created by the vendor, so as a result the vendor has to provide their own uninstaller too. uninstallers are complex enough that the OS can't completely take their place, though Windows has shipped with an install/uninstall framework called MSI for a long time.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#14I had never heard of detours before, but I guess it isn’t any different that a good old fashioned LD_PRELOAD
it's a little more general, I think, since one common use case for it is to use it on your own process in order to intercept calls to stdlib/OS code from libraries you don't control.
For example, in the bad old days I used detours to virtualize the windows registry so that I could do "fake installs" of COM components inside of a VB6 app, allowing it to run without an install and without administrator permissions. This worked by detouring all the Win32 registry APIs, which was sufficient to intercept registry accesses performed by the COM infrastructure.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#15And today I learned that Windows supports running Javascript as shell script. huh
It's technically JScript.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#16And today I learned that Windows supports running Javascript as shell script. huh
Yes, the same way one could write VBS (Visual Basic Script).
I think Windows 98 already had this ability. Possibly Windows 95 as well. It's a variant of the language called JScript, which is what was used in old versions of IE too.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#17And today I learned that Windows supports running Javascript as shell script. huh
Been using this for years. Mostly really useful. Sometimes tricky to get right since the available APIs are semi-well documented and it's JScript, which is some sort of old Internet Explorer-ish version of JavaScript.
By the way, there are also HTAs, which are Microsoft HTML Applications. You can create a simple double-clickable GUI with these using only HTML and JScript.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#18Installing / uninstalling / updating software should be a service provided by the OS. Letting vendors do it themselves just gives them an opportunity to mess it up, and they frequently do.
I can't speak for whether Apple gets it right, but my experiences with the various package managers on Linux have not been any better than my experiences with installers on Windows. I've settled for avoiding system packages for anything I can build from source since system packages are always outdated and often Strange, and I try to avoid third party package sources and weird stuff like Snap or Flatpak since it's also historically been a source of problems for me. Maybe life is better outside of the Debian sphere though, since I've only dealt with Ubuntu and Debian.
Windows does have installer/uninstaller infrastructure called MSI (https://learn.microsoft.com/en-us/windows/win32/msi/windows-...), but ultimately it's up to developers to choose to use it.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#19I've seen Malwarebytes flag uninstallers a few times.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#20And today I learned that Windows supports running Javascript as shell script. huh
It is very common for malware to contain java script payloads that try to obfuscate themselves like like this:
Seemingly_random_code(seemingly_random_string)
The seemingly_random_code decompresses/decodes whatever is in the seemingly_random_string and hands over control to it. Interestingly the decoded code is another version of the same with different code and string. This goes on for ~100 layers deep then at the end it just downloads and executes some file from the net.