May 4, 2011 at 09:44Imposing your products mail.ru
We all use instant messengers, and it is always present on the home PC, and even if not 2 (or even more), but 1 is definitely there.
Well, now more specifically. Today I would like to talk about Mail.Ru Agent and the imposition of unnecessary products by its developers. The idea of the post arose after a friend of mine complained that when installing this product, a bunch of garbage was added to him as a “gift”. Deciding to figure it out, I set about.
After downloading the latest version 5.8 from the official site, I started the installation and at the same time I tracked which files and entries in the registry the installer adds / edits.
Excluding unnecessary, I installed the product.
The first thing that caught my eye after installation: 4 bookmarks suddenly added in IE8 and Chrome (default browser). Bookmarks like: Photo mail.ru, search mail.ru and similar garbage.
The second is the 3 added processes GUARDMAILRU.exe, GUARDMAILRU.exe, GUARDGUARD.exe all together consume about 10 MB of memory. What it is and why it was installed on my PC is not clear (and without my consent). If you try to close these processes in turn through the task manager, they close, but open again. Well, the deeper, the more interesting. It turns out GUARDMAILRU.exe was added to both startup and Windows services. (In general, this Guard is very suspicious and if you look on the Internet, a lot of negativity is expressed in its address)
In addition to search services IE 8, a search was added from mail.ru, which for some reason became the default search engine. Newmrasearch.dll is responsible for this in the folder of the installed messenger.
As a result, we have the following unauthorized actions:
So draw conclusions. Personally, I lost the desire to use mail.ru and its products.
ps anyone interested here is the installation log: link to Google Docs . Maybe you find something else interesting there.
Well, now more specifically. Today I would like to talk about Mail.Ru Agent and the imposition of unnecessary products by its developers. The idea of the post arose after a friend of mine complained that when installing this product, a bunch of garbage was added to him as a “gift”. Deciding to figure it out, I set about.
After downloading the latest version 5.8 from the official site, I started the installation and at the same time I tracked which files and entries in the registry the installer adds / edits.
Excluding unnecessary, I installed the product.
The first thing that caught my eye after installation: 4 bookmarks suddenly added in IE8 and Chrome (default browser). Bookmarks like: Photo mail.ru, search mail.ru and similar garbage.
The second is the 3 added processes GUARDMAILRU.exe, GUARDMAILRU.exe, GUARDGUARD.exe all together consume about 10 MB of memory. What it is and why it was installed on my PC is not clear (and without my consent). If you try to close these processes in turn through the task manager, they close, but open again. Well, the deeper, the more interesting. It turns out GUARDMAILRU.exe was added to both startup and Windows services. (In general, this Guard is very suspicious and if you look on the Internet, a lot of negativity is expressed in its address)
In addition to search services IE 8, a search was added from mail.ru, which for some reason became the default search engine. Newmrasearch.dll is responsible for this in the folder of the installed messenger.
As a result, we have the following unauthorized actions:
- adds its bookmarks in IE 8 and in Chrome, which was the default browser (I did not check how things are with other browsers).
- GUARDMAILRU is installed, which is added to both startup and Windows services, and the output gives 3 processes: GUARDMAILRU.exe 4049kb, GUARDMAILRU.exe 3840kb, GUARDGUARD.exe 1340kb
- newmrasearch.dll is embedded in IE 8 as a search service
So draw conclusions. Personally, I lost the desire to use mail.ru and its products.
ps anyone interested here is the installation log: link to Google Docs . Maybe you find something else interesting there.