Imposing their products mail.ru
We all use messengers, and on the home PC it is always present, and even if not 2 (or even more), but 1 definitely is.
Well, now more specifically. Today I would like to talk about Mail.Ru Agent and the imposition of unnecessary products by its developers. The idea of the post arose after my friend complained that when installing this product, a bunch of garbage was added to his “gift”. Having decided to understand this, I proceeded.
Downloading the latest version 5.8 from the official site began the installation and simultaneously monitored which files and registry entries the installer adds / edits.
Eliminating too much, installed the product.
The first thing that caught my eye after installation: suddenly added 4 bookmarks in IE8 and Chrome (default browser). Bookmarks like: Photo mail.ru, search mail.ru and similar garbage.
The second is the 3 added processes GUARDMAILRU.exe, GUARDMAILRU.exe, GUARDGUARD.exe all together take about 10 Mb of memory. What it is and why it is installed on my PC is not clear (and without my consent). If you try to close these processes one by one through the task manager, they close, but open again. The more, the deeper, the more interesting. It turns out that GUARDMAILRU.exe has been added to both autoload and Windows services. (Generally, this Guard is very suspicious and if you look on the Internet, there is a lot of negative about it)
')
In addition, a search from mail.ru was added to IE 8 search services, which for some reason became the default search engine. Newmrasearch.dll in the folder of the installed messenger is responsible for this.
As a result, we have the following unauthorized actions:
So draw conclusions. Personally, I lost the desire to use mail.ru and its products.
ps who cares here is the installation log: link to Google Docs . Maybe you can find there something else interesting.
Well, now more specifically. Today I would like to talk about Mail.Ru Agent and the imposition of unnecessary products by its developers. The idea of the post arose after my friend complained that when installing this product, a bunch of garbage was added to his “gift”. Having decided to understand this, I proceeded.
Downloading the latest version 5.8 from the official site began the installation and simultaneously monitored which files and registry entries the installer adds / edits.
Eliminating too much, installed the product.
The first thing that caught my eye after installation: suddenly added 4 bookmarks in IE8 and Chrome (default browser). Bookmarks like: Photo mail.ru, search mail.ru and similar garbage.
The second is the 3 added processes GUARDMAILRU.exe, GUARDMAILRU.exe, GUARDGUARD.exe all together take about 10 Mb of memory. What it is and why it is installed on my PC is not clear (and without my consent). If you try to close these processes one by one through the task manager, they close, but open again. The more, the deeper, the more interesting. It turns out that GUARDMAILRU.exe has been added to both autoload and Windows services. (Generally, this Guard is very suspicious and if you look on the Internet, there is a lot of negative about it)
')
In addition, a search from mail.ru was added to IE 8 search services, which for some reason became the default search engine. Newmrasearch.dll in the folder of the installed messenger is responsible for this.
As a result, we have the following unauthorized actions:
- adds its bookmarks in IE 8 and in hrome, which was the default browser (as it is with other browsers, did not check).
- GUARDMAILRU is installed which is added to the autoload, and to the Windows services, and the output gives 3 processes: GUARDMAILRU.exe 4049kb, GUARDMAILRU.exe 3840kb, GUARDGUARD.exe 1340kb
- newmrasearch.dll is embedded in IE 8 as a search service
So draw conclusions. Personally, I lost the desire to use mail.ru and its products.
ps who cares here is the installation log: link to Google Docs . Maybe you can find there something else interesting.
Source: https://habr.com/ru/post/118648/
All Articles