#1  
Old 08-21-2013, 11:20 AM
jholland1964's Avatar
jholland1964 jholland1964 is online now
Almost Really Old Member
 
Join Date: Feb 2004
Location: The Middle
Posts: 35,585
Alert concerning the program Unlocker

This is an alert concerning the program Unlocker. For many years this has been an often recommended program on various forums, to help users unlock and delete a file in Windows because the file is locked resulting in Windows error messages that usually say:

Quote:
Cannot delete folder: It is being used by another person or program
Cannot delete file: Access is denied
There has been a sharing violation.
The source or destination file may be in use.
The file is in use by another program or user.
Make sure the disk is not full or write-protected and that the file is not currently in use.
Unlocker is used to help unlock & remove the locked file, and it can work but not always. HOWEVER, because of a thread created by a poster here last week it has been found that this Unlocker program contains, by design, what are called PUP's (Potentially Unwanted Programs) some of them often known malware. And these "unwanted extras" have been contained in the install file going back to version v.1.86, released 2008 and have continued thru the current version v.1.92 released in May of this year.

These findings all are the result of an MBA-M scan done by the poster at which gave the result of one PUP found in her v.191 Unlocker program, the Babylon Toolbar. She let it remove the object found and uninstalled Unlocker and downloaded the new v.1.92 from the developer's web site and again MBA-M flagged the PUP Babylon Toolbar. This time she didn't allow MBA-M to remove it, thinking it probably was a False Positive.

She then created her thread. I told her I would check it out. I downloaded Unlocker directly from the developers web site, reading the change log first to see if any "extras" were mentioned and they were noted there:
Quote:
“Promotional Feature: Fully optional Delta Toolbar”.
I went to the MBA-M forum and created a thread in their False Positive forum, did "developer scan with MBA-M of the file as requested and uploaded the log and the file itself asking if this was indeed a False Positive.
I received my answer from MBA-M within 30 minutes:
Quote:
“These are not False Positive detections as the installer for the software currently bundles the Delta Tool Bar”
The names Delta Tool Bar and Babylon Tool Bar are sometimes interchangeable, though you may see both names in scan logs at times. The word bundles indicates that it is automatically INCLUDED with the install and indicates it is not really optional.

As a double/triple check I then uploaded both files to Virus Total and VirScan.org web sites where the files were scanned by up to 30 different well known scanner programs. Both files were found on both sites by 5 different scanners to contain infections.

I reported my findings to the poster at WS and she said she was positive she was not offered any "Fully Optional" anything. Normally, during the install with a good program that does offer a "Promotional Feature" (meaning they have been paid to include it) shows the user a box where the user can either check to receive or uncheck to not receive this extra.

To check, I installed Unlocker and the Delta Tool Bar is noted in the License agreement for the program, that box that we generally always receive but rarely read. In section B. it clearly says in Section B;
Quote:
B. Delta Toolbar End User License Agreement
You have the option of installing the Delta Toolbar. By installing the Delta Toolbar you agree to the Delta End-User-License Agreement and Delta Privacy Statement. You can easily remove this application at any time.
*see attached*

Since there was only ONE I Agree button, because if you don't agree, you can't install the program, I clicked I Agree hoping I would be given the Option to not take the Delta Tool Bar during the install.There was NO other Opt Out listed anywhere during the install, the program installed in just a few minutes. I opened the program to see if Opt Out was IN the program itself. Nothing. I closed the program and Uninstalled it. But on doing my immediately done MBA-M scan, sure enough there it was, Babylon Tool Bar! Of course I allowed MBA-M to remove the file found.

I then ran two scans with two other programs which are designed to specifically remove these types of files (infected tool bars and browser helper objects) and even though MBA-M had removed the one original file, these two found many additional files and registry entries created by the Delta and Babylon Tool Bars. Roughly 25 additional removals done by these two programs! I then ran an ESET Online Scan which found and removed 5 additional files! So 31 files dropped by this program!

Remember, I had only installed this program, did open it but did not use it.

Now any people who have this Unlocker program and also have and regularly use a fully up to date MBA-M program may ask, "I have had Unlocker for years, why didn't MBA-M find these files before now?"

For a very good reason, because so many FREE programs have begun offering these Promotional Features for other programs with their installs in order to help pay the bills so they can continue to offer their programs for Free and SOME of these "extras" Are for legitimate programs and the option to not accept them are clearly visible and True options. But, many like this Delta Tool Bar and others are NOT clearly visible and the user has no idea they have received them.
http://blog.malwarebytes.org/news/20...ve-pup-policy/
Quote:
Malwarebytes feels most of our users have no knowledge that these PUPs were installed and would like them removed. Several thousand forum posts and support tickets confirm our standpoint. Ranging from difficult to uninstall applications to software that makes you opt-out, we’ve had enough of it all!
Other security programs ARE following suit, ESET Nod for one.
My advice to any who do have Unlocker installed, no matter what version, to Uninstall it Immediately and run a fully updated MBA-M Full Scan and have it remove any items found.
Then create a thread here in our Virus and Malware Help forum, copy/paste the MBA-M log in it and you will receive the next steps needed. I don't want to give other the steps until the MBA-M log can be seen so it then can be decided which other tools may be needed for your particular computer.

Additional information: Commonly here we recommend to get your Free program from the developer's web site first, which I did in this case, and if it is not offered at the developer site then go to either filehippo or majorgeeks, because neither of those two sites use a 3rd party installer which in itself is dangerous. Both of those sites offer the program as it came directly from the developer, so this program offered on their site ALSO contains that Delta Tool Bar. filehippo offers the change logs for those downloaders to read and those change logs at filehippo are identical to those on the developer web site so the "unwanted extras" are noted there, if you read them
Majorgeeks does not offer change logs for most of the downloads they offer, however for programs such as this the do have a Limitation posted at the bottom of the download section for all programs containing these "Promotional Features" meaning the developer was PAID to include the extras.
Quote:
Limitations: This program is advertising supported and may offer to install third party programs that are not required for the program to run. These may include a toolbar, changing your homepage, default search engine or other third party programs. Please watch the installation carefully to opt out.
So read EVERYTHING on download pages, whether the developer's or majorgeeks or filehippo BEFORE downloading any FREE program. Read the change logs if available, look for Limitations like majorgeeks uses. If you see nothing in any of those three places be sure to Watch your downloads closely, a reputable program will tell you BEFORE the License agreement appears that there are extras OFFERED so you can truly Opt Out, and then watch for the Opt Out page during the install and for heaven's sake Read that License Agreement Fully before clicking "I Agree"
__________________

1.Dell Inspiron 17 5759
Windows 10 64bit
Firefox v.52.0 ;WLM2012; Avira Free, Windows Firewall, MBAM, SpywareBlaster, SUPERAntispyware

2.Dell Inspiron N7010; Laptop Windows 7 64bit SP1
*same programs as computer 1 above*


Help Us To Help You

System Restore

Stick with the Clean up
Closed Thread

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Forum Jump


All times are GMT -5. The time now is 07:07 PM.


Powered by vBulletin® Version 3.8.1
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.
Copyright 2000-2011 WorldStart, Inc