Software Deployment

I figured it out.

http://explanoit.com/article.php/20111009100133758

32 bit machines:
"C:\Program Files\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml" /S

64 bit machines:
"C:\Program Files (x86)\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml" /S

Hi spartacus,
Good point. When I get some time I'll run a snapshot and see what other files it creates. I'll make a batch file if anyone wants it.

It could create more responses if you showed us the content of uninstall.xml. The problem may lie there. If you have already found a solution, please share or edit the knowledge database so others can benefit also.

Here are the contents of the XML file. (I do not have permissions to post the file, so it's copied below) This application is an absolute harm to any environment. It is either an active conduit, or the originating source for all sorts of malware and this has been conclusively proven over a period of years.

The uninstall process is such that it pops open a window where the user is asked to confirm the uninstallation by clicking "Next", and then "Finish". Of course it leaves junk around, but that can be cleaned up easily enough.

The problem is creating the silent uninstall when it's utilitizing the XML file for confirmation.

Can anyone provide some insight here?

<?xml version="1.0" encoding="iso-8859-1"?><SUF70UninstallData>
<DataFilePath>C:\Program Files\Coupons\Uninstall\uninstall.dat</DataFilePath>
<CPRegKey>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.0.1</CPRegKey>
<EXELocation>C:\Program Files\Coupons\uninstall.exe</EXELocation>
<AppShortcutFolderPath>C:\Documents and Settings\All Users\Start Menu\Programs\Coupons</AppShortcutFolderPath>
<UninstallReverseOrder>1</UninstallReverseOrder>
<UninstallFiles>
<File>
<Filename>C:\Program Files\Coupons\Coupons.ico</Filename>
<DecrementUsageCount>0</DecrementUsageCount>
<UnregisterCOM>0</UnregisterCOM>
<UnregisterFont>0</UnregisterFont>
<FontDesc/>
<BackupFile/>
</File>
<File>
<Filename>C:\WINDOWS\CouponPrinter.ocx</Filename>
<DecrementUsageCount>0</DecrementUsageCount>
<UnregisterCOM>1</UnregisterCOM>
<UnregisterFont>0</UnregisterFont>
<FontDesc/>
<BackupFile/>
</File>
<File>
<Filename>C:\DOCUME~1\ETB230\LOCALS~1\Temp\_ir_sf_temp_0\npMozCouponPrinter.dll</Filename>
<DecrementUsageCount>0</DecrementUsageCount>
<UnregisterCOM>0</UnregisterCOM>
<UnregisterFont>0</UnregisterFont>
<FontDesc/>
<BackupFile/>
</File>
<File>
<Filename>C:\DOCUME~1\ETB230\LOCALS~1\Temp\_ir_sf_temp_0\npCouponPrinter.dll</Filename>
<DecrementUsageCount>0</DecrementUsageCount>
<UnregisterCOM>0</UnregisterCOM>
<UnregisterFont>0</UnregisterFont>
<FontDesc/>
<BackupFile/>
</File>
<File>
<Filename>C:\DOCUME~1\ETB230\LOCALS~1\Temp\_ir_sf_temp_0\npCouponPrinter.xpt</Filename>
<DecrementUsageCount>0</DecrementUsageCount>
<UnregisterCOM>0</UnregisterCOM>
<UnregisterFont>0</UnregisterFont>
<FontDesc/>
<BackupFile/>
</File>
<File>
<Filename>C:\Program Files\Coupons\CouponsDotCom.url</Filename>
<DecrementUsageCount>0</DecrementUsageCount>
<UnregisterCOM>0</UnregisterCOM>
<UnregisterFont>0</UnregisterFont>
<FontDesc/>
<BackupFile/>
</File>
</UninstallFiles>
<UninstallShortcuts>
<Filename>C:\Documents and Settings\All Users\Start Menu\Programs\Coupons\Coupons.com - Print Coupons.lnk</Filename>
<Filename>C:\Documents and Settings\All Users\Start Menu\Programs\Coupons\Uninstall Coupon Printer for Windows.lnk</Filename>
</UninstallShortcuts>
<UninstallSupportFiles>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG1.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG1.JPG</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG2.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG3.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG2.JPG</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG4.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG5.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG6.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG7.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG8.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG3.JPG</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG4.JPG</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG9.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG5.JPG</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRIMG10.BMP</Filename>
<Filename>C:\Program Files\Coupons\Uninstall\IRZip.lmd</Filename>
</UninstallSupportFiles>
<UninstallFolders>
<FolderPath>C:\Program Files\Coupons</FolderPath>
<FolderPath>C:\Program Files\Coupons\Uninstall</FolderPath>
<FolderPath>C:\Documents and Settings\All Users\Start Menu\Programs\Coupons</FolderPath>
</UninstallFolders>
<SessionVars>
<Var>
<Name>%ProductName%</Name>
<Value>Coupon Printer for Windows</Value>
</Var>
<Var>
<Name>%CompanyName%</Name>
<Value>Coupons.com Incorporated</Value>
</Var>
<Var>
<Name>%ProductVer%</Name>
<Value>5.0.0.1</Value>
</Var>
<Var>
<Name>%Copyright%</Name>
<Value>Copyright © 2011 %CompanyName%</Value>
</Var>
<Var>
<Name>%CompanyURL%</Name>
<Value>http://www.coupons.com</Value>
</Var>
<Var>
<Name>%WindowTitle%</Name>
<Value>%ProductName% Setup</Value>
</Var>
<Var>
<Name>%AppFolder%</Name>
<Value>%ProgramFilesFolder%\Coupons</Value>
</Var>
<Var>
<Name>%AppShortcutFolderName%</Name>
<Value>Coupons</Value>
</Var>
<Var>
<Name>%firefoxc%</Name>
<Value>C:\Program Files\Mozilla Firefox\components</Value>
</Var>
<Var>
<Name>%firefoxp%</Name>
<Value>C:\Program Files\Mozilla Firefox\plugins</Value>
</Var>
<Var>
<Name>%myWindowsFolder%</Name>
<Value>C:\WINDOWS</Value>
</Var>
<Var>
<Name>%MainMsg%</Name>
<Value>The Coupon Printer is necessary to print coupons with barcodes directly on your printer so that when you use them in stores, they scan properly at the register.</Value>
</Var>
<Var>
<Name>%PriorID%</Name>
<Value/>
</Var>
<Var>
<Name>%httpport%</Name>
<Value>80</Value>
</Var>
<Var>
<Name>%netscapec%</Name>
<Value/>
</Var>
<Var>
<Name>%netscapep%</Name>
<Value/>
</Var>
<Var>
<Name>%NoKeys%</Name>
<Value>1</Value>
</Var>
<Var>
<Name>%flockc%</Name>
<Value/>
</Var>
<Var>
<Name>%flockp%</Name>
<Value/>
</Var>
<Var>
<Name>%operap%</Name>
<Value/>
</Var>
<Var>
<Name>%operac%</Name>
<Value/>
</Var>
<Var>
<Name>%chromep%</Name>
<Value/>
</Var>
<Var>
<Name>%chromec%</Name>
<Value/>
</Var>
<Var>
<Name>%safarip%</Name>
<Value/>
</Var>
<Var>
<Name>%safaric%</Name>
<Value/>
</Var>
<Var>
<Name>%WindowTitleUninstall%</Name>
<Value>%ProductName% Uninstaller</Value>
</Var>
<Var>
<Name>%build%</Name>
<Value>universal</Value>
</Var>
<Var>
<Name>%couponbar%</Name>
<Value>yes</Value>
</Var>
<Var>
<Name>%CouponBarMsg%</Name>
<Value>Yes, also install the Couponbar and notify me of available coupons for groceries, products, brands and stores while I browse the web.</Value>
</Var>
<Var>
<Name>%RadioSelection%</Name>
<Value>yes</Value>
</Var>
<Var>
<Name>%Conduit%</Name>
<Value>yes</Value>
</Var>
<Var>
<Name>%ConduitAddr%</Name>
<Value>CT2559647_Coupons.exe</Value>
</Var>
<Var>
<Name>%ConduitAddrXPI%</Name>
<Value>{37153479-1976-43c3-a1ee-557513977b64}</Value>
</Var>
<Var>
<Name>%INIVar%</Name>
<Value/>
</Var>
<Var>
<Name>%ConduitAddrFlags%</Name>
<Value>-ctid=CT2559647 -ie -ch -ff -startpage=false -defaultsearch=true -openuninstallpage=true -openwelcomedialog=false -searchfromaddress=true -welcomepage=false</Value>
</Var>
<Var>
<Name>%ApplicationDataFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Application Data</Value>
</Var>
<Var>
<Name>%ApplicationDataFolderCommon%</Name>
<Value>C:\Documents and Settings\All Users\Application Data</Value>
</Var>
<Var>
<Name>%DesktopFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Desktop</Value>
</Var>
<Var>
<Name>%DesktopFolderCommon%</Name>
<Value>C:\Documents and Settings\All Users\Desktop</Value>
</Var>
<Var>
<Name>%FontsFolder%</Name>
<Value>C:\WINDOWS\Fonts</Value>
</Var>
<Var>
<Name>%MyDocumentsFolder%</Name>
<Value>C:\Documents and Settings\ETB230\My Documents</Value>
</Var>
<Var>
<Name>%StartFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Start Menu</Value>
</Var>
<Var>
<Name>%StartFolderCommon%</Name>
<Value>C:\Documents and Settings\All Users\Start Menu</Value>
</Var>
<Var>
<Name>%StartProgramsFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Start Menu\Programs</Value>
</Var>
<Var>
<Name>%StartProgramsFolderCommon%</Name>
<Value>C:\Documents and Settings\All Users\Start Menu\Programs</Value>
</Var>
<Var>
<Name>%StartupFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Start Menu\Programs\Startup</Value>
</Var>
<Var>
<Name>%StartupFolderCommon%</Name>
<Value>C:\Documents and Settings\All Users\Start Menu\Programs\Startup</Value>
</Var>
<Var>
<Name>%CommonDocumentsFolder%</Name>
<Value>C:\Documents and Settings\All Users\Documents</Value>
</Var>
<Var>
<Name>%MyMusicFolder%</Name>
<Value>C:\Documents and Settings\ETB230\My Documents\My Music</Value>
</Var>
<Var>
<Name>%MyMusicFolderCommon%</Name>
<Value>C:\Documents and Settings\All Users\Documents\My Music</Value>
</Var>
<Var>
<Name>%MyPicturesFolder%</Name>
<Value>C:\Documents and Settings\ETB230\My Documents\My Pictures</Value>
</Var>
<Var>
<Name>%MyPicturesFolderCommon%</Name>
<Value>C:\Documents and Settings\All Users\Documents\My Pictures</Value>
</Var>
<Var>
<Name>%MyVideosFolder%</Name>
<Value>C:\Documents and Settings\ETB230\My Documents\My Videos</Value>
</Var>
<Var>
<Name>%MyVideosFolderCommon%</Name>
<Value>C:\Documents and Settings\All Users\Documents\My Videos</Value>
</Var>
<Var>
<Name>%ProgramFilesFolder64%</Name>
<Value>C:\Program Files</Value>
</Var>
<Var>
<Name>%CommonFilesFolder64%</Name>
<Value>C:\Program Files\Common Files</Value>
</Var>
<Var>
<Name>%ProgramFilesFolder%</Name>
<Value>C:\Program Files</Value>
</Var>
<Var>
<Name>%CommonFilesFolder%</Name>
<Value>C:\Program Files\Common Files</Value>
</Var>
<Var>
<Name>%SystemFolder%</Name>
<Value>C:\WINDOWS\system32</Value>
</Var>
<Var>
<Name>%WindowsFolder%</Name>
<Value>C:\WINDOWS</Value>
</Var>
<Var>
<Name>%SystemDrive%</Name>
<Value>C:</Value>
</Var>
<Var>
<Name>%TempFolder%</Name>
<Value>C:\DOCUME~1\ETB230\LOCALS~1\Temp</Value>
</Var>
<Var>
<Name>%TempLaunchFolder%</Name>
<Value>C:\DOCUME~1\ETB230\LOCALS~1\Temp\_ir_sf_temp_0</Value>
</Var>
<Var>
<Name>%RegOwner%</Name>
<Value>Information Technology Services</Value>
</Var>
<Var>
<Name>%RegOrganization%</Name>
<Value>Wake Tech Community College</Value>
</Var>
<Var>
<Name>%AppDrive%</Name>
<Value>C:</Value>
</Var>
<Var>
<Name>%DAOPath%</Name>
<Value>C:\Program Files\Common Files\Microsoft Shared\DAO</Value>
</Var>
<Var>
<Name>%LaunchUserApplicationDataFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Application Data</Value>
</Var>
<Var>
<Name>%LaunchUserDesktopFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Desktop</Value>
</Var>
<Var>
<Name>%LaunchUserMyDocumentsFolder%</Name>
<Value>C:\Documents and Settings\ETB230\My Documents</Value>
</Var>
<Var>
<Name>%LaunchUserStartProgramsFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Start Menu\Programs</Value>
</Var>
<Var>
<Name>%LaunchUserStartFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Start Menu</Value>
</Var>
<Var>
<Name>%LaunchUserStartupFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Start Menu\Programs\Startup</Value>
</Var>
<Var>
<Name>%LaunchUserMyMusicFolder%</Name>
<Value>C:\Documents and Settings\ETB230\My Documents\My Music</Value>
</Var>
<Var>
<Name>%LaunchUserMyPicturesFolder%</Name>
<Value>C:\Documents and Settings\ETB230\My Documents\My Pictures</Value>
</Var>
<Var>
<Name>%LaunchUserMyVideosFolder%</Name>
<Value>C:\Documents and Settings\ETB230\My Documents\My Videos</Value>
</Var>
<Var>
<Name>%SourceFilename%</Name>
<Value>C:\Documents and Settings\ETB230\Local Settings\Temporary Internet Files\Content.IE5\NYC496DU\CouponPrinter[1].exe</Value>
</Var>
<Var>
<Name>%SourceFolder%</Name>
<Value>C:\Documents and Settings\ETB230\Local Settings\Temporary Internet Files\Content.IE5\NYC496DU</Value>
</Var>
<Var>
<Name>%SourceDrive%</Name>
<Value>C:</Value>
</Var>
</SessionVars>
</SUF70UninstallData>


Winbatch has 2 interesting functions - I know one exists in VB but I'm not sure if the other does. But you can send keystrokes to an app, screen, etc in WinBatch and block keyboard inputs for a period of time. If nothing else, one could write a Winbatch to do both and get rid of the stupid coupon printer.

My view would be that, in the final analysis, all we're dealing with is files and registry junk. So, in your shoes, I would create a removal package by capturing:

- the unregistering of the OCX (I take it it's an OCX, looking at your XML file)
- the removal of the OCX, ICO and any other file associated with the app
- the removal of the folder containing the app

ORIGINAL: ITslave

This application is an absolute harm to any environment. It is either an active conduit, or the originating source for all sorts of malware and this has been conclusively proven over a period of years.


Though I can neither endorse or refute it, this blog article it does nonetheless make interesting reading.

ORIGINAL: ITslave

Of course it leaves junk around, but that can be cleaned up easily enough.




You do, of course, have the option of authoring your own independent 'uninstallation' MSI , initially based on the information in the XML file to remove the files and registry information that the original coupons printer installer put down in the first place by populating the RemoveFile and RemoveRegistry table accordingly.

If the aforementioned article is to be believed, then it's likely the XML contents will not cover everything that your 'uninstall' MSI would need to remove. However, if you use a lightweight snapshot tool (e.g. InCntrl5) to do a before and after snapshot of the installation of the coupon printer software on a clean (and isolated !) PC, you should be able to get a comprehensive listing of what needs to be removed.

Once your uninstall MSI is complete, you can then run it silently through the usual methods, (i.e use the /qn qualifier to your msiexec command line.)


Spartacus

ORIGINAL: explanoit

I figured it out.

http://explanoit.com/article.php/20111009100133758

32 bit machines:
"C:\Program Files\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml" /S

64 bit machines:
"C:\Program Files (x86)\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml" /S


Glad you have a solution, but keep in mind my earlier reply because there is a suspicion that the uninstall.exe doesn't remove all traces of the installation, so if that matters to you then you might still want to consider creating your own uninstaller as discussed previously.

Spartacus

PS script....

$ErrorActionPreference= 'silentlycontinue'

if(Test-path "C:\Program Files\Coupons") {

start-process -wait "C:\Program Files\Coupons\uninstall.exe" -arg '"/U:C:\Program Files\Coupons\Uninstall\uninstall.xml" /S';

   remove-item "C:\Program Files\Coupons" -force -recurse

}elseif(Test-path "C:\Program Files (x86)\Coupons") {

   start-process -wait "C:\Program Files (x86)\Coupons\uninstall.exe" -arg '"/U:C:\Program Files (x86)\Coupons\Uninstall\uninstall.xml" /S';

   remove-item "C:\Program Files (x86)\Coupons" -force -recurse

}else {

   "Coupon Printer Not found"

}

$software = "Coupon Printer*"

$path = @(

            'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall'

            'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall'

'HKLM:\software\classes\installer'

'HKLM:\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products'

        )

$Installs = (GCI $path -Recurse |

ForEach-Object { Get-ItemProperty $_.pspath } | Where-Object {$_.DisplayName -like $software})

foreach ($Install in $Installs){ if (!($null -eq $Install)) { Write-Output "Installed $($Install.DisplayName) version is $($Install.DisplayVersion) "        

Remove-Item -force -recurse -Path $($Install.PsPath) }}

@ explanoit - In your findings, did those 2 scripts remove all traces?  If not, do you have a copy of that batch file?