Project Release

I felt that my project, my toolbar blocker, was far enough along to start a project page. This software is NOT fully functioning, and could product dangerous results. (e.g. Deleting a critical system folder.) Despite the danger, I feel I have overcome enough programmatic hurdles to make this project viable. It is still possible I will run into something and be unable to finish the project. If such an event occurs, at least the code is available for someone daring to carry on with it.

Anyway, this project was inspired yet again by my workplace. Time and time again I have seen average users with many toolbars and other questionable web browser objects/add-ons. If I can't teach the users how to avoid these installations, I would have to prevent it all together.

The main issue for getting this to work is detecting when toolbars installing. (What do all toolbars have in common?) All toolbars must copy files, and they tend to copy in the same places. The software will run in the System Tray, and monitor directories for file changes. Such directories are the Program File directories or the root/system drive. The next step is to scan files, like an anti-virus program against a database of known toolbars. I came across a website called www.systemlookup.com. The program will download a search page from the site, do a search through the web page, and then know if it's a toolbar or not. My preferred idea was to detect which process was copying the files (the toolbar installer). From my research, Windows does not save which process was responsible for file creation. This is one thing with which I would like help, as my current solution is a bit dirty (explained next). Any information on communication or manipulation of external processes (such as halting or suspending a process in place) would be great.

So if I can't kill the process responsible, how do I "block" the toolbar? I don't block the toolbar, I let it install and then delete the files it copied. As it stands, the toolbar is still listed as an installed program. I know I can probably remove that via the Registry. If you try to uninstall the toolbar, Windows will let you know something like "We couldn't find the uninstaller and it seems the program has been uninstalled. Do you want to remove this from the list?"

Before I go any further, does the initial release work? To some degree, it does! I've tested two toolbars, Google and Bing. It successfully can delete Google's, but gets the wrong path with Bing. The reason it gets the wrong path is SystemLookup doesn't give the top-level folder, but one that is named by version number. I assume for these I will have to add them in manually.

Let me briefly explain how the code works...

First, directories need to be monitored for file creation. FileSystemWatcher handles that.

pFiles = New FileSystemWatcher("C:\Program Files", ".")

Next my sub routing with the event handler, and our newly created file.

Sub badFiles32(ByVal sender As Object, ByVal e As System.IO.FileSystemEventArgs) Handles pFiles32.Created
Dim fileInfo = New FileInfo(e.FullPath)
Dim createWord = fileInfo.Name.ToString()

Now, the search and download (the search is createWord being inserted into the URL).

Dim myWebClient As New System.Net.WebClient
myWebClient.DownloadFile("http://www.systemlookup.com/lists.php?list=1&type=filename&search=" & createWord & "&s=", programDirectory & "\temp" & "\" & createWord & ".html")

Now the fun part--searching this web page.

Dim reader = IO.File.ReadAllText(programDirectory & "\temp" & "\" & createWord & ".html")

When doing this search, you are searching the name of the file created. In this search, there will be at least one instance found regardless if there is a result or not. This is because when you do a search, that string is in the search box, so the program thinks there's a match. So I used the HTML markup to get a unique result. Our goal is to get to the URL containing the program path location.

indexOfFirstFind is the starting index of our createWord. We use indexOfFirstFind as the starting position to find the second index, the start position of the fragment URL needed. We use indexOfFirstFind for indexOfThirdFind as well, to find the end position.

   Dim indexOfFirstFind As Integer = 0
    Dim indexOfSecondFind As Integer = 0
    Dim indexOfThirdFind As Integer = 0
    Dim finalPath As String = String.Empty
    If reader.Contains("<td>" & createWord & "</td>") And code = 0 Then
        indexOfFirstFind = reader.IndexOf("<td>" & createWord & "</td>")
        indexOfSecondFind = reader.LastIndexOf("a href=" & Chr(34), indexOfFirstFind)
        indexOfThirdFind = reader.LastIndexOf(Chr(34) & ">", indexOfFirstFind)

The start position is + 8 because we need to skip "a href=", and I subtract third from second to get the length (to know how far to read).

       finalPath = reader.Substring(indexOfSecondFind + 8, indexOfThirdFind - indexOfSecondFind - 8)

Finally, I download the new page. This page will also be searched in a similar manner to find the program path.

       myWebClient.DownloadFile("http://www.systemlookup.com/" & finalPath, programDirectory & "\temp" & "\" & createWord & "PT.html")

Looking back on that, I don't know if there was an easier solution. But it does work, that much I know. The main thing that concerns me is if it comes up with the wrong path, specifically a system path. My proposed solution will be for the program to not go through with deletion if it matches a certain path. Such as...

If programPath = "C:\Program Files" Or programPath = "C:\"
'don't delete
Else
'delete
End If

One thing I really need is other people's help. I hope this project gains attention so that I can get feedback. This program needs to be heavily tested before I feel confident it won't delete critical areas.