Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A lot of so called "freeware" bundle installers contains one or more unwanted disgusting crapware components like the evil ask toolbar or other similar hexadecimal stuff. Is it possible to identify the bundler/packer programs which was used by the creator of the bundle and is it possible to edit such an "infected" installer exe package without running it? I can open such packages with 7zip and can see and analyze the content, but its impossible to delete single files in the setup bundle. I've had opened some crapware setup bundles with an hex editor to read out the file header bytes and I tried to find some informations about the file header numbers at google but found no really useful results. How I can open, identify and edit ["disinfect" :-)] such bundles? I think it must be possible to edit the embedded installer scripts to "castrate" the crapware or selective delete the unwanted installer components. Any suggestions? Thanks, Zorkus

share|improve this question
I would assume in most cases its just a normal .msi file which means any number of programs could have created it. – Ramhound May 31 '13 at 15:35
The file extension .msi means microsoft installer, these installer files mostly harmless and without crapware. I'm interested in files with the extension .exe only. Crapware coders or bundlers mostly uses special encrypted sfx packers to prevent reverse engineering, selective unpacking and "disinfection" of those crapware bundles. – Zorkus May 31 '13 at 18:49
I'm sure that each packer/encryptor/bundler (runtime packers) leaves an unique signature at the created setup.exe and I'm interested to find out where this signature is located and which packer/encryptor/bundler uses which signature. So I could identify the related packer and unpack the crap bundle without installing and then could selective remove the crapware and repacking the clean software setup for installing. The key for the whole procedure is analyzing any setup.exe and identifying the related packer/encryptor/bundler program. – Zorkus May 31 '13 at 19:12
Any Antivirus Software must have embedded unpacker routines for the most known packing algorithms. Those unpacker routines capable to identify each packed file to unpack it automatically with the right algorithm for scanning. So it must be possible to analyze and unpacking nearly each encrypted self-extracting exe file. Looking for detailed informations about that. Maybe I have to analyze an Antivirus program to find out what's the best way to break into those most behated crapware bundles. The goal is killing any crapware installer algorithm before it infects the system with unwanted shit. – Zorkus May 31 '13 at 19:40
Very few anti-virus programs on the market can scan .msi files – Ramhound May 31 '13 at 20:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.