230

As many are painfully aware of, Oracle continues to not only bundle the Java installation with the useless Internet browser toolbar from Ask.com, but also enable its installation by default. In addition to the toolbar, Ask also replaces your favourite search engine in your browser with Ask.

Furthermore, the Java installation goes as far as to actually recommend installing this useless junk, meaning that any non IT-savvy person is more than likely to leave it checked and install it (after all, it was enabled by default and the friendly Java installer did recommend it, right?).

To add insult to injury, even if you remove the Ask Toolbar, you can be sure to see it again soon, when the next Java update hits you (which seem to happen quite often lately, due to loads of security fixes for Java, but that's another story).

I'll duly remove the check-mark to install Ask Toolbar, whenever I update Java, but when supporting my family and friends, it's obvious they don't.

How can I prevent the pesky Ask.com Toolbar from being installed in the first place?

8
  • 8
    I always download the offline version of java which seems to be without the "ads".
    – kobaltz
    Feb 10, 2013 at 5:01
  • 2
    @kobaltz: How does that version behave when you update it (if you just press next, next, next)? Do you get the Ask Toolbar. My idea with this solution, is especially for implementing on computers, whose users' are not the most IT savvy. Users that will probably forget to uncheck Ask Toolbar and definitely not mess around with offline installers ;-)
    – abstrask
    Feb 10, 2013 at 8:16
  • 23
    Consider signing this petition change.org/petitions/… :)
    – Mxx
    Feb 11, 2013 at 3:20
  • 3
    @RasmusRask - Ask.com is not included in the offline installer.
    – Ramhound
    Feb 11, 2013 at 12:46
  • 5
    Mandatory reading: A Close Look At How Oracle Installs Deceptive Software With Java Updates -- zdnet.com/… Feb 12, 2013 at 20:25

8 Answers 8

248
+150

UPDATE 2016-02-21: It seems that the old registry key below is not used anymore to disable sponsors. Since Java 7u65 and 8u11 (8u40 on Mac OS X) there is a supported way to disable sponsor offers directly through the Java Control Panel. In Windows:

Control Panel → Java → Advanced → Miscellaneous (scroll to bottom) →Suppress sponsor offers when installing or updating Java

Since 7u55 (8u40 on Mac OS X) you can also disable sponsor offers through the command line running a Java installer with a special argument:

jre-7u55-windows-i586-iftw.exe SPONSORS=0

For those of you that still need to disable sponsors in a programmatic way, it seems that now it's enough to add the following line to C:\ProgramData\Oracle\Java\java.settings.cfg (create a new file if it doesn't exist).

SPONSORS=0

Please note that this last method is undocumented and unsupported, just like the old one!


UPDATE 2016-02-21: The following one is the old method to disable sponsors, it only works for Java versions below 7u65. For newer Java versions see above. Digging a bit into the problem myself, I've found that there's an hidden switch to disable sponsor offers in the auto-update installer.

Open the following keys into the Windows Registry Editor (regedit.exe):

  • HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft (available only on Windows 64-bit)

and create in both of them a new String Value (type REG_SZ) named SPONSORS of value DISABLE (both name and value must be uppercase).

Alternatively, copy and paste the following code into a text file called disable_java_sponsors.reg and double click on it to import these values in your Registry.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft]
"SPONSORS"="DISABLE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft]
"SPONSORS"="DISABLE"

Please note that this switch not only disables the Ask.com toolbar installation and prompt, but disables all of the sponsors potentially bundled with the Auto-update setup/Online setup (Google toolbar, Yahoo toolbar, McAfee something, etc...)


Another way, without having to download and rename or create a new .REG file, is to copy and paste the following two lines into an elevated CMD prompt:

reg add HKLM\SOFTWARE\JavaSoft /v "SPONSORS" /t REG_SZ /d "DISABLE" /f 
reg add HKLM\SOFTWARE\Wow6432Node\JavaSoft /v "SPONSORS" /t REG_SZ /d "DISABLE" /f
12
  • 13
    That's a really neat and elegant solution. Nice find! Let's hope Java keep obeying that registry setting and don't suddenly decide to use another value - you know, just to push sponsor software through anyway ;-)
    – abstrask
    Mar 9, 2013 at 17:00
  • 3
    I just tested the registry settings in a virtual machine with the Java RE 7 update 17. The Ask toolbar did indeed not install. Sweet! I like this fix a lot more than my own, so I'll change the accepted answer to this. Thanks! :-)
    – abstrask
    Mar 9, 2013 at 17:10
  • 7
    I just wanted to confirm the SPONSORS=DISABLE option works for me too. It is now part of our Workstation GPO. Apr 16, 2013 at 22:18
  • 2
    Downloadable file for your convenience: pastebin.com/download.php?i=iTkxyPum
    – dtech
    Apr 30, 2013 at 10:53
  • 2
    Answer of the year!!!! Jun 28, 2013 at 6:51
46

Edit 2014-02-02: With JavaRE 7u51, Ask toolbar now installs into a subfolder named "AskPartnerNetwork" instead of "Ask.com". One could have suspicions about what the point of that is... Meanwhile, @Danilo Roascio's registry values are still obeyed and works just as well as before.

This just highlights that the simple registry fix, is still the simplest and best solution. In case the Java installer changes, so that this registry value is ignored, the following script can still be used as a workaround - just make sure the Ask Toolbar path is updated.


The simplest way to prevent Ask Toolbar from being installed again I could think of, was to create the folder Ask Toolbar installs into and modify the permissions, so no one can write to it.

First, make sure that the Ask Toolbar has been removed. Then copy the following code to Notepad, save it as a .cmd file and run it in an elevated command prompt:

REM Detect processor architecture
set proc_arch=x64
if "%PROCESSOR_ARCHITECTURE%" == "x86" ( 
    if not defined PROCESSOR_ARCHITEW6432 set proc_arch=x86
) 

REM Define Ask Toolbar path
if "%proc_arch%" == "x86" set AskPath=%ProgramFiles%\Ask.com
if "%proc_arch%" == "x64" set AskPath=%ProgramFiles(x86)%\Ask.com
set AskReadme=%AskPath%\..\Ask.com_ReadMe.txt
set AskRevert=%AskPath%\..\Ask.com_RestorePermissions.cmd

REM Create dummy Ask Toolbar folder
md "%AskPath%"

REM Add explanatory text file, as to why the dummy folder is there
echo The 'Ask.com' folder is has been created and write protected,> "%AskReadme%"
echo in order to prevent Ask.com Toolbar from being 'accidentally'>> "%AskReadme%"
echo installed, e.g. by Java.>> "%AskPath%\readme.txt">> "%AskReadme%"
echo.>> "%AskReadme%"
echo This has been done using ICACLS by denying write access to the>> "%AskReadme%"
echo EVERYONE security group.>> "%AskReadme%"
echo.>> "%AskReadme%"
echo To revert permissions run:>> "%AskReadme%"
echo %AskRevert%>> "%AskReadme%"

REM Create script to remove restrictions
echo icacls "%AskPath%" /remove:d *S-1-1-0> "%AskRevert%"

REM Deny everyone (SID: S-1-1-0) write access
icacls "%AskPath%" /deny *S-1-1-0:(OI)(CI)W

Please note: ICACLS is included in Windows Vista and later. You can download ICACLS for Windows XP/Server 2003 through Microsoft KB919240, or an updated version through KB943043 (but the latter must first be requested, after which you will receive a link by e-mail to download it). For this purpose, both versions should work equally well.

I have verified with the installer for Java 1.7 update 13, that the Ask Toolbar indeed does not install, even if I leave the checkbox checked.

A similar approach can most likely be used to block most other kinds of piggybacking crapware.

Edit #1

Windows Explorer quirk: Access denied

Windows Explorer behaves a little strange if you try to open the folder. Even though you still have read access to the folder, Windows Explorer will tell you that access is denied, even though only write access has been denied.

This doesn't happen if you simply only have been assigned read access in the first place, but it seems to happen when you have been assigned read/write permission to the folder and then been denied write access.

Reverting permissions

The script has been updated to add a 'read me' text file and a script for removing the restriction again. Both are stored in the 32-bit program files folder.

6
  • 10
    I would recommend leaving a text file inside the folder explaining why the "ask.com" folder is there and what it is designed to do. That way when you look back at the folder 3 years from now, you'll know what the reason for it was.
    – Richard
    Feb 11, 2013 at 17:14
  • @Richard: Probably a good idea ;-)
    – abstrask
    Feb 11, 2013 at 18:25
  • @Richard: Aagain, very good idea. I've updated the script to add the explanatory read me file. Due to the Windows Explorer quirk however, it's stored directly in Program Files, not in the Ask.com folder. The script now also saves a small script to revert the change, so you don't have to remember exactly what was done, or the syntax of ICACLS.
    – abstrask
    Feb 11, 2013 at 19:12
  • Small update to script: ProgramFiles path is now locale independent.
    – abstrask
    Feb 16, 2013 at 16:26
  • 1
    @Pacerier: No reason not to. Read the top of my answer. I suggested the solution before the brilliantly simple registry mod. I kept my answer as a fallback if Oracle stops respecting the registry setting, or as an idea to block other crapware, piggybacking on other software than Java
    – abstrask
    Nov 16, 2014 at 0:11
19

Consider using https://ninite.com/ Select all the apps you want it to install/update, and with a single click it'll install only those apps, w/o extra garbage like Ask toolbar in java. If a system already has the latest version of a given app, Ninite will skip that install. Also you don't need to regenerate its package every time. The same .exe will ensure that you always install the latest versions. Just tell your friends/family to run it once a month and it'll make sure they are always up to date.

Update: Alternatively, if you install JRE from http://www.oracle.com/technetwork/java/javase/downloads/index.html it does not come with Ask or McAfee toolbars. (Not sure about auto-update afterwards).

4
  • 2
    I like Ninite, but it has (at least) two drawbacks: a) Ninite doesn't allow you to differentiate between 32 and 64 bit Java (at least not that I know of) - on 64 bit machines, you will get both 32 and 64 bit Java installed, though the majority only needs 32 bit. B) Silent installs/updates is a premium feature, whereas Java has auto-update built-in (however ugly it might be)
    – abstrask
    Feb 10, 2013 at 22:08
  • Does it really matter if 64bit jre is also installed? It's not slowing the system down, and once browsers upgrade to 64bit, they'll have proper plugins ready. Simply tell your friends/family whenever they see java update popup to run Ninite installer. You don't need paid Ninite updater app. Or even put Ninite into Windows scheduler to automatically run however often you want and keep those systems up to date.
    – Mxx
    Feb 11, 2013 at 3:24
  • 1
    "Does it really matter if 64bit jre is also installed?" - Yes, when it's not needed at all, I think it matters. But then again, I'm a bit pedantic when it comes to unnecessary software ;-). Also, I have previously experienced with a Ninite-installed Java, that the 64-bit version never updated. Of course this could be solved my simply instructing my "users" to run the Ninite package periodically. But then again, the scope was to simply to prevent Ask.com Toolbar from being installed, through Java or otherwise. Tools like Secunia PSI and CSIS Heimdal can keep most 3rd party apps up-to-date.
    – abstrask
    Feb 11, 2013 at 14:47
  • The Java Auto Updater appears to only update the 32-bit version. If you also have 64-bit installed, it will be left behind. Jul 17, 2014 at 8:01
12

Another method is to prevent DNS resolution of the ask.com domain. I tested this by setting my network's DNS cache/resolver (Unbound) to refuse queries for ask.com and then updating java with the ask toolbar box checked. Result was no installation.

This method has the drawback (if you consider it such) that the ask.com domain will be unavailable. But it has the bonus that ask.com "infected" systems may be discovered (as users may have search issues) allowing for disinfection to be undertaken.

Another positive is that no changes are needed for each computer. The DNS solution works for all systems immediately and simultaneously. Note that other DNS caches must be blocked - which is quite typical in most controlled environments - the firewall prevents access via port 53 to outside DNS from all but the internal DNS cache/resolver.

2
  • 7
    "This method has the drawback (if you consider it such) that the ask.com domain will be unavailable" - I don't consider that a drawback ;-). For the computers I normally support, I cannot configure this at the router level, so it would be a per-computer job regardless.
    – abstrask
    Feb 10, 2013 at 20:56
  • 3
    Along the lines of your answer, darkphader, a host file entry of 127.0.0.1 www.ask.com could work for an individuals computer.
    – Bryan
    Feb 27, 2013 at 21:29
10

Nov 2014: Answers here are largely outdated as Oracle has now disclosed this. Or at least we can say there's now an "official" solution.

First of all: The Ask toolbar has only ever been included as an option with the Consumer version of Java installer (the one you get from java.com) whereas the Corporate version of Java installer (the one you get from java.sun.com) never had it. So the problem about the Ask stuff has "only" been a problem for private individual type users. I put "only" in quotation marks because I too have been annoyed by it. Its not a discussion that has existed in corporate IT department, simply because the option wasn't there.

Ok, let's focus on the Consumer version of the Java installer.

Nowadays the Java widget on the Windows Control Panel has an option to permanently disable the "prompts" where you are asked about Ask and where you previously had to remember to unselect the option.

enter image description here

You'll only have to do this once and then never again. I still would have liked Oracle to remove it altogether from the Consumer version of Java but this solution at least means you only have to say "no" once.

There's is a command line option as well. More information here.

0
6

For those of you interested- I created administrative templates (one for x86 and one for x64) that can be used for Group Policy. They've been tested and work in XP and Windows 7.

For more information on this procedure, click here.

In Group Policy you may need to go to View menu, click Filtering and uncheck "Only show policy settings that can be fully managed."

Save the following file as templatenamex86.adm and import in Group Policy:

CLASS MACHINE

CATEGORY !!cat01

KEYNAME "Software\JavaSoft"
POLICY !!polname

  SUPPORTED !!supOSes
  EXPLAIN !!poldescr

    PART !!msg01 EDITTEXT REQUIRED DEFAULT "DISABLE"
    VALUENAME "SPONSORS"
    END PART 

END POLICY


END CATEGORY

[strings]
cat01="Java Update Sponsor Offers x86 Windows"
polname="Set Value"
supOSes="Windows 2000+"
poldescr="Enabling this policy and leaving this field reading "DISABLE" will remove sponsor offers during Java updates"
msg01="DISABLED = Sponsor Offers Disabled"

Save the following file as templatenamex64.adm and import in Group Policy:

CLASS MACHINE

CATEGORY !!cat01

KEYNAME "SOFTWARE\Wow6432Node\JavaSoft"
POLICY !!polname

  SUPPORTED !!supOSes
  EXPLAIN !!poldescr

    PART !!msg01 EDITTEXT REQUIRED DEFAULT "DISABLE"
    VALUENAME "SPONSORS"
    END PART 

END POLICY


END CATEGORY

[strings]
cat01="Java Update Sponsor Offers x64 Windows"
polname="Set Value"
supOSes="Windows 2000+"
poldescr="Enabling this policy and leaving this field reading "DISABLE" will remove sponsor offers during Java updates in 64-bit Windows"
msg01="DISABLED = Sponsor Offers Disabled"

You should see them in Group Policy now: Group Policy

I hope this information can help others keep this garbage off their networks too!

-Mike

1
  • Nice for enterprise deployment, though I personally prefer deploying registry settings using Group Policy Preferences, instead of fiddling with getting the syntax in custom ADM templates juuust right ;-)
    – abstrask
    Aug 17, 2013 at 7:25
5

This was mentioned in the comments, but not clearly explained in any of the answers:

The offline Windows installer for Java doesn't prompt to install the Ask Toolbar. The link to the installer for the Java SE JRE (if you don't know what SE or JRE means, then this is what you want) is currently at:

http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html

The Windows offline installer for x86 (i.e. 32-bit software, includes most browsers) is clearly marked. The 64-bit installer seems to be offline-only.

1
  • This is great, but you will still have to uncheck it with each update.
    – Jirka-x1
    Nov 20, 2013 at 10:15
3

The javaruntime package on Chocolatey appears to avoid installing the Ask toolbar. I've been running that package and, unfortunately, the auto updater, and have not seen the Ask toolbar installed after an update from this initial source. I suspect the java updater adheres to the original installation parameters.

FYI, Chocolatey is a command-line Windows application/package manager, like apt-get for Linux.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .