I'd like to know (a) where the configuration files for the Windows Taskbar are stored, and (b) how to edit the files to remove the item of malware.
Yesterday I installed Foxit Reader and Foxit Mobile to my Windows 10 PC, unaware (at that time) of the company's history of bundled malware.
Almost instantly, the Foxit Reader had installed malware: an application called Reason Core Security, which added itself to the Start Menu, to the Task Bar, to the context-sensitive menus in Windows Explorer and even to the "Trusted Applications" list in my security software!
Seconds later the application began scanning my PC and apparently transmitting a stream of data via the internet off to god-knows-where.
Removal was painfully slow. Even after so-called "uninstallation" a search still found hundreds of files - including .exe files - that had been installed by Foxit or Reason and that were left buried in various locations. Deleting some files would trigger the Windows message "This will cancel all transfers in progress... ", suggesting that the files were trying to transmit data (even tho my internet was off by then).
After hours of work I thought that I'd got rid of all traces of the Foxit and Reason applications from the file system and the registry, had stopped the services running, etc.
But here's the one final problem that I just can't get rid of: Reason Core Security remains visible the Task Bar with the label "rsUI.exe - Reason Core Security (Protected)".
There's no file called rsUI.exe to be found anywhere on my PC, but the above seems to suggest that Reason Core Security is still running on the PC and is "protected" from being deleted?
So this leads to my specific question on SuperUser: (a) where does Windows Taskbar source its data from (e.g. is there a configuration file for the Windows Taskbar), and (b) can this be edited to directly remove the item of malware from the Windows Taskbar?
