1

I'd like to know (a) where the configuration files for the Windows Taskbar are stored, and (b) how to edit the files to remove the item of malware.

Yesterday I installed Foxit Reader and Foxit Mobile to my Windows 10 PC, unaware (at that time) of the company's history of bundled malware.

Almost instantly, the Foxit Reader had installed malware: an application called Reason Core Security, which added itself to the Start Menu, to the Task Bar, to the context-sensitive menus in Windows Explorer and even to the "Trusted Applications" list in my security software!

Seconds later the application began scanning my PC and apparently transmitting a stream of data via the internet off to god-knows-where.

Removal was painfully slow. Even after so-called "uninstallation" a search still found hundreds of files - including .exe files - that had been installed by Foxit or Reason and that were left buried in various locations. Deleting some files would trigger the Windows message "This will cancel all transfers in progress... ", suggesting that the files were trying to transmit data (even tho my internet was off by then).

After hours of work I thought that I'd got rid of all traces of the Foxit and Reason applications from the file system and the registry, had stopped the services running, etc.

But here's the one final problem that I just can't get rid of: Reason Core Security remains visible the Task Bar with the label "rsUI.exe - Reason Core Security (Protected)".

enter image description here

There's no file called rsUI.exe to be found anywhere on my PC, but the above seems to suggest that Reason Core Security is still running on the PC and is "protected" from being deleted?

So this leads to my specific question on SuperUser: (a) where does Windows Taskbar source its data from (e.g. is there a configuration file for the Windows Taskbar), and (b) can this be edited to directly remove the item of malware from the Windows Taskbar?

2
  • 1
    The configuration is most likely in the Windows registry (because MS hates actually editable config files for some reason). Not sure what keys though. Aug 2 '18 at 18:47
  • Thanks @AustinHemmelgarn. Following your suggestion I spent an entire day going through every item in the registry. The registry search found over 100 obscure registry entries for either Foxit Reader or Reason Core Security (even after both applications had been uninstalled and after hundreds of other files, stuffed into obscure locations, had been deleted). Even after deleting all 100+ registry items the phantom "rsUI.exe" remained visible on my TaskBar for two weeks. Thankfully it's gone now, possibly after switching my security software over to BitDefender.
    – TechnoCat
    Aug 21 '18 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.