91

We will have proctored online exams because of COVID-19 for which we must install proctoring software (spyware) that will download and run additional software after installation and monitor everything on the computer.

I know that I have to install the software and that virtual machines are not allowed. However, I would like to 100% uninstall the software and everything that the software has installed after my exam, how could this best be achieved?

I have not yet installed the proctoring software.

  • 4
    Thank you. The software is from Examity, but I think it would be great if there is a solution for all students, regardless of whether they must install software from Examity, ProctorU, Proctorio, etc. – Anne Maier Nov 26 '20 at 9:20
  • 23
    @Tetsujin Neither the education authority nor the software maker have an incentive to tell you how to actually remove the low-level OS integration it performs, as opposed to just pretend that the software can simply be uninstalled by disappearing the pretty UI. – goncalopp Nov 27 '20 at 4:01
  • 9
    By "virtual machines are not allowed", do you mean that the software scans if there are virtual machines on the OS its running on, or that the software scans if itself is running in a VM? Im curious on how good the software is at detecting if its running in a VM – Flying Thunder Nov 27 '20 at 7:13
  • 22
    Your school is going to lose their minds when they learn people can own more than one device. 🤦‍♂️ If your school is run by intelligent people, you could point out that the software is useless and you'd prefer to not install it. In my experience, the odds of that are very low though. – twiz Nov 27 '20 at 22:26
  • 8
    I fail to understand; if one doesn't own Windows machine; what happens? Just pretend that dog ate the Windows machine. On a serious note, raising awareness is number one action as described in answer below. You are going to install a software which "99/100" security experts would advised against. – Kyslik Nov 30 '20 at 14:48

13 Answers 13

93

No extra hardware required:

  • The "probably good enough" approach would be to make a System Restore point before installing the software and rollback to it later. Some configuration and temporary files etc. can remain after this, as System Restore is preserving user files and only restoring executables to the earlier state, but without anything to make use of them these files will be harmless. They can take up a (probably insignificant) amount of disk space, but they won't make a difference security- and privacy-wise.

Extra disk required:

  • You can take a full disk image (or OS partition image) to an external drive before installing software in question and restore the image later. This will undo everything that happened on that disk in the meantime, including changes in user files, so if you're using a password manager etc. make sure you have an independent copy on another media.

  • If you have a second internal disk of at least the same size and without anything important on it, you can clone the system disk to that one, swap them and install the software on the cloned disk. Once you're done just repartition & format the clone. Your original disk stays untouched the entire time.

Some extra disk space required:

  • The ultimate approach would be to install a throwaway OS just for this purpose. The advantage of this method is that it will protect all your data from being accessed by potentially rogue software, assuming that you're using a separate/clean disk or other partitions are not mounted. Combine this with a full disk image and you can do without actually swapping any hardware and without a spare disk (except for an external disk for the image).

USB flash drive or external drive required:

  • A variant of the "throwaway OS" approach is to use a live system on a USB flash drive/external drive, namely the Windows To Go feature. You could use Rufus to create a Windows To Go flash drive from an official ISO downloaded from Microsoft (also possible with Rufus). You can then boot from that USB media to a clean Windows install without affecting your main OS. Make sure that your disk partitions are not mounted for privacy. (Thanks to @MechMK1 and @Akeo for suggesting this in the comments!)

Possible alternatives:

  • There's also software that makes sure the disk is restored to a previous snapshot on each boot. I've never used it though, so I don't know how effective it would be for your use case.
  • 5
    I hadn't considered Deep Freeze like software, but I wonder if that would be seen as "working around" in a similar way that a VM would... – Mokubai Nov 26 '20 at 9:27
  • 6
    Honestly, a live OS would probably be best if it is possible. A throwaway OS is probably second in terms of success rate. – MechMK1 Nov 26 '20 at 21:45
  • 4
    @gronostaj You can run Windows 10 live from a USB stick. It's a bit of a hassle, but it works. Besides, Linux support isn't that uncommon anymore. – MechMK1 Nov 27 '20 at 10:11
  • 20
    @grosnotaj, Windows To Go was NOT removed from Windows 20H1 or 20H2. It's just no longer officially supported by Microsoft, which is very different. Basically, what they removed was the obsolete WTG creation tool, that they hadn't updated since Windows 8, and then stated that they wouldn't work on the WTG feature any longer. But WTG still works absolutely fine with these versions. Source: I am the author of Rufus, and I test every new Windows release for WTG. So can you please amend your answer? OP should be able to download 20H2 (which can be done through Rufus btw) and create a WTG drive. – Akeo Nov 27 '20 at 13:26
  • 2
    @Akeo Answer updated and I've cleaned up my comments, thanks! – gronostaj Nov 27 '20 at 13:54
67

There's several solutions to this, both social and technical.

Technical Solutions

It's usually technically impossible to remove windows software after it's been run or installed. You can remove the superficial parts, but deeper modifications to the operating system will remain.

Please check the "social solutions" section of this answer for ways to prevent the software from being installed in the first place.


Make the software not able to run on your computer in a way that is provably the fault of the software vendor.

The simplest way to do this is to run a Linux live CD like Mint. Examity and ProctorU run only on Windows and Mac. You could also get a loaned a chromebook from someone, perhaps.

This makes no changes to your computer at all, and allows you to plausibly claim that the software doesn't work on your computer. If the school needs you to have a windows computer, they can provide one to you.


Clone your whole hard drive, aka fulldisk image, before the install. This is possibly to do with free open-source tools like clonezilla. You'll need a second hard drive of at least the same size.

This is impossible to detect, and you can restore the image after the exam. This is technically hard, and might require a lot of reading, but should be 100% safe if done correctly.


Use a system modification detector to revert changes.

Software like Total Uninstaller can detect changes made to your system and revert them. You'll need to scan your computer before and after the installation of the malware.


Make a system restore point if no other option works, then restore it after you don't need the software anymore. This is the least safe option, as the software might delete or tamper the restore point.


Do a factory reset. This will erase all the data in the computer, so you'll have to backup everything to do that. This should be relatively safe, although it won't protect against the nastiest varieties of software, depending on your computer.


 

Social solutions

Social solutions are the safest option, since it prevents any infection from happening in the first place. They will also have the most long-lasting effects, since you're helping everyone around you.

It might be hard to achieve a social solution. This depends on your colleagues' values and attitude, your social circle and how comfortable you are reaching out to strangers for help.


Raise awareness of the problems and organize together with other students

Having this software is not in any students interest, so you simply shouldn't install it. To prevent repercussion, you'll need to do this as a group.

Your teacher won't fail the whole class. And if they try, you raise the issue to the school board. And if the school board doesn't do anything, you raise the problem to the school supervisory authority.


Ask for help and educate others around you.

You're not alone in this. See this article for example. You can try to reach out to people that are researching the problems, they'll probably have better guidance for you than superuser.

A local computer expert group would understand the problem and could potentially help explain the issues to your teachers and school.


Research the problem and find a solution

You can search for articles like this one, that show how this software exposes your name, address and passwords to hackers. Or this one about how students are watched live on camera remotely by people from random countries and can't move away even in extremely embarrassing situations.

Compile a list of the problems, and explain it to people around you. Try to understand what other students (and perhaps their families) care about the most. Talk with your teachers. Then research some more.

It's important that you don't just focus on the problem, but actually provide a solution that is better for everyone, students, teachers and schools.

Software like this does not prevent cheating. Students have managed to successfully cheat for centuries, even under close surveillance from their teachers and huge penalties.

The only way to reliably prevent cheating is to design the tests in a way that having access to material (including books, notes and the internet) is not sufficient to pass without having learned the material. That is your teachers responsibility. It is also the only way to check that you actually learned anything, instead of just memorizing.

If your teachers are concerned about students copying from each other, this can be reliably detected manually if the answers are long-form, or statistically if they're multiple choice. It's some extra work for teachers, for sure, but tests can be changed and that is their job.


  • 9
    +1 This should be upvoted much further. While I realize it's not completely practical, raising awareness is absolutely crucial. The approach of schools and more importantly the states/nations sanctioning or forcing this is extremely invasive and in my opinion utterly indefensible. The fact that so many people just rollover "because pandemic and it's hard" is scary. – DRF Nov 27 '20 at 13:41
  • I don't know if it's the case for OP, but some schools can and will fail you as you must sign an agreement to the terms of the semester when registering for classes. That doesn't make it right, but it's a very real concern when your grades are on the line. – JS Lavertu Nov 27 '20 at 14:02
  • @DRF I would get the pandemic and suddenly we need something argument. However, even so, raising awareness to make sure this practice is a terrible compromise and needs to be rolled back/discarded as soon as the emergency is over (even if schools/universities by then have learned that remote can have its advantages) is as important when you accept it as a compromise. – Frank Hopkins Nov 27 '20 at 20:06
  • @StianYttervik: It's time to bring down the house on these browsers that demand admin rights anyway. – Joshua Nov 29 '20 at 5:57
  • 2
    -1 for "Raise awareness of the problems to other students, organize and refuse to install the software as a group." - school doesn't ask you to use the program because they want bad to you. It's also your interest that exams happen exactly the same way for everybody. Instead of protesting, help the school looking for better options. – Máté Juhász Nov 29 '20 at 7:12
23

This might not be the best option but it was not mentioned yet so consider this more a 'nice to know'.

Windows has support for FBWF (file based write filter) or its successor UWF (unified write filter).

Unified Write Filter (UWF) is an optional Windows 10 feature that helps to protect your drives by intercepting and redirecting any writes to the drive (app installations, settings changes, saved data) to a virtual overlay. The virtual overlay is a temporary location that is usually cleared during a reboot or when a guest user logs off.

https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/unified-write-filter

Basically when you turn it on, it will write ANY file changes to a shadow copy of the disk. When you reboot, the shadow copy gets deleted, and the original state gets reinstated.

This means you could enable UWF, install the software etc, then turn it off when you're done and reboot again. After that it's like you did not even install the software at all.

At a company I work for we use this on machines to prevent viruses or on-site staff fiddling with configurations. We've actually had a big case of virus in the network that took down a bunch of machines (all interlinked) and our big save was that we could just reboot and the virus was gone. That being said machines from other vendors were still infected and would promptly reinstall the virus, but we could simply unlink the machine and reboot again. It was a life-saver, so i'm promoting this feature where I can.

I did not find it a very easy tool to use, there are some slight nuances you must know if you're gonna run this for a longer period, but for a case like this I would recommend it as an alternative.

BE AWARE of the requirements and limitations, see the link.

Windows 10 Enterprise, Windows 10 IoT Core, or Windows 10 IoT Enterprise.

  • 4
    I think this is a good option but it's unlikely that the OP would be running Windows 10 Enterprise on his/her personal computer (and obviously, not Windows 10 IoT). – 41686d6564 Nov 28 '20 at 8:18
19

Once you have given an invasive piece of software complete access to your machine then it is difficult to ever fully excise it. You might be able to uninstall it and that may even completely get rid of it, but there could well be configuration changes and movement of other items that you can never fully undo.

The best thing you can do if you want absolutely no trace whatsoever is to take a full image backup using Clonezilla.

What you would do is boot from a Clonezilla USB or DVD/CD, create a full disk backup to a suitably large USB hard disk, and then when you are done restore that backup image and in so doing erase everything that is currently there.

You would want to backup everything from while the software was installed as well, in case there were documents you worked on that you need to restore as well. Cloud services or another full disk image would help here.

  • 3
    For PCs with multiple hard drives instead of backing every single one of them, disconnecting the ones which are not necessary for the exam might be a better option. – Jan Dorniak Nov 26 '20 at 19:04
7

Windows Sandbox

Recent versions of Windows 10 (Professional and Enterprise) have built-in support for a feature called Windows Sandbox, which is a lightweight virtualized instance of Windows 10. The sandbox is isolated from the host system through container mechanisms and all changes applied to the sandbox will be lost upon closing the sandbox window. The main motivation behind sandbox was to provide means for safely running untrusted software, without the overhead of having to fire up a virtual machine.

The sandbox allows selective data sharing with the host system, e.g. by configuring shared folders on the hard disk, which allows for fine-grained control of which parts of the data are shared.

You mentioned that "virtual machines are not allowed", which is a fuzzy constraint which may or may not be violated by using the Windows sandbox, which is more of a container than a virtual machine. In Windows 10, when virtualization support is activated in the operating system, all instances are virtualized, so the sandbox is technically no different from your normal Windows 10 session. It's just another instance running under the same hypervisor. But you might want to double-check with the authorities when in doubt.

  • Interesting answer, I think this approach is worth looking into. "On Windows 10 all instances are virtualized" - if you have Hyper-V platform enabled. Otherwise no, it's still just bare metal Windows. – gronostaj Nov 30 '20 at 20:13
  • @gronostaj Good point about Hyper-V, thanks. I adapted the answer. – ComicSansMS Dec 3 '20 at 17:54
  • 2
    Was going to propose Sandboxie, and saw this. Native process sandboxing in Windows? Nice! – Marc.2377 Dec 5 '20 at 0:11
6

To directly answer your question, the only way to be 100% sure is to never have installed it. And you can achieve that even after installing by cloning the disk before installing.

The easiest way to do it is to buy what's called a HDD duplicator and a new disk of at least the same size, although it's preferable if you have an identical second disk. This is assuming that you actually need all your software for the exam and just installing windows + proctoring on a new HDD is not going to cut it.

Next step is as easy as plugging your disk in port A, plugging the empty disk in port B, plugging the device to power, pressing on clone and wait.

enter image description here

After you're done with the exam, just wipe the old drive and continue using the new drive.

You can achieve the same by using software like [dd][2], as long as you want to put the effort to understand how it works, as a single wrong letter may lose you data.

Moreover, you can also be less extreme and just clone the partition of interest into an image on a free section of the same drive, and then write it back to the same partition after the exam is done.

DD has many options, and how to use it is probably out of scope for this question, but using it, or a physical HDD duplicator, are your best bets if you want to be 100% sure.

In most cases though, I believe using the windows uninstaller will be about as good and much easier.

  • 2
    This should be the accepted answer. The other solution is just to do a fresh OS install or a side-by side install of another OS and boot to it. – mckenzm Nov 29 '20 at 5:14
  • There are dozens of free tools that do the same thing as a duplicator, but without the need to purchase extra hardware you'll use only once. What are the advantages of a physical duplicator? – gronostaj Nov 29 '20 at 9:11
  • @gronostaj you mean, like the free tool I suggested in the answer, or something completely different? – Andrei Nov 29 '20 at 10:32
  • 1
    dd, while unefficient compared to other tools, would be fine. So what would be the advantage of buying a hardware duplicator? – gronostaj Nov 29 '20 at 10:46
  • @gronostaj how am I supposed to say what are the advantages of a HDD duplicator when compared to these other tools that you have in mind, but won't let anyone know about? I guessed dd (which is only not as efficient as a HDD duplicator), but obviously I am not a mind reader. – Andrei Nov 29 '20 at 11:36
4

This is covered in the Help article How do I uninstall the Software Secure proctoring software?

It says in effect that the software can be uninstalled from Control Panel > Programs and Features, where it's called "PSI Secure Browser".

To clean-up after it, you should in the folder C:\Users\Username\AppData\Roaming delete the following folders:

  • PSI Secure Browser
  • psi-secure-browser
  • com.psiexams.psi-secure-browser

For being sure, I would recommend uninstalling the software while using Revo Uninstaller Freeware with Advanced scanning afterward, then further checking if the above folders have been deleted.

  • 3
    I'd think this type of uninstall would often leave behind some deep system modifications and registry entries? – goncalopp Nov 27 '20 at 4:29
  • 1
    @goncalopp: Not necessarily. This software seems to be non-profit and ethically written, even advising of where are potentially left-over files. – harrymc Nov 27 '20 at 6:59
  • I have had good experience with Revo Unistaller, even with those "deep system modifications and registry entries". – Mawg says reinstate Monica Nov 29 '20 at 8:10
  • 2
    @harrymc As far as I can tell PSI Secure Browser (note that OP doesn't limit their question to a specific software or vendor) is written by a for profit firm, PSI Services LLC. I'm not sure how you define "ethically written", but the software prevents "taking screen captures, using instant messaging programmes, accessing other applications, or accessing other websites" – goncalopp Dec 6 '20 at 18:37
  • @goncalopp: Software that is handed out by a university, article published on .org, are reasons enough. These permissions sound logical for avoiding cheating. – harrymc Dec 6 '20 at 18:55
2

Install it on a different hard drive. this is going to cost you $40-200 and some time with a screwdriver. (and a reinstall on the new disk)

2

I am aware of a software called Deep Freeze which works on Windows and OSX. I believe using it is the most painless (albeit non free) way for you to achieve what you want. Maybe there's a trial version available that you can use if your use case is a one time thing?

I've seen it being used on computers at my university as well as many cyber cafes. What it does is that once installed, it 'freezes' your system state and no matter what you install or delete, a system reboot will restore your computer back to the 'frozen' state. You could install/uninstall drivers, malware, make registry changes, delete System32 and more but when you reboot your computer, it returns back to its 'frozen' state and all your changes are lost. So if you freeze your computer, install the proctoring software, finish your exam and then reboot, your computer would be restored back to the state it was in before the proctoring software was installed and this happens instantly so there's no need to make disk images and restore your system from those images.

I had used this software ages ago so maybe it has some new features now but that's the gist of it. Unfortunately it's not a free solution but if they have a trial version available and you only need this once, you should be covered.

Oh and don't forget to 'thaw' your system or uninstall Deep Freeze after you're done otherwise it'll just keep discarding all your changes on every reboot.

I just found out they do have a 30 day trial. You can download it from here: https://www.faronics.com/en-uk/downloads_en-uk/download-files_en-uk//?product=DFS,

1

Total Uninstaller

It’s been a decade or more since I used this utility, but I recall it worked well for me in the past and still seems to be supported on Windows 10.

https://www.martau.com/

This is a utility that you start running before installation, and then tell it when you have finished installing. While it is running, is analyzing every change made and keeps it in a log. It then gives you the ability to undo everything that was done.

The "Monitored Programs" module helps monitor any changes made to your system during the installation of a new program. It allows you to perform a complete uninstall without having to rely on the supplied built-in uninstaller, which can leave files or changes behind.

Note that this will only track changes while it is running. So if the program makes changes later, those would not be tracked. You would need to leave this running as long as the app is running to be completely sure you tracked everything.

1

Don't install it on your existing system. A system compromised with malware is permanently compromised; there's no way to undo it. If a VM won't work (it should, but only if you can make it sufficiently complete), then just run your "VM" on the bare metal: disconnect your system drive and boot a throwaway system from a USB thumb drive. This has a small cost, but you can get high-speed, high-capacity (even 128 or 256 GB) USB 3 thumb drives for under $35.

  • Thank you. As far as I know, the software works in a VM, but using a VM is prohibited by the software provider. And if you try to hide the VM and if the software still notices that it is running in a VM, you will fail the exam. – Anne Maier Nov 29 '20 at 9:18
  • Yes. In theory VM should work if you make it complete enough but it's high-stakes to test and you may not have access to test in advance. That's why I suggest using a throwaway windows install on removable media instead. – R.. GitHub STOP HELPING ICE Nov 29 '20 at 20:39
0

I trust this tool. It cleans up the files, registry and any thing related:

https://www.iobit.com/en/advanceduninstaller.php

0

I would buy an additional internal disk drive and a contractor that let access it over USB.

Then install the new disk in your machine, install a fresh Windows install on it, and then use the connect to access any files you need from your existing disk copying them over. Unplug existing disk before installing the untrusted software.

Depending how much you untrust the software you can decide if you reformat the disposable new internal disk, or if you burn it when the exam is over.

However this still leaves the issues that the untrusted software can replace you bios.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.