Wednesday, February 4, 2015

Uninstall Pokki for All Users

(Edit 24/02/15 - corrected registry location)

Lenovo were preinstalling a Start Menu replacement on Windows 8 called Pokki.  Uninstalling this works for a single user, but as soon as another user logs in, the application is reinstalled.  This is not listed as Metro application that can be uninstalled using remove-appxpackage or remove-appxprovisionedpackage, as listed here (new window).

To uninstall this for all future users (This will not delete it for any users that have already created profiles, they will need to be done individually – see the end for more details):

Go into Programs and Features, and uninstall it like any other application




Yes choose to uninstall



Go into the \users\public folder, and delete the pokki folder



You will need to show hidden files and folders (see here for instructions - new window), and go in to the \users\default\appdata\local folder, and delete the pokki folder



Open regedit as ad administrator, select HKEY_USERS, click the file menu and select Load Hive…
Navigate to \users\default and select NTUSER.DAT



Give the hive a name, eg: pokkiDefault and click OK



Navigate to HKEY_USERS\pokkiDefault\Software\
Delete the POKKI key



Navigate to HKEY_USERS\pokkiDefault\Software\Microsoft\Windows\CurrentVersion\Run
Delete the Pokki string value



Select the HKEY_USERS\pokkiDefault key, select the file menu, and Unload hive… and select yes.


This will not delete pokki from profiles that are already created.  You can however delete the pokki files from each user profile, and use the regedit method above to load the other users hive and remove it from their startup.  I haven’t tried it but would also look at removing it from their Programs and Features list via this method: http://support.microsoft.com/kb/247501 and also looking in their hive at the equivalent HKCU registry location.

10 comments:

  1. I'm on Windows 8.1. I don't see "NTUSER.DAT" for the step:
    Navigate to \users\default and select NTUSER.DAT

    ReplyDelete
    Replies
    1. OK, the file does exist. I just could not see it. Thanks for the link to show hidden and system files.

      Delete
  2. It would be great if you could elaborate on the steps to delete pokki from existing profiles.

    Also, this was not the right path on my Win 8.1 system:
    HKEY_USERS\pokkiDefault\Software\Microsoft\CurrentVersion\Run

    It had to be changed to (and your screenshot agrees):
    HKEY_USERS\pokkiDefault\Software\Microsoft\Windows\CurrentVersion\Run

    ReplyDelete
    Replies
    1. You are correct, the registry location was incorrect, and I have updated the article, thank you.
      Outlining the steps to remove it from existing profiles is an article I will look at doing in the future, thanks for the suggestion.

      Delete
  3. Thank you for this great step-by-step. Although in Windows 8.1, I had a few steps that did not work for me at first in removing Pokki. Such as, it would not let me delete the folder stating an item is running elsewhere, or it would not let me uninstall through >Programs>install/uninstall. I will also suspect that my McAfee virus program might have been preventing the folder from being deleted. I had put this program to its 'Block' list.
    Once removed from the HKEY_USERS, at least it stopped popping up. There was a 'uninstall' file inside users/appdata/pokki. After uninstall, I was able to delete the folder itself.
    This program is definitely malicious. It is not some innocent byproduct that came with Windows. It slowly takes over.

    Unfortunately, I was not able to find the NTUSER.DAT, but it might have gotten deleted together with the folder.

    Thank you all very much for your efforts.

    ReplyDelete
    Replies
    1. You're welcome, glad I could help. I think the word malicious is very appropriate for this software.

      Delete
  4. Very helpful.Thank you!

    ReplyDelete
  5. After googling around for hours, this is the only thing that worked! thanks!

    ReplyDelete
  6. Thank you very much for your advice. The very fact users are having to resort to these acts of desperation speaks volumes about the honesty of those providing this 'software'. I'm fixing a laptop for someone and now this pops up, through no fault of their own? Great..

    ReplyDelete
    Replies
    1. The pop-up doesn't even tell you who it's from, and the privacy policy looks like it was written by an imbecile using copy and paste. Nothing is provided to legitimately tell users who this software is from and how to disabled it apart from the vague uninstall option which the authors KNOW does NOT fully work. So I ask as of January 2015: How and why has this 'bundle' been forced onto someone buying a new ACER laptop (Aspire E 13)?

      Delete