Lenovo were preinstalling a Start Menu replacement on Windows 8 called Pokki. Uninstalling this works for a single user, but as soon as another user logs in, the application is reinstalled. This is not listed as Metro application that can be uninstalled using remove-appxpackage or remove-appxprovisionedpackage, as listed here (new window).
To uninstall this for all future users (This will not delete it for any users that have already created profiles, they will need to be done individually – see the end for more details):
Go into Programs and Features, and uninstall it like any other application
Yes choose to uninstall
Go into the \users\public folder, and delete the pokki folder
You will need to show hidden files and folders (see here for instructions - new window), and go in to the \users\default\appdata\local folder, and delete the pokki folder
Open regedit as ad administrator, select HKEY_USERS, click the file menu and select Load Hive…
Navigate to \users\default and select NTUSER.DAT
Give the hive a name, eg: pokkiDefault and click OK
Navigate to HKEY_USERS\pokkiDefault\Software\
Delete the POKKI key
Navigate to HKEY_USERS\pokkiDefault\Software\Microsoft\Windows\CurrentVersion\Run
Delete the Pokki string value
Select the HKEY_USERS\pokkiDefault key, select the file menu, and Unload hive… and select yes.
This will not delete pokki from profiles that are already created. You can however delete the pokki files from each user profile, and use the regedit method above to load the other users hive and remove it from their startup. I haven’t tried it but would also look at removing it from their Programs and Features list via this method: http://support.microsoft.com/kb/247501 and also looking in their hive at the equivalent HKCU registry location.
I'm on Windows 8.1. I don't see "NTUSER.DAT" for the step:
ReplyDeleteNavigate to \users\default and select NTUSER.DAT
OK, the file does exist. I just could not see it. Thanks for the link to show hidden and system files.
DeleteIt would be great if you could elaborate on the steps to delete pokki from existing profiles.
ReplyDeleteAlso, this was not the right path on my Win 8.1 system:
HKEY_USERS\pokkiDefault\Software\Microsoft\CurrentVersion\Run
It had to be changed to (and your screenshot agrees):
HKEY_USERS\pokkiDefault\Software\Microsoft\Windows\CurrentVersion\Run
You are correct, the registry location was incorrect, and I have updated the article, thank you.
DeleteOutlining the steps to remove it from existing profiles is an article I will look at doing in the future, thanks for the suggestion.
Thank you for this great step-by-step. Although in Windows 8.1, I had a few steps that did not work for me at first in removing Pokki. Such as, it would not let me delete the folder stating an item is running elsewhere, or it would not let me uninstall through >Programs>install/uninstall. I will also suspect that my McAfee virus program might have been preventing the folder from being deleted. I had put this program to its 'Block' list.
ReplyDeleteOnce removed from the HKEY_USERS, at least it stopped popping up. There was a 'uninstall' file inside users/appdata/pokki. After uninstall, I was able to delete the folder itself.
This program is definitely malicious. It is not some innocent byproduct that came with Windows. It slowly takes over.
Unfortunately, I was not able to find the NTUSER.DAT, but it might have gotten deleted together with the folder.
Thank you all very much for your efforts.
You're welcome, glad I could help. I think the word malicious is very appropriate for this software.
DeleteVery helpful.Thank you!
ReplyDeleteAfter googling around for hours, this is the only thing that worked! thanks!
ReplyDeleteThank you very much for your advice. The very fact users are having to resort to these acts of desperation speaks volumes about the honesty of those providing this 'software'. I'm fixing a laptop for someone and now this pops up, through no fault of their own? Great..
ReplyDeleteThe pop-up doesn't even tell you who it's from, and the privacy policy looks like it was written by an imbecile using copy and paste. Nothing is provided to legitimately tell users who this software is from and how to disabled it apart from the vague uninstall option which the authors KNOW does NOT fully work. So I ask as of January 2015: How and why has this 'bundle' been forced onto someone buying a new ACER laptop (Aspire E 13)?
DeleteHi, I am trying to get rid of this Pokki. Not able to find these in the registry. Access to many folders is denied. login password has got changed. Please help. Norton is not working.
ReplyDelete