Caisey Blog

MSP · July 13, 2026

The Uninstaller Was Blocked by Trial AV: Killing PC App Store the Hard Way

Uninstalling a PUP that didn't want to leave
UninstallingPUP

The user installed PC App Store. Then it wouldn't go away — and the one tool that should have removed it, the app's own uninstaller, had been blocked by Webroot before Webroot itself got pulled off the machine. So now there's a persistent PUP with no working exit. Classic Monday.

The tech opened Caisey and typed one line: user installed "PC App Store" and it won't go away.

Caisey started by looking, not swinging. Before touching anything, it ran a read-only sweep across the usual hiding spots — installed programs, running processes, scheduled tasks, services. The Win32_Product query came back empty. So did processes and tasks. But the services check surfaced it: PcAppStoreSRV, stopped and disabled. That was the thread to pull. From there Caisey mapped the whole footprint. It pulled the service path, dug the uninstall entry out of the WOW6432Node registry hive (PC App Store, publisher "Fast Corporation LTD," version fa.2047 — a name that screams bundleware), and walked the install directory at Program Files (x86)\PCAppStore. That's where it flagged the part that matters: alongside the app were AutoUpdater and Watchdog components. Those are the reason these things "come back." Delete the folder alone and the watchdog quietly rebuilds it.

Caisey called it: potentially unwanted software, with active persistence. Then it stopped and asked before doing anything destructive. That's the moment worth noticing. The tech supplied the context Caisey couldn't have known — the uninstaller was dead, Trial Webroot was already gone — and gave the go-ahead. No autonomous cleanup. The tech approved the plan, and Caisey executed it.

And it executed it in order: stop the service and any live processes, sc delete PcAppStoreSRV to kill the registration, force-remove the install folder, clear the uninstall registry key, sweep the Run/RunOnce startup keys, then hunt down the orphaned Start Menu shortcut the first pass missed. Every step verified. Final check confirmed no service, no folder, no processes, no shortcut — and confirmed Webroot was in fact gone, matching what the tech had said.

Then it wrote the ticket note. Issue, cause, exact commands run, outcome, and a follow-up recommendation to run a full AV scan for any other hitchhikers. Copy, paste, done.

Do this by hand and you're bouncing between Add/Remove Programs (broken), Services.msc, regedit, and File Explorer, hoping you found the watchdog before it re-spawns the app behind you. Miss one persistence hook and you're back tomorrow. Caisey found all of them in about seventy seconds of diagnostics, then ran the removal in roughly two minutes once the tech said go.

Caisey
loading...