(Edit 24/02/15 – corrected registry location)
Lenovo were preinstalling a Start Menu replacement on Windows 8 called Pokki. Uninstalling this works for a single user, but as soon as another user logs in, the application is reinstalled. This is not listed as Metro application that can be uninstalled using remove-appxpackage or remove-appxprovisionedpackage, as listed here (new window).
To uninstall this for all future users (This will not delete it for any users that have already created profiles, they will need to be done individually – see the end for more details):
Go into Programs and Features, and uninstall it like any other application
Yes choose to uninstall
Go into the userspublic folder, and delete the pokki folder
You will need to show hidden files and folders (see here for instructions – new window), and go in to the usersdefaultappdatalocal folder, and delete the pokki folder
Open regedit as ad administrator, select HKEY_USERS, click the file menu and select Load Hive…
Navigate to usersdefault and select NTUSER.DAT
Give the hive a name, eg: pokkiDefault and click OK
Navigate to HKEY_USERSpokkiDefaultSoftware
Delete the POKKI key
Navigate to HKEY_USERSpokkiDefaultSoftwareMicrosoftWindowsCurrentVersionRun
Delete the Pokki string value
Select the HKEY_USERSpokkiDefault key, select the file menu, and Unload hive… and select yes.
This will not delete pokki from profiles that are already created. You can however delete the pokki files from each user profile, and use the regedit method above to load the other users hive and remove it from their startup. I haven’t tried it but would also look at removing it from their Programs and Features list via this method: http://support.microsoft.com/kb/247501 and also looking in their hive at the equivalent HKCU registry location.
I'm on Windows 8.1. I don't see "NTUSER.DAT" for the step:
Navigate to usersdefault and select NTUSER.DAT
OK, the file does exist. I just could not see it. Thanks for the link to show hidden and system files.
It would be great if you could elaborate on the steps to delete pokki from existing profiles.
Also, this was not the right path on my Win 8.1 system:
HKEY_USERSpokkiDefaultSoftwareMicrosoftCurrentVersionRun
It had to be changed to (and your screenshot agrees):
HKEY_USERSpokkiDefaultSoftwareMicrosoftWindowsCurrentVersionRun
You are correct, the registry location was incorrect, and I have updated the article, thank you.
Outlining the steps to remove it from existing profiles is an article I will look at doing in the future, thanks for the suggestion.
Thank you for this great step-by-step. Although in Windows 8.1, I had a few steps that did not work for me at first in removing Pokki. Such as, it would not let me delete the folder stating an item is running elsewhere, or it would not let me uninstall through >Programs>install/uninstall. I will also suspect that my McAfee virus program might have been preventing the folder from being deleted. I had put this program to its 'Block' list.
Once removed from the HKEY_USERS, at least it stopped popping up. There was a 'uninstall' file inside users/appdata/pokki. After uninstall, I was able to delete the folder itself.
This program is definitely malicious. It is not some innocent byproduct that came with Windows. It slowly takes over.
Unfortunately, I was not able to find the NTUSER.DAT, but it might have gotten deleted together with the folder.
Thank you all very much for your efforts.
You're welcome, glad I could help. I think the word malicious is very appropriate for this software.
Very helpful.Thank you!
After googling around for hours, this is the only thing that worked! thanks!
Thank you very much for your advice. The very fact users are having to resort to these acts of desperation speaks volumes about the honesty of those providing this 'software'. I'm fixing a laptop for someone and now this pops up, through no fault of their own? Great..
The pop-up doesn't even tell you who it's from, and the privacy policy looks like it was written by an imbecile using copy and paste. Nothing is provided to legitimately tell users who this software is from and how to disabled it apart from the vague uninstall option which the authors KNOW does NOT fully work. So I ask as of January 2015: How and why has this 'bundle' been forced onto someone buying a new ACER laptop (Aspire E 13)?