[Resolved] Sneaky Programming

[Quiver318]

Quite by accident, I have discovered some sneaky coding in a major release of some very popular accounting software.

In short, I have installed this software into an encrypted volume and it works fine from there. But, when I close the volume (making the installed components unavailable, and secure) I have noticed that the MSI installer pops up whenever I open my web browser, and the installation is specific to this accounting software. The installer has somehow noticed that a DLL is missing, and it wants to put it back. Naturally, it can't because the volume is no longer mounted.

This DLL would seem to allow the accounting program to impersonate my browser for the purposes of getting past my personal firewall. If I had not discovered this, I think the accounting package would be phoning home with my accounting information, or spying on me.

My question to you is, how is the MSI installer even being made aware that the component is missing? Why does it come to life and try to put the file back, and how do I stop it so I can use my accounting software in peace?

Thanks,

Quiver