I think the detection should certainly trigger before the wrapper does anything;
This is almost certainly not realistic/practical.
The wrapper is going to do its own thing, and then unpack and launch your original pristine installer after it has offered up its bundled adware, etc.
If you wanted to physically stop the wrappers from running, the only solution is to have some other software already running (like an antivirus) that detected it and stopped it. And if you are the kind of person who would run such a tool constantly in the background, you are also the kind of person who won't get bit by these wrapped installers in the first place.
However, I believe that the solution with the dll preventing your program from installing from a wrapper and telling the user why will accomplish the same goals.
The most likely result of having this dll prevent the wrapper from completing its installation, is that it will never be wrapped in the first place.
First, it's quite likely that the automated wrapper creation tool will abandon trying to wrap your program, meaning you will stop this problem before it ever gets to the user. Second, if it they do try to distribute your wrapped program, it won't be long before they get enough complaints from users that downloaded it that they will remove the wrapper and put back your original.
-mouser
Maybe this is a double barreled problem. For example, with me as your test case, "Anti-Virus" programs do nothing about junk installers. So what if you just spread a second project dll/file that looks for the top twelve junkware installers and sorta acts like an Anti-Virus addon? Aka "No they're not viruses, exactly, but they're mean. You probably shouldn't be running that. So whatever cool little tool you just tried to download was scooped up. Try to find the original copy."
Twist - sometimes the wrapped copy is the only one left after a few years. Web volatility and all.
It's like I want this utility to "scan inside itself" to see whatever it will *eventually* install, then notice that's not the same as the wrapped mess, then do something. It sounds easy in concept logic, prob tricky to really do.
Edit: I just installed a new copy of Java. They used to have a nasty installer, but I forgot what was bundled with it. Today the new one "just did what apparently it was supposed to". (We'll see!!)