View original (French)

I would like to uninstall Wondershare.

Solved
equinoxenav Posted messages 571 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,

It has been a long time since I needed your services.
I found Wondershare! I ran an Adwcleaner and the report is here:

https://pjjoint.malekal.com/files.php?id=20170329_q15p8j11w12b11

Thank you for supervising it like last time! Best regards.

Windows 7.
Configuration: Windows / Chrome 56.0.2924.87

7 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

    Open Notepad: Press Windows + R,
    In the "Run" field, type notepad and hit OK.
    Copy/Paste the following into it: 


    CloseProcesses:
    CreateRestorePoint:
    (Wondershare) C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe 
     HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare) 
     C:\Program Files\Common Files\Wondershare
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Once the text is pasted into Notepad,
    Go to the "File" menu and then "Save As",

    On the left, navigate to the Desktop,

    In the bottom field, for the file name type: fixlist.txt
    Click on "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click on the "Fix" button
    A restart may be necessary (not mandatory)
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    --
    Please press any key to continue the disinfection...
    5
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    Follow the FRST tutorial. ( take the time to read carefully - everything is well explained ).

    Download and run the FRST scan, 3 FRST reports will be generated:
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Send these 3 reports to the site http://pjjoint.malekal.com/ and in return provide the 3 pjjoint links leading to the reports here in a new response so that we can consult them.

    --
    Please press any key to continue the disinfection...
    1
  4. equinoxenav Posted messages 571 Status Member 7
     
    Everything is fine, Once again THANK YOU!!!!!!!
    0
  6. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    You're welcome and have a great day! :)

    --
    Please press a key to continue the disinfection...
    0
  7. lolo9550 Posted messages 1 Status Member
     
    here are the links
    https://pjjoint.malekal.com/files.php?id=FRST_20170701_c5q8x9s159
    https://pjjoint.malekal.com/files.php?id=20170701_d12q5i7b10g13
    https://pjjoint.malekal.com/files.php?id=20170701_m14b10n14z14k15
    thank you in advance
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      Hi lolo,

      You have some Wondershare programs installed, you need to uninstall them (perhaps along with other relatively useless ones that can slow down Windows)

      go to the Control Panel
      then programs and features.
      CyberLink
      Java
      SweetPacks bundle uninstaller
      WildTangent Games App (unless you play those games)
      Windows Live Essentials
      Wondershare SafeEraser

      then:

      Here is the correction to be made with FRST. You can use this explanatory note with screenshots as a guide.

      Open Notepad: Windows Key + R,
      In the "Run" field, type notepad and hit OK.
      Copy/Paste the following into it: 


      CreateRestorePoint:
      CloseProcesses:
      HKU\S-1-5-21-4036344433-3017104236-4118162681-1003\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)
      Access the disinfection procedure
       HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe 
       HKLM-x32\...\Run: [Wondershare Helper Compact] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe 
       HKU\S-1-5-21-4036344433-3017104236-4118162681-1003\...\Run: [Wondershare Helper Compact] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe 
       ShortcutTarget: SafeEraser Service.lnk -> C:\Program Files (x86)\Wondershare\SafeEraser\SafeEraserNotifier.exe (Wondershare) 
       S3 WsDrvInst; C:\Program Files (x86)\Wondershare\SafeEraser\DriverInstall.exe [115344 2016-10-20] (Wondershare) 
       2017-06-05 00:34 - 2017-03-04 17:28 - 00000000 ____D C:\Users\juery\AppData\Roaming\Wondershare 
       2017-06-05 00:34 - 2017-03-04 17:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare 
      Hosts:
      EmptyTemp:
      RemoveProxy:
      Reboot:


      Once the text is pasted into Notepad,
      Menu "File" then "Save As",
      On the left, navigate to the Desktop,
      In the bottom field, file name type: fixlist.txt
      Click on "Save", it will create fixlist.txt on the Desktop.

      Restart FRST and click the "Fix" button
      A reboot may be necessary (not required)
      A text file will appear, copy/paste the content here in a new message.

      Restart the computer.
      0
  8. Habakuk
     
    Here are the links:

    https://pjjoint.malekal.com/files.php?id=FRST_20180530_o13p14g15c10r13

    https://pjjoint.malekal.com/files.php?id=20180530_j7j9d6m15d11

    https://pjjoint.malekal.com/files.php?id=20180530_n5p11v13d10c12

    Thank you in advance!
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      Hello,

      There are malware issues because of the cracks you are downloading.


      You have programs that were installed when you purchased the computer or subsequently installed that may not be useful.
      They clutter Windows and can slow it down.
      You can therefore uninstall them.
      Go to the Control Panel
      then Programs and Features.
      Uninstall:

      CCleaner
      Glary Utilities
      CyberLink
      Wondershare


      PS: CCleaner is not really useful, even though it is recommended everywhere.
      If you want to keep it, disable CCleaner's monitoring, which is unnecessary, as it starts up with Windows and slows it down with its incessant cleaning. See: https://www.malekal.com/supprimer-ccleaner-demarrage-windows/


      Here is the correction to perform with FRST. You can refer to this explanatory note with screenshots.
      Restart FRST and then press CTRL + Y on your keyboard.
      The notepad will open, copy/paste this. 

      CreateRestorePoint:
      CloseProcesses:
      2018-05-05 23:54 - 2018-05-30 03:17 - 000000028 _____ C:\ProgramData\rwi.khad 
       2018-05-05 23:54 - 2018-05-30 03:17 - 000000004 _____ C:\ProgramData\lock.dat 
       2018-05-05 23:51 - 2018-05-30 04:08 - 000000000 ____D C:\ProgramData\97f29a35-8705-47de-97b4-45277a5a7676 
       2018-05-05 23:51 - 2018-05-30 03:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Healer 
       2018-05-05 23:51 - 2018-05-30 03:03 - 000000000 ____D C:\ProgramData\5ef56cd9-83de-4b9a-9c95-e64c97565d3e 
       2018-05-05 23:51 - 2018-05-30 03:03 - 000000000 ____D C:\Program Files (x86)\SystemHealer 
       2018-05-05 23:51 - 2018-05-05 23:51 - 000003328 _____ C:\Windows\System32\Tasks\System Healer Monitor 
       2018-05-05 23:51 - 2018-05-05 23:51 - 000003320 _____ C:\Windows\System32\Tasks\System Healer Delayed 
       2018-05-05 23:50 - 2018-05-30 02:55 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\Native Systema 
       2018-05-05 23:50 - 2018-05-05 23:50 - 000002293 ____H C:\Users\HABAKUK\Desktop\Google Chrome.lnk 
       2018-05-05 23:50 - 2018-05-05 23:50 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\SystemHealer 
       2018-05-05 23:49 - 2018-05-30 03:23 - 000000000 _RSHD C:\Users\HABAKUK\AppData\Roaming\DE25E01C-A553-C0F0-1FF2-A9F4C346ED68 
       2018-05-05 23:49 - 2018-05-30 03:03 - 000000000 ____D C:\ProgramData\3ff2e85ac3114ca79d1d7ea0f21f28f8 
       2018-05-05 23:49 - 2018-05-05 23:49 - 000004408 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_TQ 
       2018-05-05 23:49 - 2018-03-24 14:51 - 002990080 _____ C:\Windows\system32\mcicda64.dll 
       2018-05-05 23:48 - 2018-05-30 03:46 - 000000000 ____D C:\ProgramData\dahkService 
       2018-05-05 23:48 - 2018-05-30 03:11 - 000000000 ____D C:\Windows\SysWOW64\xwtcglsu 
       2018-05-05 23:48 - 2018-05-30 03:03 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\2d8162f91d7e42af907268c81bef4699 
       2018-05-05 23:48 - 2018-05-05 23:48 - 000000000 ____D C:\Users\Public\Documents\XMUpdate 
       2018-05-05 23:47 - 2018-05-30 03:03 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\SPI 
       2018-05-05 23:47 - 2018-05-30 03:03 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\Browsers 
       R2 windows_udp_controller; C:\ProgramData\6c171908b0\a239cef578.exe [2173440 2018-03-31] () [Unsigned file] 
      HKLM-x32\...\Run: [DFX] => C:\Program Files (x86)\DFX\DFX.exe [1325240 2015-10-21] () 
      HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION 
       HKU\S-1-5-21-1045021067-2284003948-594102669-1001\...\Run: [GenericTools] => C:\Users\HABAKUK\AppData\Local\GenericTools\GenericTools.exe [191488 2018-03-29] () 
      HKU\S-1-5-21-1045021067-2284003948-594102669-1001\...\Run: [s'FKB#5dlX.exe] => C:\Program Files\Reference Assemblies\T2ZJM7EDQXKIFE29\s'FKB#5dlX.exe [841728 2018-05-05] () 
       HKU\S-1-5-21-1045021067-2284003948-594102669-1001\...\Winlogon: [Shell] C:\Windows\explorer.exe [2755504 2016-08-27] (Microsoft Corporation) <==== ATTENTION 
      HKU\S-1-5-18\...\Run: [] => [X] 
       2018-05-30 01:25 - 2018-05-30 01:26 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\wxpwk4cxaon 
       2018-05-30 01:23 - 2018-05-30 01:38 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\uuyxj1cepb4 
       2018-05-30 01:23 - 2018-05-30 01:28 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\g2xxzgtfybi 
       AppInit_DLLs: C:\ProgramData\Quoteex\Gravekix.dll => C:\ProgramData\Quoteex\Gravekix.dll [342528 2018-03-31] () 
      Task: {3CF41FFA-E560-4E95-A8DB-C94FBFDA660A} - System32\Tasks\{38769FEE-8F65-4E8C-92D5-C55F78C8A01B} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\SystemHealer\unins000.exe" -c /VERYSILENT
      Task: {403D50AD-AE13-4BAE-AE53-5E561FBF9BB3} - \Online Application V2G1 -> No file <==== ATTENTION
      Task: {424C65E4-C5A6-4F02-A0F7-471AD80F1516} - System32\Tasks\GlaryOneClickOptimizer 4 => C:\Program Files (x86)\Glary Utilities 4\OneClickMaintenance.exe [2013-12-24] (Glarysoft Ltd)
      Task: {446A817B-BFCE-4617-92FF-F1CEC51FF22B} - System32\Tasks\GoogleUpdateSecurityTaskMachine_EL => C:\Users\HABAKUK\AppData\Roaming\2d8162f91d7e42af907268c81bef4699\HandlerExecution.exe [2018-05-05] () <==== ATTENTION
       C:\Users\HABAKUK\AppData\Roaming\2d8162f91d7e42af907268c81bef4699
      Task: {869B777E-1FA9-4E47-802D-F3CF8EF24324} - \Online Application V2G2 -> No file <==== ATTENTION
      Task: {9E2431DB-20C1-4D7E-A27D-23CA538C2A13} - System32\Tasks\GoogleUpdateSecurityTaskMachine_BD => C:\Users\HABAKUK\AppData\Roaming\19d78705971b477bac5aa86dd8cd0fb1\HandlerExecution.exe [2018-05-05] () <==== ATTENTION
      Task: {9F3090BA-DFD3-4942-9EB8-E57E0772632F} - \Online Application V2G6 -> No file <==== ATTENTION
       C:\Users\HABAKUK\AppData\Roaming\19d78705971b477bac5aa86dd8cd0fb1
      C:\Program Files (x86)\SystemHealer
      Task: {A312DCDC-E5AA-4416-B622-30D48E845C07} - System32\Tasks\System Healer Monitor => C:\Program Files (x86)\SystemHealer\HealerConsole.exe [2018-04-11] () <==== ATTENTION
      Task: {B29FE984-8B20-40CA-B6BD-D28AF93D98FE} - \FastDataX Task -> No file <==== ATTENTION
      Task: {BBA863F4-5819-4D63-AE17-72F39622B88E} - \Online Application V2G5 -> No file <==== ATTENTION
      Task: {C51425C8-E957-4C83-A048-AF9F080A8156} - System32\Tasks\System Healer Delayed => C:\Program Files (x86)\SystemHealer\SystemHealer.exe [2018-04-11] () <==== ATTENTION
      Task: {CCC4B279-0926-418E-AA08-AC4E7CF98171} - \WinHostStartForMachine -> No file <==== ATTENTION
      Task: {D732A4D2-D93B-492E-B7A0-D0F7F6A460B6} - \Online Application V2G3 -> No file <==== ATTENTION
      Task: {D9BA19BA-60C9-4E1D-82AC-BC9229AAA06C} - System32\Tasks\GoogleUpdateSecurityTaskMachine_TQ => C:\ProgramData\3ff2e85ac3114ca79d1d7ea0f21f28f8\HandlerExecution.exe [2018-05-05] () <==== ATTENTION
      Task: {E14F234D-BBD5-44E3-9AC6-F0F739B9A037} - System32\Tasks\GoogleUpdateSecurityTaskMachine_AM => C:\Users\HABAKUK\AppData\Local\Temp\1373c96bc85045c9b3a525a4ae37bd4b\HandlerExecution.exe <==== ATTENTION
      Task: {E3F5912D-25C2-40A7-9D2C-CDE1A8EFD24D} - \Sierra LIDIX 2004 Pro -> No file <==== ATTENTION
      Task: {E522E4EC-14D4-4B44-9BB5-1AEB827B3B39} - System32\Tasks\Updater_Online_Application => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe [2017-11-02] (Microleaves) <==== ATTENTION
       2018-05-05 23:13 - 2018-05-05 23:13 - 000000000 ____D C:\ProgramData\Wondershare 
       2018-05-05 22:54 - 2018-05-05 22:54 - 000000000 ____D C:\Users\HABAKUK\AppData\Local\Wondershare 
       2018-05-05 22:54 - 2017-10-19 10:17 - 000271360 _____ (Wondershare Software) C:\Windows\system32\WSPDFelementMonitor.dll 
       2018-05-05 22:53 - 2018-05-30 04:09 - 000000000 ____D C:\Users\HABAKUK\AppData\Roaming\Wondershare 
       2018-05-05 22:53 - 2018-05-30 04:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare 
       2018-05-05 22:52 - 2018-05-30 04:09 - 000000000 ____D C:\Program Files (x86)\Wondershare 
       2018-05-05 22:41 - 2018-05-30 04:03 - 000000000 ____D C:\Users\Public\Documents\Wondershare 
      Task: {E80D1BEF-2BC8-4476-AA45-E4A78E7A4699} - System32\Tasks\1a22255d192cbbeb14ad7b47e4e052e0 => sc start 1a22255d192cbbeb14ad7b47e4e052e0 <==== ATTENTION
      Task: {F04870DC-2CCF-44A5-AE35-2EB921795B5C} - \Online Application V2G4 -> No file <==== ATTENTION
      Task: {F5B48C47-24EF-4618-86F1-CA31E2205EE3} - System32\Tasks\GoogleUpdateSecurityTaskMachine_UO => C:\Users\HABAKUK\AppData\Local\Temp\6df99f8229ec4fd9803b1cf6aeecf141\HandlerExecution.exe <==== ATTENTION
      EmptyTemp:
      RemoveProxy:
      Reboot:


      Save the content through the file menu then save.

      Close the notepad, go back to FRST and click the "Fix" button
      A restart may be necessary and automatic.
      A text file will appear, copy/paste the content here in a new message.

      Restart the computer.



      2°)
      Reset/Repair the affected web browsers:

      3°)
      Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware free version tutorial

      4°)
      See what happens and if there have been any improvements.
      If not, and if you still have pop-up ads, specify which web browser.
      Rescan with FRST and provide the new reports via attachment.
      0