View original (French)

Remove Wondershare Service

Solved
thomas57 -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,

For some time now, my PC has been slow and overheating a lot.
I saw on this forum that the issue is Wondershare Service. Indeed, by disabling it, the fans slow down until they turn off and the problem is resolved; it's much faster.
However, Wondershare Service relaunches with every PC startup.

I have therefore downloaded FRST as indicated on your forum, and here are the links:

http://pjjoint.malekal.com/files.php?id=FRST_20170505_j13w10i9g13n9

http://pjjoint.malekal.com/files.php?id=20170505_k8q10f9z13i9

http://pjjoint.malekal.com/files.php?id=20170505_e14o14y9m11m15

Can you please help me remove Wondershare Service?

Thank you in advance.

Thomas

Configuration: Windows / Edge 14.14393

2 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    Several instances where Wondershare service consumes > 2GB of RAM and causes significant lag issues.
    Indeed, it needs to be removed.

    Here’s the fix to perform with FRST. You can refer to this explanatory note with screenshots.

    Open Notepad: Press Windows key + R,
    In the "Run" field, type notepad and OK.
    Copy/Paste the following into it: 

    CreateRestorePoint:
    CloseProcesses:
     (Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.3.2.219\WsAppService.exe 
     R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.3.2.219\WsAppService.exe [440832 2016-12-07] (Wondershare) [Unsigned file] 
     C:\Program Files (x86)\Wondershare
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-3855853254-3462473905-601002880-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9532120 2017-04-11] (Piriform Ltd)
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Once the text is pasted into Notepad,
    Menu "File" then "Save As",
    On the left, navigate to Desktop,
    In the field at the bottom, file name input: fixlist.txt
    Click "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click the "Fix" button
    A restart may be needed (not mandatory)
    A text file appears, copy/paste the content here in a new message.

    Restart the computer.

    Please press any key to continue the disinfection...
    0
    1. thomas57
       
      The issue seems to be resolved.
      The PC is no longer overheating and Wondershare no longer appears in the list of processes.

      Thank you for the solution and your very quick response.

      Here is the fixlog file created:


      Farbar Recovery Scan Tool (x64) Correction Results Version: 03-05-2017 01
      Executed by THOMAS (05-05-2017 11:29:14) Run:1
      Executed from C:\Users\THOMAS\Desktop
      Loaded profiles: THOMAS (Available profiles: THOMAS)
      Boot Mode: Normal
      ==============================================

      fixlist contents:

      2. CreateRestorePoint:
      CloseProcesses:
      (Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.3.2.219\WsAppService.exe
      R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.3.2.219\WsAppService.exe [440832 2016-12-07] (Wondershare) [Untrusted file]
      C:\Program Files (x86)\Wondershare
      Hosts:
      EmptyTemp:
      RemoveProxy:
      Reboot:


      The restore point was created successfully.
      Processes closed successfully.
      C:\Program Files (x86)\Wondershare\WAF\2.3.2.219\WsAppService.exe => No active processes found
      HKLM\System\CurrentControlSet\Services\WsAppService => key(s) deleted successfully
      WsAppService => service(s) deleted successfully
      C:\Program Files (x86)\Wondershare => moved successfully
      C:\Windows\System32\Drivers\etc\hosts => moved successfully
      Hosts restored successfully.

      ========= RemoveProxy: =========

      HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value(s) deleted successfully
      HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value(s) deleted successfully
      HKU\S-1-5-21-3855853254-3462473905-601002880-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value(s) deleted successfully
      HKU\S-1-5-21-3855853254-3462473905-601002880-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value(s) deleted successfully


      ========= End of RemoveProxy: =========


      =========== EmptyTemp: ==========

      BITS transfer queue => 0 B
      DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 14053466 B
      Java, Flash, Steam htmlcache => 506 B
      Windows/system/drivers => 423713373 B
      Edge => 124558037 B
      Chrome => 208896 B
      Firefox => 0 B
      Opera => 0 B

      Temp, IE cache, history, cookies, recent:
      Default => 0 B
      Users => 0 B
      ProgramData => 0 B
      Public => 0 B
      systemprofile => 0 B
      systemprofile32 => 0 B
      LocalService => 0 B
      NetworkService => -654 B
      THOMAS => 26406835 B

      RecycleBin => 0 B
      EmptyTemp: => 561.7 MB of temporary data deleted.

      ================================


      The system had to reboot.

      End of Fixlog 11:29:30

      Thomas
0
  • Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    You're welcome =)

    Delete the folder C:\FRST

    --
    Please press any key to continue the disinfection...
    0