How to remove the traces of Wondershare Player

このサイトを検索 | Search this site

,Wondershare

Thank you for accessing.

This article has been removed.

The content of this blog can be searched by keyword.

Use the search window in the sidebar or at the top. Alternatively, please translate the original article using Google or other means.

Please find alternative content.

Remnants of articles that had been published

When I ran a security check on my PC, I was warned to remove the following items from startup.

Wondershare Application Framework Service

When I checked,

I found out that it is an information gathering module with a component of Wondershare Player made in China.

It was open to the public.

Wondershare Player was not listed in the list of "Programs and Features", so it seems that it has been uninstalled, but instead, Wondershare Application Framework Service was running.

And, It was set to be executed at the same time as turning on the power of the PC.

It's malicious.

Speaking of Chinese products, Lenovo has backdoors, Baidu IME, Simeji has keyloggers, etc., and we have a track record of trying to collect information without permission from users.

Each time, there are various responses such as distribution of correction modules and forgiveness of factlessness, but I do not admit that spyware was intentionally loaded.

It's sad to think that information has been missed so far.

Please be careful.

Remove Wondershare

I have succeeded in removing the trace of Wondershare Player, so I will share the specific procedure.

According to me,

It is known that Free Audio Converter behaves similarly.

For the Free Audio Converter, we have uploaded a verification article, so please read the related article. (End of sentence)

Steps to remove Wondershare Player traces

If you disable the Wondershare Application Framework Service from the Windows management tool "Service", it will not run at the same time as the PC starts.

If you want to completely remove the trace, you can use the SC command to remove it from the service.

SC command uses command prompt.

1. Stop the service and set the startup type to "Disable"

Wondershare Application Framework Service


Service name	WsAppService
Display name	Wondershare Application Framework Service

2. Stop the process

Start Task Manager and stop the process that seems to be Wondershare.

If you're not sure, restart your PC after performing step 1.

3. Delete Wondershare related folders

If you get a "in use" message when deleting a folder, Wondershare-related processes are running in the background.

To delete it, you need to terminate the process. Alternatively, process after restarting the PC.

C:\Program Files\Wondershare
C:\Program Files\Common Files\Wondershare
C:\Users\Username\AppData\Local\Wondershare
C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact
C:\Users\Public\Documents\Wondershare

4. Delete the service (just in case)

If you disable Wondershare Application Framework Service, it will not start automatically, but there will be traces left in the registry.

If you want to remove the trace completely, remove the Wondershare Application Framework Service from the service.

Use the command prompt.

WsAppService

4-1. Start the command prompt in administrator mode
4-2. Input the command

* Service name: WsAppService

>sc delete WsAppService


c:\_	Administrator: Command prompt	ー □ ×
C:\>sc delete WsAppService [SC] DeleteService SUCCESS

5. End of procedure

Traces of Wondershare Player have been removed.

Check Windows services regularly to see if any potentially unwanted programs are registered.

Wondershare Player is no longer available

Research date: 2017-05-27

When I looked at the Wondershare Player official website, it was discontinued.

Notice: Thank you for your interest in this product. Wondershare Play is no longer available.

Representative Director and President: Hiroshi Wang
Representative Director: Tae Wu (Wondershare China CEO)
https://www.wondershare.jp/company/overview.html

Summary

Programs registered as Windows services will not run if [Startup type: Disabled] is selected.

However, malicious software may change the startup type, so it is safe to delete it from the Windows service by using the SC command.

SC

To delete the program registered in the Windows service, use the command prompt (or Windows PowerShell) started in administrator mode, but the important thing is to specify the service name (ServiceName) specified in [SC delete ServiceName]. Is to identify.

The "service name" is used in the command prompt.

It is not a "display name".

Baidu IME

As another example, we will share the information of Chinese Baidu IME.

Baidu IME was found to be sending the user-entered history to a cloud server, and an excuse is announced in a press release.

As stated in "We strictly manage the data sent to the server," it does not say that we have not diverted the collected data for any purpose other than the original purpose.

Even if it's a lie, I wish I could write that it wasn't diverted.

Baidu.jp Press Release (December 26, 2013)

2. About cloud input
Baidu IME and Simeji provide cloud input, and provide a convenient conversion method that can convert the latest languages etc. through the server. The cloud input uses a secure communication method, and the data sent to the server is strictly managed.
We recognize that our service manages data at the same level as cloud service providers who handle highly confidential information.
Our view on some reports | Baidu Japan

External link

Verification: Windows7 32-bit

：SC2