5

Windows 7 Enterprise x64

So I made a mistake and ran a dubious executable program downloaded from the internet. I was making a dvd and I didn't know how to download videos from funnyordie.com, so I went out on a limb and tried Wondershare Allmytube. It did what I wanted but it seemed really sketchy and it made my laptop start working so hard that my fan kicked on without any user input, so I turned off the wifi and uninstalled it right away and now I'm paranoid that I'm a part of some botnet or someone's got my saved chrome passwords.

Even after I uninstalled it, there were still files in C:/Program Files (x86)/Common Files/Wondershare, C:/Program Files/Common Files/Wondershare, C:/ProgramData/Wondershare, and there was a .exe on my desktop. I found someone with the same problem on this forum: http://www.smartestcomputing.us.com/topic/71056-wondershare-helper-compact/

The only problem is their solution was specific to that user's machine, and I can't download the fixlist.txt supplied by the admin in this thread to see what he did. However, I did run the Farbar Recovery Scan Tool as this person did, and I found some references to Wondershare in the FRST.txt file.

Under the heading Registry (Whitelisted), I found these lines:

HKLM-x32...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

HKLM-x32...\Run: [DelaypluginInstall] => C:\ProgramData\Wondershare\AllMyTube\DelayPluginI.exe

Under the heading Internet (Whitelisted), I found this line:

BHO-x32: Wondershare AllMyTube 4.2.0 -> {067DF9EC-26B7-40DC-8DB8-CD8BE85AE367} -> C:\ProgramData\Wondershare\AllMyTube\WSBrowserAppMgr.dll No File

Under the heading Firefox, I found this line:

FF HKLM-x32...\Firefox\Extensions: [[email protected]] - C:\ProgramData\Wondershare\AllMyTube\[email protected]

How do I take all references to Wondershare off of whitelists? It seems like that's a security threat and I'm trying to patch it. (I have also run malwarebytes, and it detected and removed several threats.) Am I looking at this problem the right way?

1

5 Answers 5

6

Wondershare and now iSkysoft (I tried iSkysoft Video Editor) seem to exhibit some behaviors similar to malware in that a hidden piece of software is installed and set to run constantly in the background even after un-install. This is very "rude". In my efforts to clean up what it has done I have resorted to the following.

  1. Create a .REG file containing the following text. These represent registry keys and values to be deleted because I determined that they were associated strictly with Wondeshare. To identify them I searched the registry for "wondershare" and noted the parent keys containing the results at the level specific to wondershare files. Then I searched for indirect references to them by searching the registry again for the TypeLib GUIDs that the previous search turned up (for example, I searched for {249694CE-7F79-4224-A555-11B445F947AB} and noted the parent keys from those results as well). The final result is somewhat redundant because some of these keys are actually the same key under different names, but deleting the same key multiple times will neither hurt nor report an error.

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\TypeLib\{249694CE-7F79-4224-A555-11B445F947AB}]

[-HKEY_CLASSES_ROOT\Interface\{69468394-C7A1-4AF7-8788-5DCB7BE8BACC}]

[-HKEY_CLASSES_ROOT\WOW6432Node\Interface\{69468394-C7A1-4AF7-8788-5DCB7BE8BACC}]

[-HKEY_CLASSES_ROOT\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69468394-C7A1-4AF7-8788-5DCB7BE8BACC}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{69468394-C7A1-4AF7-8788-5DCB7BE8BACC}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\Interface\{69468394-C7A1-4AF7-8788-5DCB7BE8BACC}]

[-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{967B86E6-92E8-4A35-86C0-FEB187726802}]

[-HKEY_CLASSES_ROOT\WOW6432Node\TypeLib\{249694CE-7F79-4224-A555-11B445F947AB}]

[-HKEY_CLASSES_ROOT\WOW6432Node\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}]

[-HKEY_CLASSES_ROOT\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC}]

[-HKEY_CLASSES_ROOT\Interface\{0FA988D3-BA51-48AD-A518-6462CD5FF547}]

[-HKEY_CLASSES_ROOT\Interface\{225BE4D8-64CA-49B1-9630-917F2D92F452}]

[-HKEY_CLASSES_ROOT\Interface\{36B0BA4B-20B5-4369-BBCA-9FAADC8EAC19}]

[-HKEY_CLASSES_ROOT\Interface\{46884330-13BA-4AC9-BEDC-3A2E955EB8DA}]

[-HKEY_CLASSES_ROOT\Interface\{4D3609D2-1D8A-4E9F-884B-438AFDDECB86}]

[-HKEY_CLASSES_ROOT\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374}]

[-HKEY_CLASSES_ROOT\Interface\{5610D1A9-5B54-4E77-9190-94FF9E59AFBA}]

[-HKEY_CLASSES_ROOT\Interface\{70AC1FC1-A22B-4327-9A54-754B9301A056}]

[-HKEY_CLASSES_ROOT\Interface\{B76550E2-048B-4D8C-B432-4668A54EDEA3}]

[-HKEY_CLASSES_ROOT\Interface\{C5CAFA8E-F69D-4E6F-9BF3-1F4522AFD4BE}]

[-HKEY_CLASSES_ROOT\Interface\{E1839CDE-A191-4DA4-9FCE-178A88318DF4}]

[-HKEY_CLASSES_ROOT\Interface\{E5E91D68-955D-4DE1-AB8E-89B26DF6A331}]

[-HKEY_CLASSES_ROOT\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}]

[-HKEY_CLASSES_ROOT\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}]

[-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}]

[-HKEY_CLASSES_ROOT\WOW6432Node\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC}]

[-HKEY_CURRENT_USER\SOFTWARE\BugSplat]

[-HKEY_CURRENT_USER\SOFTWARE\Wondershare]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{249694CE-7F79-4224-A555-11B445F947AB}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{967B86E6-92E8-4A35-86C0-FEB187726802}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\TypeLib\{249694CE-7F79-4224-A555-11B445F947AB}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32]
"Wondershare Helper Compact.exe"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{967B86E6-92E8-4A35-86C0-FEB187726802}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\TypeLib\{249694CE-7F79-4224-A555-11B445F947AB}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run]
"Wondershare Helper Compact.exe"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Wondershare]

  1. Save and run the REG file. Ignore the fact that the message says it "added" information to the registry. It actually just deleted all those keys and values, and added nothing.

  2. Then check task manager for a process called Wondershare Studio. I think this was running before I ran the REG file, but seemed to go away afterwards. If it's still there, I'd have ended it forcefully.

  3. Finally it should be safe to delete the following directory, noting that this is the name of the directory on a 64-bit OS, and if you have a 32-bit OS, the (x86) piece will not be part of the path:

    C:\Program Files (x86)\Common Files\Wondershare

That's as much as I could find to clean up.

Note: I do not recommend using the above REG file on a 32-bit OS because 32-bit windows structures the registry differently without all the WOW6432Node bits.

1
  • 1
    This worked a treat! Thank you for the detailed description and .reg file. Jun 26, 2016 at 20:58
2

I found a useful tip on another website about this Wondershare issue.

  1. Go into registry editor.
  2. Collapse all the files.
  3. Go under "edit" and hit "find" - type in Wondershare and it will call up instances of the file (one by one).
  4. You have to delete them manually.
  5. Hit F3 to find the next instance of the file until you go through the entire registry.

I bet I had 30 different registry keys with the Wondershare on it. Computer working great now.

-1

I found Control.Alt.Delete then Processes. Delete any under wondershare then go back to the regular uninstaller and remove. Worked for me

-1

Even after you do the usual install/uninstall programmes route of uninstalling Wondershare, when you do a search for it there are still many files left on your system. If you try to delete them it will refuse because "it is open". Usually it's the Wondershare helper which stays open, which prevents you from deleting the files. Go control.alt.delete, open processes, find the helper and end task, then do a search for Wondershare and delete all remaining files.

-1

I had the same problem. I uninstalled Wondershare from control panel but when I reboot a dialogue box appears every time saying that "wondershare helper compact" wants to modify the system. I went into standard malware clean-up mode: Open regedit and search for wshelper.exe. You will find lots of matches but you can ignore most of them. Keep pressing F3 to find the next match until you eventually find a match sitting inside a RUN key. The 'RUN' keys are important because this is how software hooks into the computer startup sequence. Once you have found the wshelper.exe value under a RUN key then delete it. * Be careful not to delete anything else apart from the wshelper.exe value. If you accidentally delete anything else you can cause damage to your computer. Only follow this procedure if you are experienced. Also backup your registry by creating a restore point in control panel * You may find you have more than one "RUN" key (in my case my computer has a WOW6432 redirection subnode so I have two RUN keys) so keep looking for any RUN keys where wshelper.exe may be hiding. I then did a reboot and I no longer get the annoying Wondershare helper dialog boxes. I have not bothered to clean up all the other registry entries and hard drive folders because I am happy that it is all unhooked and not active. I hope this helps people in the same situation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .