1

Recently my PC started to freeze. The RAM was being clobbered.
I do what I always to CNTRL + ALT + DEL to open taskmgr.
Well non of the processes were there.
So I decided to check Resource Monitor and there it was.

WsAppService.exe, using 9.2GB of my 10GB RAM.

Loc: C:\Program Files (x86)\Wondershare\WAF\2.3.2.219\WsAppService.exe

So, what is WsAppService doing and why is it consuming all of my RAM? Even when I unplug my internet connection it's running out of control.

I'm not sure how this got installed. But there is a log in this folder that shows a date of installation. The fact that there is a log makes me believe that this is not a malicious program. But why is there no thread in the taskmgr if that's true? Memory leak? Bad program stuck in an infinite loop? As a programmer I have created memory leaks and infinite loops in my own work, so I'm familiar with this topic.

And to be extra clear: This isn't a question of how to uninstall it, or how to get rid of it.

I opened "Programs and Features" to find this program to uninstall it. It's not there.

Although, there is another executable file in the root folder: C:\Program Files (x86)\Wondershare\WAF -- uninstall executable. But what makes it curious is that it isn't in the "Programs and Features".

Microsoft Essentials and MalwareBytes hasn't any problems with this program. Which it wouldn't if it's a memory leak of some sort.

Any help would be greatly appreciated, especially if you've heard about this program.




--------- checked links in this forum --------------------------------------------



I did check out this thread: Track File Usage in Windows 7 -- However this link leads to a download, which I downloaded. I tried filtering it to just this file-path; nothing.

I also looked at: which app triggers the "Windows features" dialog? -- My problem is NOT a triggering of "Windows feature" dialogue..

I also looked at: How do I completely remove Wondershare Allmytube from Windows [using Farbar Recovery Scan Tool]? -- It's not AllMyTube, but makes me think of NHC which is a company that installs many different programs in the same NHC directory on my computer which I use.

Community
  • 1
ejbytes
  • 2,014
  • 3
  • 13
  • 25
  • use sysmon, to see which process started Wondershare: http://superuser.com/a/1145877/174557 look for parentid of wondershare and now look which other process has this processid – magicandre1981 Mar 02 '17 at 05:43
  • @magicandre1981 I'm not familiar with this program. Any extensible program like this, needs experienced user and finesse. This seems like a robust tool for an IT Administrator which I'm not. I've downloaded it and read the notes on the link. I know how to pass arguments to an executable via command line arguments, but still like I mentioned it looks very extensive. Perhaps someone with experience with this same problem might chime in. I've read many threads on this very subject to this very particular executable program. – ejbytes Mar 02 '17 at 07:59
  • the usage is simple. check the properties of WsAppService.exe in processexplorer and look for parent process. if the parent is shown you know which started it. if not use sysmon and reboot. it logs all process creation/stop in eventlog. I marked it now as duplicate. both question are the same, which process x triggered start of process y. – magicandre1981 Mar 02 '17 at 14:35
  • @magicandre1981 I don't think the usage is as simple as you think. Have you used this before? One must create a "Configuration File". How would you suggest creating a Configuration file for this question? – ejbytes Mar 02 '17 at 21:06
  • @magicandre1981 I have rewritten my question. You are a little hasty to your assumptions. Are you here to help? – ejbytes Mar 02 '17 at 21:13
  • he asks which process x triggered starting of y (windows dialog), you ask which process x srats y (wondershare). it is a **dup**, no matter how you complain. I'll close it again if 4 other idiots reopen it. – magicandre1981 Mar 03 '17 at 15:53
  • @magicandre1981 The answer is hardly an answer in the link you provide as a duplicate. I wouldn't have marked that as a solution; a link to a download with no other explanation. Doesn't matter on my end, I've fixed the problem, without downloading anything. – ejbytes Mar 03 '17 at 19:26
  • @JourneymanGeek I have tried rewording the question / content -- after engagement with magicandre1981. Any suggestions? So far I've killed the PID found in the Resource Monitor, because it's not showing in Processes in the Taskmgr. It's not a fix, per say. It's more of a means to an end for now. – ejbytes Mar 04 '17 at 00:12
  • does it turn up in startup items/autoruns? Is there an associated service? – Journeyman Geek Mar 04 '17 at 00:16
  • @JourneymanGeek I've checked the Registry and the Autorun folders (user and local machine), but nothing there. As far as associated service, I don't know. I guess that's the question, what's it being associated with? – ejbytes Mar 04 '17 at 00:17
  • http://superuser.com/questions/800294/how-do-i-completely-remove-wondershare-allmytube-from-windows-using-farbar-reco potential dupe I suspect. – Journeyman Geek Mar 04 '17 at 00:24
  • @JourneymanGeek I guess there is a General problem with Wondershare at it appears across Google searches. Perhaps it's just an undesirable program that piggy-backs on other intentional installs? In this link you provided, he discusses How To Uninstall. Not quite my concern, because I can get rid of it and I think I have enough experience to hunt out any remnants. Maybe in the end I'll just do that. – ejbytes Mar 04 '17 at 00:29

0 Answers0