It installed the sound service without permission and impossible to uninstall

Question

It installed the sound service without permission and impossible to uninstall

Anixx opened this issue 6 months ago · comments

WinPaletter installed the system sounds service without permission. During installation I closed the dialog that was prompting to instal it.

After that I tries to remove it by uninstalling WinPaletter via control panel, but the startup sound still is played on login.

Abdelrhman-AK · Answer 1 · Sat Dec 16 2023 14:14:22 GMT+0800 (China Standard Time)

Services installation should not start by itself. It starts when the user clicks on Install. Did you choose to hide installation prompt and it installed itself in a second session or not?
To remove it: stop this service in services and delete its file located in C:\Program Files\WinPaletter\Data\Services
Startup sound is not managed by this service. Anyway, you can disable or enable this sound in sounds control panel applet

Anixx · Answer 2 · Sat Dec 16 2023 22:49:32 GMT+0800 (China Standard Time)

What's the name of the service in Services.msc?

Services installation should not start by itself. It starts when the user clicks on Install.

I think, I clicked on cancel or closed the dialog. I definitely did not click on install.

Anixx · Answer 3 · Sat Dec 16 2023 22:53:36 GMT+0800 (China Standard Time)

There is no folder C:\Program Files\WinPaletter\Data\Services

Still after WinPaletter installation I get very distinct and very loud startup sound. In the Sound control applet SystemStart has no sound assigned:

Anixx · Answer 4 · Sat Dec 16 2023 22:59:49 GMT+0800 (China Standard Time)

Wait, maybe the sound is because the checkbox "play system start music" is on. But the sound is not similar to the default startup sound. I think, I always had startup sound but what made me worried is that now the sound is very different from default.

Abdelrhman-AK · Answer 5 · Sun Dec 17 2023 00:39:20 GMT+0800 (China Standard Time)

Service name is WinPaletter.SystemEventsSounds
The sounds being played on startup is actually unlock sound.
I tried to reproduce this issue. But it didn't install itself after clicking cancel or hiding it.
I'll investigate about installation of service inspite of cancelling it or hiding it.

Abdelrhman-AK · Answer 6 · Sun Dec 17 2023 00:42:40 GMT+0800 (China Standard Time)

In the Sound control applet SystemStart has no sound assigned

WinPaletter saves startup sound to HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemStart\.Current and it is playable in Windows XP. It has no use in newer versions of Windows.

Anixx · Answer 7 · Sun Dec 17 2023 10:47:00 GMT+0800 (China Standard Time)

In the Sound control applet SystemStart has no sound assigned

WinPaletter saves startup sound to HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemStart\.Current and it is playable in Windows XP. It has no use in newer versions of Windows.

This registry place is empty on my system, but the sound is played.

Anixx · Answer 8 · Sun Dec 17 2023 10:49:47 GMT+0800 (China Standard Time)

Service name is WinPaletter.SystemEventsSounds

The sounds being played on startup is actually unlock sound.

I tried to reproduce this issue. But it didn't install itself after clicking cancel or hiding it.

I'll investigate about installation of service inspite of cancelling it or hiding it.

Another thing that happened is that when I was exitting WinPaletter, I wanted to exit without applying the theme, but I did not know what to chose in the exit dialog. WinPaletter applied the them contrary to my wish, so I had to restore the previous settings manually. Maybe, at this point it changed the startup sound...

Anixx · Answer 9 · Sun Dec 17 2023 10:51:35 GMT+0800 (China Standard Time)

The current startup sound is VERY loud, far different in this from the standard system sounds.

Abdelrhman-AK · Answer 10 · Sun Dec 17 2023 19:59:40 GMT+0800 (China Standard Time)

This registry place is empty on my system, but the sound is played.

That is because of patched imageres.dll

The current startup sound is VERY loud, far different in this from the standard system sounds.

You can try restoring default startup sounds by two methods:

Open Sounds in WinPaletter, enable the toggle, go to startup sound, press on default and then quick apply this aspect.

or 2. Open command prompt elevated and run SFC /scanfile=%windir%\System32\imageres.dll then restart your Windows

Another thing that happened is that when I was exitting WinPaletter, I wanted to exit without applying the theme, but I did not know what to chose in the exit dialog.

To do nothing on exiting WinPaletter, check these options.

Anixx · Answer 11 · Mon Dec 18 2023 00:57:10 GMT+0800 (China Standard Time)

That is because of patched imageres.dll

I did not patch imageres.dll ever. Was it patched by WinPaletter? How can I restore the original one?

Anixx · Answer 12 · Mon Dec 18 2023 00:58:56 GMT+0800 (China Standard Time)

Open command prompt elevated and run SFC /scanfile=%windir%\System32\imageres.dll then restart your Windows

I did this, it says the system protection could not find any integrity violations. But it still plays startup sound.

Anixx · Answer 13 · Mon Dec 18 2023 01:01:00 GMT+0800 (China Standard Time)

What's the difference between cancel, close, and "do actions"?

Anixx · Answer 14 · Mon Dec 18 2023 01:07:04 GMT+0800 (China Standard Time)

If it is playing the logon sound, chow can I restore the default one?

Anixx · Answer 15 · Mon Dec 18 2023 03:37:28 GMT+0800 (China Standard Time)

I tried to reproduce this issue. But it didn't install itself after clicking cancel or hiding it.

I have just reroduced it again. After clicking "Cancel" at the time of first start, in the Control Panel appeared a new WinPaletter icon.
If to chose to uninstall it, appears a dialog about installation, not de-installation:

Should I click "Start" to uninstall it?

Abdelrhman-AK · Answer 16 · Mon Dec 18 2023 05:42:42 GMT+0800 (China Standard Time)

How can I restore the original one?

The mentioned steps should restore any patched imageres.dll

I did this, it says the system protection could not find any integrity violations.

This means that imageres.dll is not patched. Maybe the loud sound is from the service.

What's the difference between cancel, close, and "do actions"?

Cancel will cancel exit process (Closes the dialog and WinPaletter won't exit)
Close will close this dialog and nothing will be done
Do actions will do the selected actions above and then closes WinPaletter

If it is playing the logon sound, chow can I restore the default one?

Changing sounds inside WinPaletter > sounds, or uninstalling the service.

I have just reroduced it again. After clicking "Cancel" at the time of first start, in the Control Panel appeared a new WinPaletter icon.

How did WinPaletter appear in Control Panel? Please show me this if it is possible.

Should I click "Start" to uninstall it?

No, it will install it again. Go to WinPaletter Settings > Users and services > Uninstall

And to avoid opening this dialog, uncheck this option and click on cancel:

And then go to WinPaletter Settings > Users and services > Uninstall to uninstall it completely

Anixx · Answer 17 · Mon Dec 18 2023 07:54:09 GMT+0800 (China Standard Time)

Cancel will cancel exit process (Closes the dialog and WinPaletter won't exit)

Close will close this dialog and nothing will be done

Cancel and close do the same?

Anixx · Answer 18 · Mon Dec 18 2023 07:56:04 GMT+0800 (China Standard Time)

How did WinPaletter appear in Control Panel? Please show me this if it is possible.

Run WinPaletter.
In the service installation dialog click Cancel
Exit WinPaletter. The icon appears in the Add/Remove software list in Control Panel.

Anixx · Answer 19 · Mon Dec 18 2023 08:00:33 GMT+0800 (China Standard Time)

No, it will install it again. Go to WinPaletter Settings > Users and services > Uninstall

I do not see this option. WinPaletter re-appears in Control Panel when I start it. If I click in Control Panel on "uninstall", the Service Installer dialog as above appears. If I click "Start" it says it is uninstalled, and disappears from Control Panel. But the startup sound remains. If I start WinPaletter it re-appears again without any action from my part.

Abdelrhman-AK · Answer 20 · Mon Dec 18 2023 19:09:52 GMT+0800 (China Standard Time)

Cancel and close do the same?

No. Cancel will abort exit process, and WinPaletter will stay opened.
Close won't do any checked option and WinPaletter will exit.

WinPaletter re-appears in Control Panel when I start it.

This is a normal behaviour of WinPaletter and it is not related to service installer. It is used to delete registry data of WinPaletter and files of WinPaletter in AppData and Program Files. Everytime you open WinPaletter it will create an uninstaller entry in control panel

If I start WinPaletter it re-appears again without any action from my part.

That is because the uninstaller deleted WinPaletter settings in registry, and so Hide dialog option won't be remembered.
I made service installer to be checked at WinPaletter startup, if it is not installed or not updated then the dialog will appear.

Abdelrhman-AK · Answer 21 · Mon Dec 18 2023 19:11:38 GMT+0800 (China Standard Time)

But the startup sound remains.

I want to know if this is the same sound of Windows 11 startup sound or another sound that plays with your device startup, so that I can differentiate its source (imageres.dll or service) and then we can restore the original sound.

Please check your Task Scheduler and open the WinPaletter entry to identify any remnants from older WinPaletter versions.

Anixx · Answer 22 · Tue Dec 19 2023 00:56:52 GMT+0800 (China Standard Time)

Close won't do any checked option and WinPaletter will exit.

This is not intuitive, I thought it means "close the exit dialog".

Everytime you open WinPaletter it will create an uninstaller entry in control panel

A counter-intuitive behaviour here is that the uninstaller entry shows the "install service" dialog which makes impression yu cannot proceed with uninstallation without pressing "Start" button in the dialog.

Anixx · Answer 23 · Tue Dec 19 2023 01:01:21 GMT+0800 (China Standard Time)

I want to know if this is the same sound of Windows 11 startup sound or another sound that plays with your device startup, so that I can differentiate its source (imageres.dll or service) and then we can restore the original sound.

The sound is not standard Windows sound. Or at least it is very loud compared to other sounds. It is the same as "Logon" sound in WinPaletter sound settings.

Please check your Task Scheduler and open the WinPaletter entry to identify any remnants from older WinPaletter versions.

Indeed, there is a WinPaletter task in task scheduler. Even after uninstalling WinPaletter.

Abdelrhman-AK · Answer 24 · Tue Dec 19 2023 04:13:11 GMT+0800 (China Standard Time)

Indeed, there is a WinPaletter task in task scheduler. Even after uninstalling WinPaletter.

Delete these tasks and tell me if the sound will be played again or not. Newer versions of WinPaletter don't use tasks scheduler anymore.

It is the same as "Logon" sound in WinPaletter sound settings.

Erase textbox contents of logon sound and quick apply the theme (if the first trial didn't work).

Abdelrhman-AK · Answer 25 · Tue Dec 19 2023 04:14:11 GMT+0800 (China Standard Time)

A counter-intuitive behaviour here is that the uninstaller entry shows the "install service" dialog which makes impression yu cannot proceed with uninstallation without pressing "Start" button in the dialog.

I'll fix this conflict.