WPS forced installation and malicious promotion solutions

Prevent extended programs from running

Because WPS office in the Web site promotion, will be through some programs to lock it, so clear the time is more troublesome. I was promoted in the use of Taobao link, the following as an example to operate (Figure 1). To avoid "relapse" after deletion, first of all, to prevent the extension of the operation of the program, and this use of the system's local security policy features can be done. First press the key combination Win+r open the system's "Run" box, enter "Secpol.msc" and press ENTER to open the system's Local Security policy Management window.

In the list on the left side of the window, expand security settings → software restriction policies in turn, click the right mouse button on the software Restriction policy item, select the "Create Software Restriction Policy" command in the pop-up menu, and then the "Security level" and "other rules" two subprojects appear on the right side of the window. Right-click More rules, select the Create Hash Rule command in the pop-up menu, and a "Create hash rule" window pops up.

Click "Browse" in the window, select the name of the promotion program in the pop-up window, the default path is "C:users username Appdataroamingkingsoftwtoolxlink_taobaodesktoplink.exe". Then, in the security Level drop-down menu, select "Do not allow", and the "description" option allows you to set a descriptive information that you understand. Once all the information content is set up, click OK in the window to complete the rule creation (Figure 2). Later, when the system discovers that the promotion program is running, it will be blocked immediately.

　Small tip:

In the WPS Office Program menu, find the "Configure Tool" and click on it and click the "Advanced" button in the pop-up dialog box. Select the "Upgrade Settings" tab in the pop-up dialog box to remove the check in front of the "recommended select software after Upgrade" option to prevent Third-party software from spreading (Figure 3).

　　Remove all promotional information

The next step is to start the Promotion program deletion, but try to quit the running program before you do the operation. First run the Third-party security tool Pchunter, and click on the "File Maker" tab in the "Process" list to find related processes that contain kingsoft information. Select these processes with the mouse and with the CTRL key on the keyboard. Then click the right mouse button to select the end process command to end them (Figure 4).

Next, click on the "Service" tab in "Startup Info", and then click on the "File Maker" tab in the list of services, as well as search for related startup services that contain kingsoft information. At this point you can see a service without any description, select it later click the right mouse button to select the menu "Delete Service" command, so that the promotion program can be removed from the start service.

Finally restart the operating system to start the cleanup work. Open Explorer to find the "C:users username Appdataroamingkingsoftwtoolxlink_taobao" directory, delete it. Next, the system desktop on the promotion of the icon also deleted, and then open the system of IE browser, click on the "Tools" menu "Internet Options" command, in the pop-up dialog box "Home" set into their own needs of the link.