What is CopySafe and how do I remove it?

[xx521xx]

So today, after someone else had been using my computer for a while, this program called ArtSoft CopySafe appeared on it. Now, nobody seems to know how this program got on the computer. It consists of a service (set to start automatically) and a Firefox plugin, but the uninstaller only removes the plugin while leaving the service to continue running automatically forever. Another strange thing is that the program's icon is loaded from a temporary folder.

On the other hand, the service executable comes back clean at VirusTotal and "known clean" from Avira. But why would a legitimate program magically install itself onto my computer without any means to fully remove it? Does anyone know what the deal is with this program, and is there a better way to remove the service than by setting it to disabled and deleting the executable? I tried to find removal instructions on Google, but the only thing I found was another tale of this program appearing on someone's computer with no obvious means of removal, and no answer as to how to remove it...

[noknojon]

Hi xx521xx -

I would ask your pal, in a very heavy way, as to exactly what did they do or install on your system - Some people see something that looks good and just click on it without thinking - It may be harmless but see if it is in Add Remove so you can remove it that woy -

Thank You -

[xx521xx]

I already asked, and supposedly this wasn't installed intentionally and there was nothing to suggest it was being installed. The only thing in add/remove programs related to it was something like "ArtSoft plugin", which I already removed, but it just removes the Firefox plugin and leaves the background service installed. I don't see any obvious uninstaller for the service on my hard drive, either...

[noknojon]

Hi Again -

I cannot remove it here - Is it causing a problem ??- If it is then the only people who can remove it are the experts in the Hijack This Forum by checking all of

your HJT logs and looking at Malwarebytes logs for odd entrys -

There may be someone with another answer but it is not me - Sorry -

Regards -

[xx521xx]

My bad, it's actually ArtistScope, not ArtSoft. This is what Avira says about the service executable:

CSHelper.exe KNOWN CLEAN

The file 'CSHelper.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'ArtistScope Plugin 4.0.0.1'.

[xx521xx]

Sorry, I didn't see your post before that. It isn't causing any problem in particular, it just makes me suspicious when a program appears out of nowhere like that. Plus, I've been trying recently to reduce the amount of programs I have installed but never use, not add more!

[noknojon]

@ xx521xx -

Unless you can find that entry or you can read your own Hijack This Logs then you will need someone who can read your logs - Sorry but we are not allowed to do that on the general forum area -

Try 'My Documents' and 'Windows Explorer' to look in your 'Program Files' -

Again sorry but Keep Looking if it annoys you -

[xx521xx]

Well, I didn't post in the Malware HJT Log forum because this isn't malware as far as I know. But regardless, I think I got rid of it. I restored a registry backup from prior to installation, thus getting rid of the service entry, and manually deleted the CSHelper.exe file. Maybe not the most graceful solution, but it worked.

[TonyKlein]

It's copy protection software, see here.

The kind that comes bundled with numerous applications these days. The application it came with will or will not let you allow to disable the service; you'll have to find that out for yourself...