It installed the sound service without permission and impossible to uninstall

[Anixx]

WinPaletter installed the system sounds service without permission. During installation I closed the dialog that was prompting to instal it.

After that I tries to remove it by uninstalling WinPaletter via control panel, but the startup sound still is played on login.

[Abdelrhman-AK]

• Services installation should not start by itself. It starts when the user clicks on Install. Did you choose to hide installation prompt and it installed itself in a second session or not?

• To remove it: stop this service in services and delete its file located in C:\Program Files\WinPaletter\Data\Services

• Startup sound is not managed by this service. Anyway, you can disable or enable this sound in sounds control panel applet

[Anixx]

What's the name of the service in Services.msc?

Services installation should not start by itself. It starts when the user clicks on Install.

I think, I clicked on cancel or closed the dialog. I definitely did not click on install.

[Anixx]

There is no folder C:\Program Files\WinPaletter\Data\Services

Still after WinPaletter installation I get very distinct and very loud startup sound. In the Sound control applet SystemStart has no sound assigned:

[Anixx]

Wait, maybe the sound is because the checkbox "play system start music" is on. But the sound is not similar to the default startup sound. I think, I always had startup sound but what made me worried is that now the sound is very different from default.

[Abdelrhman-AK]

• Service name is WinPaletter.SystemEventsSounds
• The sounds being played on startup is actually unlock sound.
• I tried to reproduce this issue. But it didn't install itself after clicking cancel or hiding it.
• I'll investigate about installation of service inspite of cancelling it or hiding it.

[Abdelrhman-AK]

In the Sound control applet SystemStart has no sound assigned

WinPaletter saves startup sound to HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemStart\.Current and it is playable in Windows XP. It has no use in newer versions of Windows.

[Anixx]

In the Sound control applet SystemStart has no sound assigned

WinPaletter saves startup sound to HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemStart\.Current and it is playable in Windows XP. It has no use in newer versions of Windows.

This registry place is empty on my system, but the sound is played.

[Anixx]

• Service name is WinPaletter.SystemEventsSounds

  • The sounds being played on startup is actually unlock sound.

  • I tried to reproduce this issue. But it didn't install itself after clicking cancel or hiding it.

  • I'll investigate about installation of service inspite of cancelling it or hiding it.

Another thing that happened is that when I was exitting WinPaletter, I wanted to exit without applying the theme, but I did not know what to chose in the exit dialog. WinPaletter applied the them contrary to my wish, so I had to restore the previous settings manually. Maybe, at this point it changed the startup sound...

[Anixx]

The current startup sound is VERY loud, far different in this from the standard system sounds.

[Abdelrhman-AK]

This registry place is empty on my system, but the sound is played.

That is because of patched imageres.dll

The current startup sound is VERY loud, far different in this from the standard system sounds.

You can try restoring default startup sounds by two methods:

1. Open Sounds in WinPaletter, enable the toggle, go to startup sound, press on default and then quick apply this aspect.

or 2. Open command prompt elevated and run SFC /scanfile=%windir%\System32\imageres.dll then restart your Windows

Another thing that happened is that when I was exitting WinPaletter, I wanted to exit without applying the theme, but I did not know what to chose in the exit dialog.

To do nothing on exiting WinPaletter, check these options.

[Anixx]

That is because of patched imageres.dll

I did not patch imageres.dll ever. Was it patched by WinPaletter? How can I restore the original one?

[Anixx]

2. Open command prompt elevated and run SFC /scanfile=%windir%\System32\imageres.dll then restart your Windows

I did this, it says the system protection could not find any integrity violations. But it still plays startup sound.

[Anixx]

What's the difference between cancel, close, and "do actions"?

[Anixx]

If it is playing the logon sound, chow can I restore the default one?

[Anixx]

• I tried to reproduce this issue. But it didn't install itself after clicking cancel or hiding it.

I have just reroduced it again. After clicking "Cancel" at the time of first start, in the Control Panel appeared a new WinPaletter icon.
If to chose to uninstall it, appears a dialog about installation, not de-installation:

Should I click "Start" to uninstall it?

[Abdelrhman-AK]

How can I restore the original one?

• The mentioned steps should restore any patched imageres.dll

I did this, it says the system protection could not find any integrity violations.

This means that imageres.dll is not patched. Maybe the loud sound is from the service.

What's the difference between cancel, close, and "do actions"?

• Cancel will cancel exit process (Closes the dialog and WinPaletter won't exit)
• Close will close this dialog and nothing will be done
• Do actions will do the selected actions above and then closes WinPaletter

If it is playing the logon sound, chow can I restore the default one?

• Changing sounds inside WinPaletter > sounds, or uninstalling the service.

I have just reroduced it again. After clicking "Cancel" at the time of first start, in the Control Panel appeared a new WinPaletter icon.

• How did WinPaletter appear in Control Panel? Please show me this if it is possible.

Should I click "Start" to uninstall it?

No, it will install it again. Go to WinPaletter Settings > Users and services > Uninstall

---

And to avoid opening this dialog, uncheck this option and click on cancel:

And then go to WinPaletter Settings > Users and services > Uninstall to uninstall it completely

[Anixx]

• Cancel will cancel exit process (Closes the dialog and WinPaletter won't exit)

• Close will close this dialog and nothing will be done

Cancel and close do the same?

[Anixx]

• How did WinPaletter appear in Control Panel? Please show me this if it is possible.

1. Run WinPaletter.
2. In the service installation dialog click Cancel
3. Exit WinPaletter. The icon appears in the Add/Remove software list in Control Panel.

[Anixx]

No, it will install it again. Go to WinPaletter Settings > Users and services > Uninstall

I do not see this option. WinPaletter re-appears in Control Panel when I start it. If I click in Control Panel on "uninstall", the Service Installer dialog as above appears. If I click "Start" it says it is uninstalled, and disappears from Control Panel. But the startup sound remains. If I start WinPaletter it re-appears again without any action from my part.

[Abdelrhman-AK]

Cancel and close do the same?

• No. Cancel will abort exit process, and WinPaletter will stay opened.
• Close won't do any checked option and WinPaletter will exit.

WinPaletter re-appears in Control Panel when I start it.

This is a normal behaviour of WinPaletter and it is not related to service installer. It is used to delete registry data of WinPaletter and files of WinPaletter in AppData and Program Files. Everytime you open WinPaletter it will create an uninstaller entry in control panel

If I start WinPaletter it re-appears again without any action from my part.

• That is because the uninstaller deleted WinPaletter settings in registry, and so Hide dialog option won't be remembered.
• I made service installer to be checked at WinPaletter startup, if it is not installed or not updated then the dialog will appear.

[Abdelrhman-AK]

But the startup sound remains.

I want to know if this is the same sound of Windows 11 startup sound or another sound that plays with your device startup, so that I can differentiate its source (imageres.dll or service) and then we can restore the original sound.

Please check your Task Scheduler and open the WinPaletter entry to identify any remnants from older WinPaletter versions.

[Anixx]

• Close won't do any checked option and WinPaletter will exit.

This is not intuitive, I thought it means "close the exit dialog".

Everytime you open WinPaletter it will create an uninstaller entry in control panel

A counter-intuitive behaviour here is that the uninstaller entry shows the "install service" dialog which makes impression yu cannot proceed with uninstallation without pressing "Start" button in the dialog.

[Anixx]

I want to know if this is the same sound of Windows 11 startup sound or another sound that plays with your device startup, so that I can differentiate its source (imageres.dll or service) and then we can restore the original sound.

The sound is not standard Windows sound. Or at least it is very loud compared to other sounds. It is the same as "Logon" sound in WinPaletter sound settings.

Please check your Task Scheduler and open the WinPaletter entry to identify any remnants from older WinPaletter versions.

Indeed, there is a WinPaletter task in task scheduler. Even after uninstalling WinPaletter.

[Abdelrhman-AK]

Indeed, there is a WinPaletter task in task scheduler. Even after uninstalling WinPaletter.

Delete these tasks and tell me if the sound will be played again or not. Newer versions of WinPaletter don't use tasks scheduler anymore.

It is the same as "Logon" sound in WinPaletter sound settings.

Erase textbox contents of logon sound and quick apply the theme (if the first trial didn't work).

[Abdelrhman-AK]

A counter-intuitive behaviour here is that the uninstaller entry shows the "install service" dialog which makes impression yu cannot proceed with uninstallation without pressing "Start" button in the dialog.

I'll fix this conflict.