When i start my notebook there a window "WSHelper.exe - System Error"

[Jerddy]

I install and uninstall 2 programs by using uninstall (control panel) last night

-- 1)  filmora-idco 2) windows-movie-maker-2016 (trial version)

and next moring i have this

WSHelper.exe - System Error 

They say " The program can't start because DAQExp.dll is missing from your computer. Try reinstalling the program to

fix this problem."

How can i check 'where this program missing? or can i download and install by myself (where should i put this program in which foulder?) 

i don't know what to do??

please help me 

Thank you

[IT_WinSec]

Hello @Jerddy

Welcome to the HP Support forum. Thank you for posting.

One of the programs you have had has also installed a malware/virus on your PC - potentially unwanted program. Now you have uninstalled part of it but not all of it is gone.

I suggest you run ESET's Online Scanner (eset.com) to scan your PC for threats and remove if anything is found. Make sure you select the option to enable scanning for potentially unwanted apps and potentially unsafe apps. Remove all threats found. Here is more info:

>> http://support.eset.com/kb2921/?locale=en_US

>> https://download.eset.com/special/eos/esetonlinescanner_enu.exe

After the scan has completed, restart the PC and see if you still experience the errors.

Let me know what ESET found - you may even take a screenshot(s) of it and post them back here.

If the issue persists even after the scan and the restart, provide me with a log file.

Download Autoruns (from Microsoft) from this URL => http://live.sysinternals.com/autoruns.exe

Information about the product => http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

- Save the file on your Desktop

- Run Microsoft Autoruns  with Administrator rights (right click -> Run as Administrator).

Agree with the standard license agreement from Microsoft.

- Once Autoruns is started, it will need some seconds (could be a minute) to gather the snapshot, wait for it.

Once it is ready, you will see the word Ready in the lower left side.

• Click on Options

Make sure that only the following are selected:

• Hide Empty Locations
• Hide Windows Entries

- Click on  Rescan button  or  click on File -> Refresh to rescan the system.

It will need some seconds (could be a minute) to gather the snapshot, wait for it.

Once it is ready, you will see the word Ready in the lower left side.

- Finally, click on File -> Save

Save the snapshot on the desktop in .TXT file

Open the newly created TXT log file.

Mark and Select all of the text (e.g. CTR+A), copy it and

visit http://pastebin.com/  to paste it there

Create new paste and give me the URL to see the log file.

Looking forward to your reply.

[Jerddy]

HI IT_WinSec

now i ran ESET's online Scanner and restart my notebook as your first suggestion already

and it's still have the same window as before
and it's have 2 new notic window

this is my result

(ESET's result)

C:\Users\User\AppData\Local\Temp\7zS2014\Optional\HP_IPG_Toolbar_installer.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting
C:\Users\User\Downloads\photo.zip Win32/TrojanDownloader.Zurgop.CO trojan deleted
C:\Windows.old\Users\User\AppData\Local\Temp\7zS2BA8\Optional\HP_IPG_Toolbar_installer.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting
D:\DJ3540_188.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application cleaned by deleting

(last one still have)

( 2 new Notic window found)

i will try second suggestion soon

and i have some questions

after i run Microsoft Autoruns
my program and all files in my pc are safe
i worry about my notebook will collapse and lost all of my files

thank you ,Jerddy

[IT_WinSec]

---

@Jerddy wrote:

after i run Microsoft Autoruns
my program and all files in my pc are safe
i worry about my notebook will collapse and lost all of my files

thank you ,Jerddy

---

Hello ,

It seems ESET did not found the risks.

Here is more info about the WSHeler > https://superuser.com/questions/800294/how-do-i-completely-remove-wondershare-allmytube-from-windows...

Don't worry about Autoruns - it is Microsoft utility and it does nothing other than scan and take log. It does not change anything, therefore is pretty safe to run/use.

Looking forward to your reply and for the rest of the requested info

[Jerddy]

Hi,

i ran Microsoft Autoruns

this is URL

https://pastebin.com/Bavrf7GP

Thank you

[IT_WinSec · Accepted solution]

Thank you for the provided log @Jerddy

I analyzed your log file and I can see where the problem is.

1. Open Autoruns again (right click with Administrator rights)

2. Wait for the scan to complete

3. Scroll down to

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"  (should be pretty high, one of the top)

 Below this section, you will be able to see this entry/line:

+ "Wondershare Helper Compact.exe"  ""  ""  "File not found: C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe.exe"

UNCHECK THIS CHECK/LINE

4. Scroll down to

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run"

Below this section, you will see an entry/line with this:

+ "Wondershare Helper Compact.exe"  "Wondershare Studio"    "Wondershare"   "c:\program files (x86)\common files\wondershare\wondershare helper compact\wshelper.exe"

UNCHECK THIS CHECK/LINE

5. Close Autoruns.

6. Using File Explorer / My Computer / Windows explorer, manually go to :

Local disk (drive) C  >>program files (x86)\common files\

Manually erase/delete this folder and everything inside >> wondershare

7.  Restart your PC  (restart!  ,  no shut down and then back on)

After restarting the PC, your issue should be gone. Please, let me know if this fixes your issue. Do not hesitate to post again if you experience problems.

If the issue is fixed, you can uninstall ESET scanner and delete Autoruns (if you want to).

If my comment helped, please mark this post as a solution so that you also help others searching the forums.

Cheers ! 🙂

[Jerddy]

Thank you so much

after did every advices you gave 
now every strange windows were gone!!!!

Hooray!!! \(>O<)/ we finally did it!!
(feeling really happy)

Thank you for your advices so much
I was impressed with your help and support.

[IT_WinSec]

@Jerddy

You are most welcome. Thank you for choosing HP.

Don't hesitate to post again if you have any issues or questions.