WebHelper: what is this process, description, features and recommendations

Today, many owners of HP laptops (and not only them) often complain that the "Task Manager" is constantly hanging an incomprehensible process with the attached concatenated dynamic library WebHelper.dll. What it is, for many remains a mystery, covered in darkness. Let's consider the main issues related to understanding what it really is.

WebHelper: what is this process? The main varieties

First of all, it is necessary to clearly understand that for today there are several varieties of the WebHelper process used in Windows operating systems. The first type is provided exclusively for use on HP laptops and is a kind of online assistant, helping to find answers to the questions arising in the process of working with the software.

The dynamic WebHelper.dll library associated with the executable EXE file of the same name refers to one of the help system components in the HP Media Center Firmware and Driver Software and the HP Web Helper Module. This service is the official development of Hewlett Packard and does not present any threat to the system (although, in the opinion of most users, it is absolutely useless and not in demand). This is the first type of WebHelper module. What kind of process is it, many will understand if they simply use help in a "clean" system.

With the second version of WebHelper, things are much worse. In fact, it is a computer worm disguised as an official process, which on HP notebooks can be distinguished from the present process only by certain features, which will be discussed a little later. In other Windows-based computer systems, it should not be, so if this process was seen, this component should be removed immediately.

Symptoms of exposure to the system and its attendant components

So, the user can independently determine even the operation of the hidden WebHelper service. What is this process, it becomes clear when the browser's start page changes, the default search engine changes, a lot of advertisements with a suggestion to install the best antiviruses, will constantly be redirected to some commercial sites or online casinos like River Belle Pocker , The uninstalled Yahoo! panel appears in the browser Toolbar, and so on.

In addition to everything, there are frequent situations when the system crashes and reports WebHelper service errors and crashes. These are all false positives.

Problems with torrent applications

But the sad thing is that the virus almost always works when you start some popular torrent client. In this case, a lot of additional modules can be installed in the system, which can be seen in the active background services tree.

In the processes appears utorrent.exe 32 (webhelper.exe, utorrentie.exe, webhelper_installdownload_1145.exe and protector.exe as companion components). The executable file of the torrent program has nothing to do with the original. After launching the client, a lot of advertising appears in it. The virus itself is a self-copying threat of the resident type, which starts with the system and constantly "hangs" in RAM, although it consumes a minimum of resources.

The size of the source file can be either 208896 bytes or 217088 bytes. The component itself has the full name of Windows Pro Web Helper and is usually located in the root directory of Windows (sometimes it has the attribute of a hidden file).

How to remove WebHelper? Powerful antivirus scanning

To remove this threat, the first step is to use a powerful anti-virus scanner, not the one installed in the system, but an independent portable application like KVRT or Dr.Web. Web CureIt !. Ideally, it is better to use disk utilities or boot programs written to removable USB-devices such as Rescue Disk.

However, if in normal systems the virus can be detected, a problem arises in laptops with HP software, since the scanner sometimes can not make a difference between the threat and the same component of the help system. And, if you take into account that this computer worm sometimes behaves like a false-antivirus, many protective packets miss it. Here is such an interesting component of this WebHelper. What kind of process is already clear, let's move on to practical removal of the threat.

Standard removal

The first symptom of the presence in the system of the virus WebHelper - pops up constantly a message about the termination of the service or its error. If this happens, use the standard Windows removal. Strange, but the program does not hide, although it reproduces its own copies (apparently, its creators have enough arrogance not to mask the threat - provided this is self-copying, this is understandable).

So, first we enter the "Task Manager" (Ctrl + Alt + Del or the taskmgr command in the "Run" console), select the display of processes for all users and complete all the above processes. After that, we use the autorun option via the msconfig command in the same "Run" menu, where we disable the automatic start of these components.

After that, we reboot the computer or laptop in safe mode and use the "Control Panel" programs and components section where we remove the installed WebHelper, Utorrentie, WebHelper_InstallDownload and Protector programs (the last two components may not be displayed). If incidentally, the original components of the HP help system will be deleted, there is nothing to worry about (they can then be reinstalled from the official developer site).

Alternative uninstallation

Standard removal does not always help, so let's look at removing Windows Pro Web Helper by an alternative method.

To do this, you need iObit Uninstaller, which is able to uninstall the standard components of any software, and then performs a powerful scan for residual files and system registry keys, which after the appearance of the results can also be deleted.

Cleaning the system registry

Finally, when the deletion seems to be done, you should go to the system registry (the regedit command in the "Run" console) and set the search for the above filenames.

All found records should be deleted, then re-scan the antivirus to make sure that the threat is really missing.

Note: before starting the search it is recommended to make a backup of the registry or create a system restore point for those cases when any component that is critical for the functioning of the system as a whole will be accidentally deleted.

The result

That's all about the WebHelper modules. What kind of processes are we already sorted out. It remains only to be repeated: on HP laptops, online help can be restored quite simply by downloading the installation distro from the official website. And there is nothing terrible in its uninstallation (it is still very few people use it). In addition, a link to its recovery can always be found among the installed software of this developer).