Today, many owners of HP laptops (and not only them) often complain that the "Task Manager" constantly hangs an incomprehensible process with an attached accompanying dynamic library WebHelper.dll. What it is for many remains a mystery, covered in darkness. Consider the main issues associated with understanding what it really is.
WebHelper: what is this process? Main varieties
First of all, you need to clearly understand that today there are several varieties of the WebHelper process used in Windows operating systems. The first type is intended exclusively for use on HP laptops and is a kind of online assistant that helps you find answers to questions arising in the process of working with software.
The WebHelper.dll dynamic library associated with the same executable EXE file belongs to one of the help system components in the software products HP Media Center Firmware and Driver Software and HP Web Helper Module. This service is an official development of Hewlett Packard and poses no threat to the system (although, according to most users, it is absolutely useless and not in demand). This is the first type of WebHelper module. What this process is, many will understand if they simply use help in a "clean" system.
The second kind of WebHelper is much worse. In fact, this is a computer worm disguised as an official process, which on HP laptops can be distinguished from the real process only by some signs, which will be discussed later. On other Windows-based computer systems, it should not be, so if such a process has been noticed, this component must be removed immediately.
Symptoms of exposure to the system and related components
So, the user can independently determine even the operation of the hidden WebHelper service. What kind of process it is, it will become clear when the browser start page changes, the default search engine changes, a bunch of ads appear suggesting you to install the best antiviruses, a redirect to some commercial sites or online casinos like River Belle Pocker will constantly occur , the uninstallable Yahoo! bar will appear in the browser Toolbar, etc.
On top of that, situations of system malfunction with the generation of error messages about the WebHelper service and its emergency shutdown are not uncommon. These are all false positives.
Problems with torrent applications
But the saddest thing is that the virus almost always works when you launch some popular torrent client. At the same time, a lot of additional modules can be installed in the system, which can be seen in the tree of active background services.
Utorrent.exe 32 appears in the processes (webhelper.exe, utorrentie.exe, webhelper_installdownload_1145.exe and protector.exe as related components). The executable file of the torrent program has nothing to do with the original. After starting the client, a bunch of ads appear in it. The virus itself is a self-replicating threat of a resident type, which starts with the system and constantly "hangs" in RAM, however, consuming a minimum of resources.
The size of the source file can be either 208896 bytes or 217088 bytes. The component itself has the full name Windows Pro Web Helper and is usually located in the root directory of Windows (sometimes it has the attribute of a hidden file).
How to remove WebHelper? Powerful antivirus scan
To remove this threat, the first step is to use a powerful anti-virus scanner, and not the one installed in the system, but an independent portable application like KVRT or Dr. Web CureIt !. Ideally, it is better to use disk utilities or boot programs written to removable USB devices such as Rescue Disk.
However, if the virus can be detected in ordinary systems, there is a serious problem in laptops with HP software, because the scanner sometimes cannot distinguish between a threat and the help component of the same name. And, if you take into account that this computer worm sometimes behaves like a false anti-virus, many protective packages let it through. Here is such an interesting component this WebHelper. What this process is, it’s already clear, we will move on to the practical removal of the threat.
Standard deletion
The first symptom of the presence of the WebHelper virus in the system is a constantly popping up message about the service termination or its error. If this happens, apply standard removal using Windows. Strange, but the program does not hide, although it reproduces its own copies (apparently, its creators have a lot of arrogance so as not to mask the threat - provided it is self-copying, this is understandable).
So, first we enter the "Task Manager" (Ctrl + Alt + Del or the taskmgr command in the "Run" console), select the display of the processes of all users and complete all the above processes. After that, we use the autorun setting via the msconfig command in the same “Run” menu, where we disable the automatic start of these components.
After that, we reboot the computer or laptop in safe mode and use the “Control Panel” program and component section, where we remove the installed programs WebHelper, Utorrentie, WebHelper_InstallDownload and Protector (the last two components may not be displayed). If along the way the original components of the HP help system are removed, it's okay (you can then reinstall them from the official website of the developer).
Alternative uninstall
Standard removal does not always help, so let's look at the removal of Windows Pro Web Helper by an alternative method.
To do this, you will need the iObit Uninstaller program, which is able to uninstall the standard components of any software, after which it performs a powerful scan for residual files and registry keys, which can also be deleted after the results appear.
System registry cleaning
Finally, when the removal seems to be done, you should go to the system registry (regedit command in the Run console) and search for the above file names.
All found entries should be deleted, and then re-scanned by the antivirus to make sure that the threat is really absent.
Note: before starting the search, it is recommended that you make a backup copy of the registry or create a system restore point for cases in which some component critical to the functioning of the system as a whole is accidentally removed.
Total
That's it for WebHelper modules. What are these processes, we have already figured out. It remains only to repeat: on HP laptops, the online help desk can be restored quite simply by downloading the installation distribution kit from the official website. And there is nothing wrong with uninstalling it (all the same, few people use it). In addition, a link to its restoration can always be found among the installed software of this developer).