apphelph3.dll - Dangerous
apphelph3.dll
Manual removal instructions:
Antivirus Report of apphelph3.dll:
apphelph3.dll
We suggest you to remove apphelph3.dll from your computer as soon as possible.
Apphelph3.dll is Trojan/Backdoor.
Kill the file apphelph3.dll and remove apphelph3.dll from Windows startup.
Classification:
Antivirus Version Last Update Result
BitDefender 7.2 2009.05.28 Trojan.Generic.CJ.FR
eSafe 7.0.17.0 2009.05.27 Suspicious File
McAfee+Artemis 5628 2009.05.27 Artemis!D2FC97F0ABFF
Rising 21.31.21.00 2009.05.27 Backdoor.Win32.Delf.ebx
Sophos 4.42.0 2009.05.28 Mal/EncPk-HJ
Symantec 1.4.4.12 2009.05.28 Packed.Generic.225
Additional information
File size: 33280 bytes
MD5 : d2fc97f0abff58c67febdfd316b8aa81
SHA1 : b5d8d423421f7b7a7f61e0b9cdbead75de2c90c0
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:3
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}
----------------------------------
Values added:5
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32\: "%SystemRoot%\system32\apphelph3.dll"
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\: "Google Audio Helper"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\: "Google Audio Helper"
HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\cmd.exe: "Windows Command Processor"
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files added:2
----------------------------------
C:\WINDOWS\system32\apphelph3.dll
C:\WINDOWS\system32\sys.dat
----------------------------------
Files deleted:1
----------------------------------
C:\sb\malware.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:11
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Browser Helper Object
%SystemRoot%\system32\apphelph3.dll - deleted
Removal Results: Success
Number of reboot: 1
| apphelph3.dll | Malware |
| apphelph3.dll | Dangerous |
| apphelph3.dll | High Risk |
Apphelph3.dll is Trojan/Backdoor.
Kill the file apphelph3.dll and remove apphelph3.dll from Windows startup.
Classification:
Antivirus Version Last Update Result
BitDefender 7.2 2009.05.28 Trojan.Generic.CJ.FR
eSafe 7.0.17.0 2009.05.27 Suspicious File
McAfee+Artemis 5628 2009.05.27 Artemis!D2FC97F0ABFF
Rising 21.31.21.00 2009.05.27 Backdoor.Win32.Delf.ebx
Sophos 4.42.0 2009.05.28 Mal/EncPk-HJ
Symantec 1.4.4.12 2009.05.28 Packed.Generic.225
Additional information
File size: 33280 bytes
MD5 : d2fc97f0abff58c67febdfd316b8aa81
SHA1 : b5d8d423421f7b7a7f61e0b9cdbead75de2c90c0
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:3
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}
----------------------------------
Values added:5
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32\: "%SystemRoot%\system32\apphelph3.dll"
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\: "Google Audio Helper"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\: "Google Audio Helper"
HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\cmd.exe: "Windows Command Processor"
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files added:2
----------------------------------
C:\WINDOWS\system32\apphelph3.dll
C:\WINDOWS\system32\sys.dat
----------------------------------
Files deleted:1
----------------------------------
C:\sb\malware.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:11
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Browser Helper Object
%SystemRoot%\system32\apphelph3.dll - deleted
Removal Results: Success
Number of reboot: 1
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.