apphelph3.dll - Dangerous
apphelph3.dll
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
Apphelph3.dll is Trojan/Backdoor.
Kill the file apphelph3.dll and remove apphelph3.dll from Windows startup.
Classification:
Antivirus Version Last Update Result
BitDefender 7.2 2009.05.28 Trojan.Generic.CJ.FR
eSafe 7.0.17.0 2009.05.27 Suspicious File
McAfee+Artemis 5628 2009.05.27 Artemis!D2FC97F0ABFF
Rising 21.31.21.00 2009.05.27 Backdoor.Win32.Delf.ebx
Sophos 4.42.0 2009.05.28 Mal/EncPk-HJ
Symantec 1.4.4.12 2009.05.28 Packed.Generic.225
Additional information
File size: 33280 bytes
MD5 : d2fc97f0abff58c67febdfd316b8aa81
SHA1 : b5d8d423421f7b7a7f61e0b9cdbead75de2c90c0
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys added:3
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}
----------------------------------
Values added:5
----------------------------------
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32\: "%SystemRoot%\system32\apphelph3.dll"
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\InProcServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Classes\CLSID\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\: "Google Audio Helper"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DF4E0B0-8744-4D55-AF4E-85818E3BEAC5}\: "Google Audio Helper"
HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\cmd.exe: "Windows Command Processor"
----------------------------------
Values modified:0
----------------------------------
----------------------------------
Files added:2
----------------------------------
C:\WINDOWS\system32\apphelph3.dll
C:\WINDOWS\system32\sys.dat
----------------------------------
Files deleted:1
----------------------------------
C:\sb\malware.exe
----------------------------------
Files [attributes?] modified:0
----------------------------------
----------------------------------
Folders added:0
----------------------------------
----------------------------------
Folders deleted:0
----------------------------------
----------------------------------
Total changes:11
----------------------------------
-------------------------------------------------------------------------------------
Detected by RegRun Reanimator:
Type: Browser Helper Object
%SystemRoot%\system32\apphelph3.dll - deleted
Removal Results: Success
Number of reboot: 1