The file WINDOWSHELP.EXE is identified as a virus dropper.
The dropper WINDOWSHELP.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file WINDOWSHELP.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the WINDOWSHELP.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the WINDOWSHELP.EXE process and delete the file WINDOWSHELP.EXE.
Malware Analysis of WINDOWSHELP.EXE
Full path on a computer: %Appdata%\winhelp\windowshelp.exe
Detected by UnHackMe:
Item Name: windowshelp
Author: TechSmith Corporation
Related File: %APPDATA%\WINHELP\WINDOWSHELP.EXE
Type: Registry Run
Removal Results: Success
Number of reboot: 1
WINDOWSHELP.EXE is known as:
Trojan.FrauDrop.abkqs, a variant of MSIL.Spy.Agent.JG, Trojan-Dropper.Dorifel, PSW.MSIL.GAO
WINDOWSHELP.EXE hash:
- MD5: 59f448f6abeb91d3acb12b9d50f54782
The file tries to download information from some web sites.
How to quickly detect WINDOWSHELP.EXE presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\windowshelp: “%Appdata%\winhelp\windowshelp.exe”
Folders:- %Appdata%\59f448f6abeb91d3acb12b9d50f54782
- %Appdata%\winhelp
Files:- %Appdata%\59f448f6abeb91d3acb12b9d50f54782\59f448f6abeb91d3acb12b9d50f54782.exe
- %Appdata%\Administrator.txt
- %Appdata%\r58Ies.tmp
- %Appdata%\winhelp\windowshelp.exe
- C:\Documents