winhlp32

[wildred]

Hey guys n gals, I have a real quick question. I have searched all over google etc. and this site and found no records of a file called winhlp32.dll.exe

Now just looking at that file, I wonder if it is a virus. Panda software came up null as well as housecall

I ran Hijack this, deleted the BHO referance to it as well as the startup file. The program still loads.

This is a client of mines computer, so getting the logs for it may be difficult.

With that being said, under the process manager tab, I see it running 3-4 times each with a relative amount of memory being used, but no cpu processing.

Has anyone heard of this issue before or seen the file?

Ending the task reloads the same 3-4 files.

[MURACU]

I checked quickly on microsoft for something but all that came up was the fact that it is a programme that manages the help files.
So I made a quick search on symantec for winhelp32 and came up with the following

winhelp32 stator

winhelp32 lov

there are more links but you need to search for winhlp32. you may have one of the virii mentioned or a variation. All I can suggest is to update your antivirus if you havent already done it and manually check your registry. It might take a bit of time but it can be worth it.

hope that helps.

edit sorry for squeezing in infront of you nihil

[nihil]

Hi Wildred, what OS are you running

I have winhlp.exe on my WinME box

Winhlp.dll.exe looks highly suspicious because of the apparent double extension?

Cheers

EDIT: No problems MURACU.............M comes before n in the alphabet

[cacosapo]

winhlp32.dll.exe?

its a malware. No way microsoft will name a file like that. Hunt and destroy it!

Just for information. winhlp32.exe is the help file processor for Windows systems, 32 bits. its is stored at \winnt\system32 folder

[nihil]

If the file is "winhlp32.dll" I would say that the box has been infected by the Isearch/Cool Web Search browser/ search engine hijacker, or some variant of it.

Is the winhlp32.dll.exe an actual file or the name of the process?

Search for Winhlp32*.* and let us know what you find and where it is.

Take a look at the BHOs, try spybot S&D and CW Shredder.

Cheers

[wildred]

Just to update, I ran Pest Patrol, a product similar to Spybot etc. and deleted all entries. I then ran CWShredder and found some entries as well. I ran Hijack this and removed all startup files (that I knew of) that might contain the file. I also deleted the BHO registry entry. The file is not the winhlp32.exe or winhlp32.dll - as nihil suggested, the file is suspicious because of the double extension. I checked to see if he had either the exe or dll and he only has the exe file. I am suspecting it is either malware or a virus however no scanners are turning up any results. I thought there was once a place where you can submit a virus for *free* and they will look at the file for you; granted I am sure the wait time is extensive.

[nihil]

Yes wildred, all the major AV companies will look at files for you, there are generally instructions on either the "support" or "virus dictionary" pages on their sites. You don't have to be a customer for this, as you are actually helping them

Cheers

[groovicus]

Is there any way you can send a copy of that file here? I know some people that may be interested. Rename it as a text file and zip it please.


Mail here

[wildred]

I will try to get ahold of the client again, and see about getting a copy of that file. I remoted in to his computer...so who knows what he has found afterwards.