Hlpsvc.exe removal

  • Kaspersky: P2P-Worm.Win32.Palevo.asy: 
  • Sophos: Mal/Autorun-E: 
  • Bitdefender: Trojan.Downloader.Injecter.B:
  • Avira: Worm/Agent.W.45:


This worm's latest release was discovered in July of 2009. It can also be considered as a Trojan-downloader as it connects to several servers and downloads malicious programs. Like other viruses, this one also modifies registry entries and drops itself into the sensitive directories of the System. However, the worm supports all the Windows operating Systems except Vista and the new Windows 7. The way of programming of this virus is interesting. It concentrates on dropping its main file into the "Recycler" folder where nobody would look into. It also creates a Desktop.ini where malicious code is stored. It injects itself into the Windows processes that are usually run on Startup like Explorer.exe, Services.exe, etc. It works in the computer so silently that you wouldn't even notice that you have a virus. A high network activity is detected at the time of execution of this virus. This one maybe easy to delete but since its a Trojan-dropping program, the mallware that it downloads could contain dangerous code that might not get detected by several anti-viruses. Hence, such Trojan-downloaders should be gotten rid of as soon as possible. As mentioned before, the virus creates a file in the Recycler folder which is a data storage directory which saves the programs that were previously deleted by the User. No, this is not the Recycle bin but its functions are similar to the it. Now lets take a look at the ways to remove this virus. 

Manual instructions to remove hlpsvc.exe:

  1. First, disable your System restore in order to prevent the virus from returning. To do so, read this.
  2. Reboot your system in the Safe Mode and open your registry( Start--> Run and type regedit). Navigate to the following registry key

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    Delete the following entry

    "Microsoft Help and Support"="C:\RECYCLER\S-1-5-21-{rest of the path}\hlpsvc.exe"

    Save the path of the virus in a Notepad just not to forget it.

  3. Search in the registry for any other entries containing the name "hlpsvc.exe". You'll definitely find an entry consisting the path of the virus. Make sure you delete only the path and not the whole key because that entry could belong to an important process of your System. 
  4. Now restart your computer again in the Safe Mode and delete the path of your Trojan using CMD. To do this, open your Command Prompt from Start --> Run and by typing "cmd" in the box.
    -> You'll be in the %Home% directory. To get out of that, type "cd\" (without the quotes)
    ->You're now in the C: directory. To goto the location, type "cd Recycler"
    ->After entering the Recycler directory, navigate to the path that you saved earlier. Since the name of the path would be too big, just type the first 5 letters correctly and click the Tab button. When you'll get the directory you're looking for, press the Return key.
    ->Type attrib -r -a -s -h to remove any attributes assigned to the files and "del hlpsvc.exe" to delete the file.
  5. As I told you before, that directory may also consist of an infected Desktop.ini file. Delete that one and also any suspicious files you find in the folder.
  6. And....thats it! you're done. Don't ever download a program unless you know completely what it is because that is how this Trojan enters your computer. Good luck!
VShop
Get the best security software for your compter here!

powered by Blogger | WordPress by Newwpthemes | Converted by BloggerTheme