Remove WebHelper virus (Removal Guide)

WebHelper is a malicious application that is detected by more than 50 anti-virus programs

WebHelper ads

WebHelper is malware that can silently infiltrate the system and run in the background while recording the victim's keystrokes, playing sounds, and reducing PC speed. Those infected with it can notice a few suspicious processes running in the background, namely, utorrentie.exe and webhelper.dll – they are not a part of Windows system and should not be present by default. In other words, if you see these processes running in the background, it is likely that you are infected with the virus.

The malicious app typically travels together with its components in one pack with uTorrent, so you should be very careful when downloading it from the Internet.^[1] If you use uTorrent, BitTorrent, and similar services to download files and programs,^[2] you can notice Web Helper 32-bit opening and playing advertisements on your computer's desktop repeatedly.

Unfortunately, there are more issues to come as the malware can cause high CPU usage and track you in the background without permission. The information that is typed via the keyboard or mouse inputs can be easily be read by malware operators; thus, eliminating this app quickly is vital to one's security and online safety. While some might think that shutting down the process will do the trick, it is not the case, as there are numerous components on the machine that will make WebHelper resurface as soon as you reboot your system.

Name	WebHelper
Type	Malware
Sub-type	Tracking software
Symptoms	Infiltrates the system unnoticed Records keystrokes Plays sounds Displays ads Tracks online activities, etc.
Danger level	High
Associated entries	utorrentie.exe and webhelper.dll
Distribution	Insecure freeware installations
Removal Solution	Malicious programs can leave plenty of files and components on the infected system – these should be eliminated promptly (we provide details below). Alternatively, you can delete malware with the help of security software quickly and effortlessly – use SpyHunter Combo Cleaner
System fix	Fortect Intego can fix the damaged Windows system files that could otherwise result in errors, system crashes and other stability issues

If you found WebHelper entries on your computer, you should know that the most visible issue it causes is serving advertisements based on users' browsing activities and performed searches. For that, malware tracks the user for some time and collects information about their interests, such as most visited websites, mostly clicked ads, etc. Additionally, it can record your keystrokes.

Unfortunately, this information, which is collected by the virus can include numerous amounts of personal data, including:

passwords;
banking data;
PC IP address;
system details;
location;
mostly visited sites;
data entered, etc.

Once the described adware collects the needed amount of information, it sends this data to its C&C servers.

Another issue is its audio ads confusing users out of nowhere. It is difficult to see what program or process is responsible for this task. The cause of the sound can be detected by opening the Volume Mixer. However, if you thought that disabling sound on WebHelper will solve the issue, we will have to disappoint you that it will help only for a limited amount of time.

Users keep complaining about WebHelper Audio Malware that is causing issues with advertisements and even error or malware alerts in audio or video form out of nowhere^[3]:

I get ads when I join community csgo servers (which is normal), but for the first time I've got a video saying “you have a virus, bla bla bla call this number bla bla bla if you close this window your computer will die bla bla bla”. So I checked where it was coming from on volume mixer and it was coming from steam client web helper.

Audio advertisements served by Web Helper are not only annoying. We should also warn you that its pop-ups and banners can contain links to possibly insecure websites.

Typically, you can’t remove WebHelper by uninstalling the app or resetting your web browsers. For that, you need to be aware of some special tips that we provided below for full malware removal. Finally, make sure you also perform a scan with Fortect Intego to fix virus damage, e.g., corrupted files and similar components.

WebHelper virus

There are two different components related to malware

WebHelper travels together with two different components that can show up in the Task Manager. They do not relate to Windows in any way.

uTorrentie.exe

utorrentie.exe is the uTorrent helper that can reinstall itself and annoy users by its reappearance. However, its main task is to use the PC's resources and communicate with its servers. It can also load third-party advertisements on your computer. The biggest problem related to such activity is a regular data tracking and computer slowdowns. We are sure that you do not want to deal with such virtual annoyances, so we highly recommend you to remove utorrentie.exe together with Web Helper.

WebHelper.dll

It acts as a browser helper object (BHO) that reinstalls WebHelper if deleted launches it and performs its unwanted activities, including displaying sound ads, pop-ups, and banners on the target system. If deleted, it typically reappears once the system is rebooted. The anonymous developer can also initiate tracking activities with the help of this .dll file.

Webhelper

Tips on malware avoidance in the future

Although this intruder is part of uTorrent, you can install similar ad-supported programs unknowingly, so we want to provide you with a guide on how to prevent this from happening in the future.

When installing free software, you should opt for Custom or Advanced installation options. These will give you an opportunity to see all the extra items added to your download.
If you do not do it and rely on Standard or Default installation options, you will simply clutter your computer with potentially unwanted programs because these installation options tend to include statements granting your permission to install all suggested additions.
Simply pick Custom or Advanced option and deselect the extras you don’t want on your computer.

Get rid of the virus and end associated processes

There is a way to remove virus for good. Keep in mind that it isn’t a critical computer program and it hardly poses a threat to your security. However, Zondervirus.nl team says^[4] that its activities are highly annoying, to say at least. Besides, its intensive data tracking can cause a loss of specific information.

You can delete Web Helper using the steps given below. Make sure you uninstall this adware via Control Panel and then reset all web browsers which are affected.

If you are not willing to perform WebHelper removal manually, you can check the system for regular adware/browser hijacking software with anti-malware software. Some of the programs we recommend are listed below. Please, make sure you update them to their latest version to have a full virus database.

Video guide for WebHelper termination

Since there are a few files that can be left behind while uninstalling the program, you should take more steps and perform virus removal this way. We have a video guide that shows you step-by-step what to fo. There are a few techniques needed for the thorough system cleaning, so follow the video and repeat all the shown procedures because WebHelper can be a persistent threat. There is no other way to end those possibly malicious processes caused by the tracking application besides fully cleaning the system.

Uninstall from Windows

Uninstall from Windows 10/8:

Type Control Panel into the Windows search box and open the result.
Under Programs, select Uninstall a program.

Uninstall from Windows 7/XP:

Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
In Control Panel, select Programs > Uninstall a program.

Remove the unwanted program:

In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
If User Account Control appears, click Yes to confirm, then complete the removal.

Delete from macOS

Remove the unwanted application:

From the menu bar, select Go > Applications.
In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).

Delete leftover files and folders:

Select Go > Go to Folder.
Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
Finally, empty the Trash to permanently remove the leftovers.

Remove from Microsoft Edge

Delete unwanted extensions from MS Edge:

Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
From the list, pick the extension and click on the Gear icon.
Click Remove.

Clear cookies and other browser data:

Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
Under Clear browsing data, pick Choose what to clear.
Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.

Restore new tab and homepage settings:

Click the menu icon and choose Settings.
Then find On startup section.
Click Remove next to any suspicious startup page.

Reset MS Edge if the above steps did not work:

Press on Ctrl + Shift + Esc to open Task Manager.
Click on More details arrow at the bottom of the window.
Select Details tab.
Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.

Instructions for Chromium-based Edge

Delete extensions from MS Edge (Chromium):

Open Edge and click select Settings > Extensions.
Delete unwanted extensions by clicking Remove.

Clear cache and site data:

Click on Menu and go to Settings.
Select Privacy, search and services.
Under Clear browsing data, pick Choose what to clear.
Under Time range, pick All time.
Select Clear now.

Reset Chromium-based MS Edge:

Click on Menu and select Settings.
On the left side, pick Reset settings.
Select Restore settings to their default values.
Confirm with Reset.
This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.

Remove from Mozilla Firefox (FF)

Remove dangerous extensions:

Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
Select Add-ons.
In here, select the unwanted extension and click Remove.

Reset the homepage:

Click three horizontal lines at the top right corner to open the menu.
Choose Settings.
Under Home, set your preferred homepage and new tab settings.

Clear cookies and site data:

Click Menu and pick Settings.
Go to Privacy & Security section.
Scroll down to locate Cookies and Site Data.
Click on Clear Data...
Select Cookies and Site Data and Temporary cached files and pages, then click Clear.

Reset Mozilla Firefox

If clearing the browser as explained above did not help, reset Mozilla Firefox:

Open Mozilla Firefox browser and click the Menu.
Go to Help and then choose Troubleshooting Information.
Under Give Firefox a tune up section, click on Refresh Firefox...
Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

Remove from Google Chrome

Delete malicious extensions from Google Chrome:

Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.

Clear cache and web data from Chrome:

Click on Menu and pick Settings.
Under Privacy and security, select Clear browsing data.
Select Browsing history, Cookies and other site data, as well as Cached images and files.
Click Clear data.

Change your homepage:

Click menu and choose Settings.
Look for a suspicious site in the On startup section.
Click on Open a specific or set of pages and click on three dots to find the Remove option.

Reset Google Chrome:

If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:

Click on Menu and select Settings.
In the Settings, scroll down and click Advanced.
Scroll down and locate Reset and clean up section.
Now click Restore settings to their original defaults.
Confirm with Reset settings.

Delete from Safari

Remove dangerous extensions:

Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.

Clear history and website data:

Click Safari in the menu and pick Clear History.
Set Clear to all history and confirm with Clear History.

Reset Safari:

Click Safari in the menu and select Preferences > Advanced.
Enable Show Develop menu in menu bar.
From the menu bar, click Develop and select Empty Caches.

How to remove WebHelper virus

WebHelper is a malicious application that is detected by more than 50 anti-virus programs

There are two different components related to malware

Tips on malware avoidance in the future

Get rid of the virus and end associated processes