Exterminate It! Antimalware


Known threats:700,086 Last Update:March 16, 12:51


Just purchased Exterminate It to remove Fake Screensaver and Richvideocodec, within minutes solved a problem I have been agonising over for days, saved my computer and sanity with minimum expense and fuss, thanks for a great product.

Craig H.


Location of HELP_DECRYPT.URL and Associated Malware

Check whether HELP_DECRYPT.URL is present in the following locations:

HELP_DECRYPT.URL file locations that are Windows version independent:


Windows 2000, Windows XP, Windows Server 2003 specific HELP_DECRYPT.URL file locations:

  • C:\Documents And Settings\USER_NAME\Start Menu\Programs\Startup\HELP_DECRYPT.URL

Windows Vista, Windows Server 2008, Windows 7, Windows 8 specific HELP_DECRYPT.URL file locations:

  • C:\Users\USER_NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.URL

If you find HELP_DECRYPT.URL file in any of these locations, your computer is very likely to be infected with the following malware:

IMPORTANT: Malware files can be camouflaged with the same file names as legitimate files. The HELP_DECRYPT.URL file is associated with malware only if found in the locations listed above.


Different Variations of HELP_DECRYPT.URL File^

File SizeFile Md5Last Seen
42248B1C67D6154958842341BC0CAC44D3AMar 31, 2015
276277FBEF1A34A7963C2D7DD0F574DC76FApr 8, 2015
280B32304AB1E44F5692531F06380D2EEAAApr 29, 2015
3047090AD46A49BC3F5BBC3BAA0A1A1EB82Jun 22, 2015
462369AFD1D31FDBBE93A2E3190FD4D96DDJul 11, 2015
28891E4A7926EFB457F243869628A7F9F88Jul 28, 2015
28003EDD064CCE30EE7282865B835BA74C9Aug 1, 2015
46287895281587A0C0EB2BE1012ED102B15Aug 6, 2015
45850B1F52754612A1FB750251E11DB998EAug 23, 2015
28842BBE9F272EA8DCA0704DDC7A3210A7ASep 2, 2015
292A9233B1EBB4DD0BC2A4A8F07A0BE80CESep 10, 2015
2967271FB64E731FE90145872CE6385E3A2Sep 14, 2015
2964781B0D9C71DEE03BFB23B4E1559A7BEOct 2, 2015
2925019551957DA429337577160D8B5FA1FOct 9, 2015
2969564C6660163A62DD67779F673119BFEOct 14, 2015
2927E2250DB552421B53C55F40AECB9B64FOct 23, 2015
292F1506B077A45A8875A9635ADD1C00166Oct 26, 2015
2925B042F94732E97D9855E06BCC644FA3DNov 8, 2015
2965A0F9C668A20B94DA5C47560ABCEEC1FMar 19, 2016
42037874AFE4EB879504BE7976C04DF6C80May 20, 2016
44658B7915210FC8ABD172D86BC10D09FC4May 24, 2016
2923F02875CBE9755096FACCC991571B2FBJun 22, 2016
2962B5DE45B322A76F2DE25A5A053A26CE6Sep 10, 2016
2921493C61FC1C772DC56060238C0861E74Nov 17, 2016
30064972BA6AEC56FD85C939DE832D364D5Mar 30, 2015
29674A6A6661A182206660D4955F4210FAAApr 17, 2015
296DDF1BDF2D16EB85401DF163804E07224Apr 22, 2015
280D761D984DAC0CD78CB621C44B3A32723Jun 27, 2015
292BBF59E501C428236BBA65BCA5B9AE8CBJul 29, 2015
304C6269539DF496C2A640462B04B4527BDAug 6, 2015
3009DC7F5F62692379791D38D71AD0B3720Aug 23, 2015
29200E5C4B07CCCAC14022151DDB54C4227Dec 9, 2015
27655D2679BA5B5A4756C4E35E2BC815B96May 20, 2016

Why Is It Important to Remove Malware Files?^

It is imperative that you delete malware-associated files as soon as possible because they can be used - or are already being used - to inflict serious damage on your PC, including:

  • Disrupting the normal functioning of the operating system or rendering it completely useless.
  • Hijacking valuable private information (credit card numbers, passwords, PIN codes, etc.)
  • Directing all your Web searches to the same unwanted or malicious sites.
  • Dramatically slowing down your computer.
  • Gaining total control of your PC to spread viruses and trojans and send out spam.


  1. To enable deleting the HELP_DECRYPT.URL file, terminate the associated process in the Task Manager as follows:
    • Right-click in the Windows taskbar (a bar that appears along the bottom of the Windows screen) and select Task Manager on the menu.
    • In the Tasks Manager window, click the Processes tab.
    • On the Processes tab, select HELP_DECRYPT.URL and click End Process.
  2. Using your file explorer, browse to the file using the paths listed in Location of HELP_DECRYPT.URL and Associated Malware.
  3. Select the file and press SHIFT+Delete on the keyboard.
  4. Click Yes in the confirm deletion dialog box.
  5. Repeat steps 2-4 for each location listed in Location of HELP_DECRYPT.URL and Associated Malware.
  6. Notes:

    • The deletion of HELP_DECRYPT.URL will fail if it is locked; that is, it is in use by some application (Windows will display a corresponding message). For instructions on deleting locked files, see Deleting Locked Files.
    • The deletion of HELP_DECRYPT.URL will fail if your Windows uses the NT File System (NTFS) and you have no write rights for the file. Request your system administrator to grant you write rights for the file.

Deleting Locked Files^

You can delete locked files with the RemoveOnReboot utility. You can install the RemoveOnReboot utility from here.

After you delete a locked file, you need to delete all the references to the file in Windows registry.

To delete a locked file:

  1. Right-click on the file and select Send To -> Remove on Next Reboot on the menu.
  2. Restart your computer.

The file will be deleted on restart.

Note: In the case of complex viruses that can replicate themselves, malware files can reappear in the same locations even after you have deleted those files and restarted your computer. Exterminate It! Antimalware can effectively eradicate such viruses from your computer.

To remove all registry references to a HELP_DECRYPT.URL malware file:

  1. On the Windows Start menu, click Run.
  2. In the Open box, type regedit and click OK. The Registry Editor window opens.
  3. On the Edit menu, select Find.
  4. In the Find dialog box, type HELP_DECRYPT.URL. The name of the first found registry value referencing HELP_DECRYPT.URL is highlighted in the right pane of the Registry Editor window.
  5. Right-click the registry value name and select Delete on the menu.
  6. Click Yes in the Confirm Value Delete dialog box.
  7. To delete all other references to HELP_DECRYPT.URL, repeat steps 4-6.
IMPORTANT: Malware files can masquerade as legitimate files by using the same file names. To avoid deleting a harmless file, ensure that the Value column for the registry value displays exactly one of the paths listed in Location of HELP_DECRYPT.URL and Associated Malware.