» rchelper.exe
Overview
Analysis
File Details
Programs (1)

rchelper.exe

Registry Clean Expert

CleanMyPC Technology Limited

The application rchelper.exe, “RegClean Expert Scheduler” by CleanMyPC Technology Limited has been detected as a potentially unwanted program by 2 anti-malware scanners. This file is typically installed with the program Registry Clean Expert by iExpert Software.

File name:

rchelper.exe

Publisher:

iExpert Software (signed by CleanMyPC Technology Limited)

Product:

Registry Clean Expert

Description:

RegClean Expert Scheduler

Version:

4, 8, 4, 0

MD5:

e0aeed18a66c940b559716a74021b700

SHA-1:

6d012ac2f207c05c53c0493eda76a4a283119bdc

SHA-256:

db55d4e0cf254464983a2ca1b54b50dd246348435eda337f1c195e074a0341c3

Scanner detections:

2 / 68

Status:

Potentially unwanted

Analysis date:

4/24/2024 3:04:20 AM UTC (today)

Scan engine

Detection

Engine version

Kaspersky

Virus.Win32.Suspic

14.0.0.894

Reason Heuristics

Win32.Generic

15.12.30.2

File size:

592.4 KB (606,592 bytes)

Product version:

4, 8, 4, 0

Original file name:

RCScheduler.EXE

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\registry clean expert\rchelper.exe

Digital Signature

Signed by:

CleanMyPC Technology Limited

Authority:

The USERTRUST Network

Valid from:

3/21/2010 5:00:00 PM

Valid to:

3/21/2012 4:59:59 PM

Subject:

CN=CleanMyPC Technology Limited, O=CleanMyPC Technology Limited, STREET="ROOM C1D 6/F, WING HING INDUSTRIAL BUILDING", STREET=14 HING YIP STREET, STREET="KWUN TONG, KOWLOON, HONG KONG", L=HONG KONG, S=NA, PostalCode=NA, C=HK

Issuer:

CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:

253A6CD8243978CADEED6FF2D0C2F4E1

File PE Metadata

Compilation timestamp:

5/3/2011 5:29:52 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:Pp/Vce5alOjFWyT+3PgjZ2SP6b7MP+Dd2PzOkJvp:PPc1OjF1S3PgVu7MP+h27O0

Entry address:

0x1000

Entry point:

68, 01, 70, 49, 00, E8, 01, 00, 00, 00, C3, C3, 8F, 68, 23, AE, C2, EB, 01, 7E, 5D, F0, 86, 4C, 22, 6B, 4C, 64, 4F, 2F, B9, AA, 37, A8, 85, BA, 06, 9C, D8, FA, 67, 9F, EE, C6, F2, 33, 8B, 87, 67, 45, F9, CB, FF, FC, 96, 56, DA, 9E, 95, E6, 2A, 0B, 31, D8, 29, 61, 9A, 7C, 0A, 35, 03, 89, 32, A3, 58, F8, 62, 6B, 91, 23, 3F, 03, 1A, 8E, C1, EA, 37, CC, CC, 3A, CD, 5A, DD, 53, 85, 31, E0, F0, 03, 0F, 91, 77, 90, 3A, 57, BF, 3D, 07, AE, 70, B6, 46, 8D, 0F, 54, 96, BB, 82, F3, 7B, 71, 9A, 57, 2E, 7B, A9, FF, 66... 
[+]

Entropy:

7.6272

Packer / compiler:

ASProtect v1.2x (New Strain)

Code size:

172 KB (176,128 bytes)

The file rchelper.exe has been discovered within the following program.

Registry Clean Expert by iExpert Software

This is a 'registry cleaner' that is supposed to clean or fix a PC by removing invalid registry settings.

www.registry-clean.net

50% remove it

Remove rchelper.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.