SteamHelper.exe runs when my computer boots - why?

[ThreeSon]

I do not have Steam set to autostart, but on my most recent reboot of my computer (Windows 7), SteamHelper.exe was running. What does this program do when the Steam client isn't running?

Edit: I finally got an answer from Steam support - http://steamcommunity.com/discussions/forum/1/412448792366881960/#c371918937253993757

[ThreeSon]

Well I found the exe on my hard drive - it's in appdata\roaming\steam folder. So as long as that's an official Steam folder I'm not that worried, but I'd still like to know why it runs on bootup if Steam isn't running.

I think I'll start with a Steam support ticket before searching for malware possibilities.

[Mattio]

Originally posted by ThreeSon:

Well I found the exe on my hard drive - it's in appdata\roaming\steam folder. So as long as that's an official Steam folder I'm not that worried, but I'd still like to know why it runs on bootup if Steam isn't running.

I think I'll start with a Steam support ticket before searching for malware possibilities.

Just because the file is in a folder called Steam, doesn't make it official, nor does it make the file legitimate if it's in the actual Steam folder.
I've never seen this file/process before, not on my Linux nor Windows, and my friend on Windows also checked and nothing.

I wouldn't wait for a ticket when you could be infected, run malwarebytes first before anything.

[ThreeSon]

I ran the containing folder through SpyBot and Microsoft Security Essentials, both of which showed it as clean. According to this page[www.freefixer.com] the file is a legit Valve executable (the version number also matches with the file on my computer).

So are you saying there is no SteamHelper.exe file anywhere on your computer? What version of Windows are you running?

[ThreeSon]

Originally posted by fauxtronic:

Alternatively, Microsoft make a program called autoruns which helps you easily identify programs, libraries and services that start with Windows (among other things).

https://technet.microsoft.com/en-gb/sysinternals/bb963902.aspx

If you use it, be aware that many of the things listed are essential for Windows to run normally. I'm only suggesting checking it out to see if it helps you track down the reason SteamHelper.exe launches when you reboot your system.

This program shows SteamHelper under the Scheduled Tasks section, along with a few other tasks like my SpyBot malware scanner. I'm not sure what I should learn from this though. Does that mean the software is okay because it's listed under Scheduled Tasks? The only odd thing here is that the "Timestamp" for SteamHelper is 6/19/1992, which seems odd since the file was placed on my computer last October (according to the file properties).

[ThreeSon]

Here is the VirusTotal report, which includes MalwareBytes: https://www.virustotal.com/en/analisis/file/414bc2153f5aab78b2ff9cc0fc9bc2951cf28fdbf0db01a8420f6ff7e3088367/analysis/

A few scanners report it as malicious, but all the rest including Malware Bytes say it is okay.

Could you confirm your version of Windows for me? If you are using Windows 7, and the SteamHelper.exe file is not located anywhere in your appdata\roaming\Steam folder, that would be more confirmation that it is a bad file than any malware scan.

[ThreeSon]

I installed and ran Malware Bytes on that appdata\roaming\steam folder. These are the results:

snip

(end)


I have no idea how to read any of this. Does that mean it's a malicious process and I should remove it? Would that even make a difference if it is malicious?

[Mattio]

Originally posted by ThreeSon:

Could you confirm your version of Windows for me?

(I know I go on a bit, but just covering as much as I can to show this thing is not officially Steam)

Windows 7, and Windows 10(friend). But they're pretty much the exact same files across all versions of Windows. Steam's files and executables are pretty much the same for Linux too and I also don't have that file.

I have found no reference to Steam officially using the ../appdata/roaming/steam directory. Doesn't exist for me, friend, or shows any google results. Clean install doesn't make it. Any official Steam exe's would be in the main directory too, so i'd confidently say it is not legitimate part of Steam. What it does is unknown to me, but assume it's malware regardless.


The above seems strange, the "SteamClient" is not in my Tasks, nor friends. We just tested a fresh steam install, nothing goes into Tasks.
Steam is launched by the startup registry key not by the task scheduler. So whatever that "SteamClient" is, it's certainly not related to official Steam.


Run your malwarebytes on every directory, do the full scan. Then at the end let it delete what it finds, after that restart your PC and find out if it's still launching on startup. If it was successfully removed then you should be ok from now on, but I have no idea what that program could have done to your PC.
The only sure way to be safe is to format and re-install Windows. Personally, after being infected with anything I'd be reinstalling my OS, but I know that's not always desirable.

[ThreeSon]

Well, thanks for all your help. I also checked the hash of my SteamHelper file with the one on freefixer[www.freefixer.com], and they match up exactly. So I am taking that to mean that unless Freefixer has been duped somehow, the file on my computer was definitely created by Valve.

I'll run a full Marlware Bytes scan on my machine, but I'll probably only remove the components it identifies as definitely hazardous until I get an answer from Steam support. My feeling now is that it is unlikely this particular file has anything to do with malware. I'm now just trying to find out how it got into my computer's startup process.

[♥♥♥ ваших мамок]

kk

[wuddih]

steamwebhelper.exe (cfe render process, dispalys websites in steam client)
wow_helper.exe (cfe pluginhelper for vista or lower)

a SteamHelper.exe does not exist in any version of Steam.
Steam also does not use appdata/roaming on win7 or later. Steam just uses appdata/local

that fixer website, is nonsense.

[ThreeSon]

Alright. Well I quarantined it with Malware Bytes for now, and I'll update here when (if) I get a definitive answer from Valve.

[ThreeSon]

Three weeks later I finally got a clear answer from Steam support. SteamHelper.exe is not a Valve-created executable program. So if you do a search of your hard drive (particularly within the Users\user name\AppData folder) and that file shows up, get rid of it.

[brenling12]

very old but, this might actually be the steam client webhelper lol

[Bill]

This thread was quite old before the recent post, so we're locking it to prevent confusion.