Should I block it?

No, this file is 100% safe to run.

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegQueryInfoKeyW, CloseServiceHandle, OpenServiceW, OpenSCManagerW, DeleteService, ControlService, DeregisterEventSource, ReportEventW, RegisterEventSourceW, SetServiceStatus, RegEnumKeyExW, ChangeServiceConfig2W, CreateServiceW, RegisterServiceCtrlHandlerW, StartServiceCtrlDispatcherW

kernel32.dll

RaiseException, InitializeCriticalSection, DeleteCriticalSection, GetLastError, lstrcmpiW, CloseHandle, WaitForSingleObject, GetModuleFileNameW, Sleep, GetModuleHandleW, GetCurrentThreadId, CreateThread, CreateEventW, InterlockedIncrement, InterlockedDecrement, SetEvent, FreeLibrary, MultiByteToWideChar, SizeofResource, LoadResource, lstrlenW, LoadLibraryExW, GetCommandLineW, GetTempPathW, RtlCaptureContext, LoadLibraryW, GetTempFileNameW, CreateFileW, DeleteFileW, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, FlushFileBuffers, LCMapStringW, LCMapStringA, GetStringTypeW, GetStringTypeA, GetLocaleInfoA, GetConsoleMode, GetConsoleCP, SetFilePointer, GetOEMCP, GetACP, GetCPInfo, LoadLibraryA, HeapSize, FindResourceW, EnterCriticalSection, LeaveCriticalSection, GetVersionExA, WideCharToMultiByte, LocalFree, GetStartupInfoW, HeapAlloc, HeapFree, RtlUnwind, HeapReAlloc, VirtualProtect, VirtualAlloc, GetProcAddress, GetSystemInfo, VirtualQuery, GetModuleHandleA, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, OutputDebugStringA, SetUnhandledExceptionFilter, TerminateProcess, GetCurrentProcess

ole32.dll

CoTaskMemAlloc, CoTaskMemRealloc, CoRevokeClassObject, CoRegisterClassObject, CoInitializeSecurity, CoUninitialize, CoInitialize, StringFromGUID2, CoCreateInstance, CoSetProxyBlanket, CoTaskMemFree

user32.dll

UnregisterClassA, CharNextW, LoadStringW, CharUpperW, MessageBoxW, DispatchMessageW, TranslateMessage, PostThreadMessageW, GetMessageW

bthfilterhelper.exe

BthFilter Helper Service by CSR, plc

Remove bthfilterhelper.exe

Version:	1.0.0.373 built by: WinDDK
MD5:	d8abbcb42c550fd3a29dec6daabd0a87
SHA1:	3541951b6719cec6b0253b6540a421257b8d117e
SHA256:	297b7390963b78ebc166668e1d110983ca5a4f071027ca07ea48997f7ea5fd9c

Overview

bthfilterhelper.exe runs as a service under the name Bluetooth Feature Support (BthFilterHelper) with minimum LOCAL SERVICE privileges (predefined local account used by the service control manager) on the local PC and presents anonymous credentials on the network. This is typically installed with the program Vista Profile Pack published by Cambridge Silicon Radio. This particular version is usually found on Windows Vista (TM) Home Basic (6.0.6002.131072).

Details

File name:	bthfilterhelper.exe
Publisher:	CSR, plc
Product name:	BthFilter Helper Service
Typical file path:	C:\Program Files\csr\vista profile pack\bthfilterhelper.exe
Original name:	BthFilterHelper
File version:	1.0.0.373 built by: WinDDK
Product version:	1.0.0.373
Size:	124.5 KB (127,488 bytes)
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

Vista Profile Pack

Cambridge Silicon Radio

3% remove

“A solution for adding Bluetooth® wireless technology features to Microsoft Windows Vista operating system platforms. BCM1000-VPP enables PC OEMs and accessory manufacturers to quickly and easily add Bluetooth profiles, including mono and stereo audio features, and functionality to complete Microsoft's Bluetooth offering on Vista desktop and notebook PCs. This innovative solution is fully compliant with the Bluetooth profile specificatio...”

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'BthFilterHelper' (Bluetooth Feature Support)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00006934%	0.028634%
Kernel CPU:	0.00001705%	0.013761%
User CPU:	0.00005229%	0.014873%
Kernel CPU time:	16 ms/min	100,923,805ms/min
CPU cycles:	1,582/sec	17,470,203/sec
Memory
Private memory:	912 KB	21.59 MB
Private (maximum):	3.17 MB
Private (minimum):	2.55 MB
Non-paged memory:	912 KB	21.59 MB
Virtual memory:	28.2 MB	140.96 MB
Virtual memory (peak):	28.95 MB	169.69 MB
Working set:	2.65 MB	18.61 MB
Working set (peak):	3.2 MB	37.95 MB
Page faults:	961/min	2,039/min
I/O
I/O read transfer:	0 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	0 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	3	12
Handles:	53	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	"C:\Program Files\csr\vista profile pack\bthfilterhelper.exe"
Owner:	LOCAL SERVICE
Windows Service
Service name:	BthFilterHelper
Display name:	Bluetooth Feature Support
Description:	“This service facilitates Bluetooth features such as radio on/off. If the service is disabled certain Bluetooth features may not work reliably.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads