Download for Windows.
One installer, two pieces: a background service that does the measuring and a desktop app that shows you the results. You need both, and the installer handles both.
Windows 10 or 11, 64-bit Intel or AMD. Installing requires administrator rights once; running it afterwards does not.
This installer is not code-signed, and Windows will say so.
Heads up. When you run the installer, Microsoft Defender SmartScreen will show a blue box reading “Windows protected your PC” and offer only a Don't run button. To continue you click More info, and then Run anyway. You will also get the usual yellow administrator prompt, because the installer registers a Windows service.
What the warning actually means
It means this file carries no code-signing certificate and Microsoft's reputation service has not seen it downloaded enough times to vouch for it. It does not mean anything was detected in it. It is the same warning every unsigned installer gets on its first day, and it is a warning worth taking seriously in general — which is exactly why we are not going to tell you to ignore it.
Why we shipped unsigned anyway
A code-signing identity has to be obtained, held securely and used consistently across the service binary, the app and the installer. Doing it makeshift — a self-signed certificate or a borrowed identity — produces a green tick that means nothing, which is worse than an honest warning.
Signing is a known gap with a plan behind it. Until it lands, this page tells you the truth about what you are clicking through.
Verify what you downloaded
Compare the checksum before you run it. In PowerShell:
Get-FileHash .\HelixInternetMonitor-1.0.0-x64-setup.exe -Algorithm SHA256Expected SHA-256: —
Antivirus may also object
A privileged service that opens raw sockets and sends ICMP is the exact shape endpoint-protection products flag on heuristics. Nothing is packed or obfuscated, and vendor allowlisting submissions are part of the signing work. If your product quarantines it, that is a false positive we would like to hear about.
What you need.
| Operating system | Windows 10 or Windows 11 |
|---|---|
| Architecture | x64 only. The installer refuses to run on 32-bit, and ARM64 is not built yet |
| WebView2 runtime | Ships with Windows 11 and current Windows 10. On an older Windows 10 build you may need to install it yourself — the installer does not fetch it in this version |
| Privileges | Administrator to install. The desktop app itself never runs elevated, and measuring needs no elevation |
| Account | None. Cloud sync is off until you enrol the device yourself |
| macOS, Linux, mobile | Not available. There is no agent for them in this release |
What the installer does to your machine.
It installs
- Two binaries into %PROGRAMFILES%\Helix — an existing install location is reused
- A Windows service, HelixCoreService, set to start automatically as LocalSystem
- A Start Menu shortcut, and a desktop shortcut if you tick it
- An Add/Remove Programs entry, so it uninstalls the ordinary way
Upgrading over an existing install
The installer deregisters the previous service before it overwrites the binary — a running service holds an open handle to its own image, so the order matters. Your measurement history is not touched.
Silent install
For a scripted or managed rollout:
HelixInternetMonitor-1.0.0-x64-setup.exe /S
"C:\Program Files\Helix\uninstall.exe" /SMSI and MSIX packaging for Intune and Group Policy is not in this release.
Uninstalling
Stops and deregisters the service, removes the shortcuts, binaries and registry entries — and deliberately leaves %PROGRAMDATA%\Helix in place. That folder holds your measurement history, and an uninstall is not a request to destroy it; a reinstall picks it back up. Delete it yourself for a clean slate.
Why there is a background service at all.
So monitoring does not depend on you looking
The measurement engine has to be running when the outage happens, which is usually not while the window is open. A service starts with the machine and keeps a continuous record.
So the app never needs elevation
The service is privileged; the desktop app is not, and cannot be made to be. They talk over a local named pipe whose permissions grant access to interactive users on this machine and nothing wider. The app can view and configure; it cannot make the service run anything.
Installed it?
The agent starts measuring immediately. Connecting it to the cloud dashboard is a separate, optional step — and sharing with an ISP is a third one.