Application.Generic.1504997_c0cca4781e

by malwarelabrobot on November 23rd, 2015 in Malware Descriptions.

Application.Generic.1504997 (AdAware), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: c0cca4781ea12fe95bb4dc2829ab23fb
SHA1: e3bae1b6dc92eb04f12c4305d9b6db18387cb22b
SHA256: c804eb173a3ab73446c335a8b3a229a10e58b00d2dc6fb23f65785d850374b06
SSDeep: 3072:fM1BjoYNXoKDIJBXJPkbIdbWsqfW9X25rplo6sOvuP4hc1HGr M9pj8uZtMFP/ z:fMMYNXqBBTdrmlopP4hc1HGr ej8iy5i
Size: 172555 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: StdLib
Created at: 2014-10-07 07:40:10
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

WebProtectorPlus.exe:544
f4.exe:1032
f1.exe:1168
wmic.exe:1536
f5.exe:1432
schtasks.exe:188
schtasks.exe:1368
%original file name%.exe:2040
LiveUpdateWPP.exe:2000
LiveUpdateWPP.exe:240
find.exe:1152

The Application injects its code into the following process(es):

ntvdm.exe:1220

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process WebProtectorPlus.exe:544 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pin[1].gif (34 bytes)
%Program Files%\ThinkProtect\SetupComponents.exe (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The process f4.exe:1032 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\ThinkupWP\LiveUpdateWPP_uninstaller.exe (4164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns7.tmp (6 bytes)
%Program Files%\ThinkupWP\LiveUpdateWPP.exe (11656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\safed.dll (4092 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns6.tmp (6 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\safed.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns6.tmp (0 bytes)

The process f1.exe:1168 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\WebProtector\ToolbarData.ini (847 bytes)
%Program Files%\WebProtector\WebProtector.dll (3073 bytes)
%Program Files%\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp\System.dll (11 bytes)
%Program Files%\WebProtector\hotbtn.ico (1 bytes)
%Program Files%\WebProtector\btn.ico (1 bytes)
%Program Files%\WebProtector\WebProtector_new.dll (9765 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsiD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp\System.dll (0 bytes)

The process ntvdm.exe:1220 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ (4 bytes)
%WinDir%\Temp\scs11.tmp (10145 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%WinDir%\Temp\scs10.tmp (33880 bytes)
%Documents and Settings%\All Users\APPLICATION DATA (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pin[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (636 bytes)
%System%\wbem\Repository\FS (4 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Program Files%\WebProtector (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (848 bytes)
%Program Files%\ThinkProtect (4 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir% (1152 bytes)
%Documents and Settings%\All Users\Documents\My Music (4 bytes)
C:\$Directory (1200 bytes)
%System% (5832 bytes)
%WinDir%\Prefetch\F5.EXE-26097A9F.pf (24 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%WinDir%\Prefetch\IEXPLORE.EXE-27122324.pf (1072 bytes)
%Program Files% (8 bytes)
%Documents and Settings%\All Users\Documents (4 bytes)
%Documents and Settings%\%current user%\My Documents (4 bytes)
%Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
%System%\config (8 bytes)
%System%\wbem (864 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_668.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (4 bytes)
%Documents and Settings%\%current user%\Cookies (192 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)

The Application deletes the following file(s):

%WinDir%\Temp\scs10.tmp (0 bytes)
%WinDir%\Temp\scs11.tmp (0 bytes)

The process wmic.exe:1536 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\ThinkProtect\TempWmicBatchFile.bat (0 bytes)

The process f5.exe:1432 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\ThinkProtect\WebProtectorPlus.exe (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsC.tmp (6 bytes)
%Program Files%\ThinkProtect\uninstall.exe (877 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsExec.dll (6 bytes)
%Program Files%\ThinkProtect\uninst.bat (135 bytes)
%Program Files%\ThinkProtect\Setup32.bat (457 bytes)
%Program Files%\ThinkProtect\SetupOld32.bat (429 bytes)
%Program Files%\ThinkProtect\SetupVista64.bat (458 bytes)
%Program Files%\ThinkProtect\SetupOld64.bat (438 bytes)
%Program Files%\ThinkProtect\SetupVista32.bat (449 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
%Program Files%\ThinkProtect\Setup64.bat (466 bytes)
%Program Files%\ThinkProtect\verdata (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nshA.tmp (12336 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss9.tmp (0 bytes)

The process %original file name%.exe:2040 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr8.tmp (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f4.exe (46772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f1.exe (37172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\JkSO3fz.dll (3796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f5.exe (33956 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (34 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f1.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f4.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\JkSO3fz.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f5.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (0 bytes)

Registry activity

The process WebProtectorPlus.exe:544 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\ThinkProtect]
"SetupComponents.exe" = "SetupComponents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\WebProtectorPlus\Notify]
"iData" = "1448180088"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 D5 1D FA F8 E0 64 1F D1 9A 72 7B A5 59 1B 1D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process f4.exe:1032 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED EA 45 69 EC EE 6B 7D 14 63 A0 5B 75 E8 20 2A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"ID" = "{FF97EE74-8F16-4759-8B78-B60FC634A2F5}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"lcid" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"last" = "0"
"IDIR" = "%Program Files%\ThinkupWP"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"inter" = "43200"
"Src" = "9804"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"DisplayName" = "LiveUpdateWPP"
"UninstallString" = "%Program Files%\ThinkupWP\LiveUpdateWPP_uninstaller.exe"

The process f1.exe:1168 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Icon" = "%Program Files%\WebProtector\btn.ico"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayName" = "WebProtect IE"

[HKCR\Interface\{3050F25E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Default Visible" = "yes"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks]
"(Default)" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0]
"(Default)" = "sf_tblib"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "WebProtector"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoRepair" = "1"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance]
"(Default)" = ""

[HKLM\SOFTWARE\WebProtector]
"Path" = "%Program Files%\WebProtector"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ClsidExtension" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\HELPDIR]
"(Default)" = "%Program Files%\WebProtector"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ButtonText" = "Web Protector"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"URLInfoAbout" = "http://web-protector.net"
"DisplayIcon" = "%Program Files%\WebProtector\webprotector_uninstaller.exe"
"Publisher" = "WebProtector"
"UninstallString" = "%Program Files%\WebProtector\webprotector_uninstaller.exe"

[HKCR\Interface\{3050F1FF-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"HotIcon" = "%Program Files%\WebProtector\hotbtn.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayVersion" = "4.2.0.2645"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\ProgID]
"(Default)" = "WebProtector.toolbar.1"

[HKCR\Interface\{3050F1FF-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"CLSID" = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = ""

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "IToolbarMainBrowser"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = "Web Protector Toolbar"

[HKCR\Interface\{3050F25E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 06 33 AB 14 1C 2C 6C 3E 6E DC 2D B8 12 52 ED"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\0\win32]
"(Default)" = "%Program Files%\WebProtector\WebProtector.dll"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\VersionIndependentProgID]
"(Default)" = "WebProtector.toolbar"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"(Default)" = "%Program Files%\WebProtector\WebProtector.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoModify" = "1"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance\InitPropertyBag]
"URL" = "about:blank"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]

The process wmic.exe:1536 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 9F 39 C1 5F DE C9 4A 46 18 7A B7 9A A5 D8 04"

The process f5.exe:1432 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"DisplayName" = "Web Protector Plus (uninstall only)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"UninstallString" = "%Program Files%\ThinkProtect\uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 B7 72 6F F3 57 B7 4B D7 7D 45 B4 E2 07 9F 57"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WebProtectorPlus\Uninst]
"Install_Dir" = "%Program Files%\ThinkProtect"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Web Protector Plus Agent" = "%Program Files%\ThinkProtect\WebProtectorPlus.exe"

The process schtasks.exe:188 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 F8 B2 1A 49 0A FC 4E D3 7F 51 2F 36 3D 51 B9"

The process schtasks.exe:1368 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 D3 E1 3F 1A DD 77 AE E2 CD 04 E5 A6 AC F0 1C"

The process %original file name%.exe:2040 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 96 83 AF F1 BE CE 9D 05 AF 54 C3 18 78 C0 AD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse2.tmp\nsProcess.dll,"

[HKLM\SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgwNA=="

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "8C744716-9E7E-4880-A3EC-ECC3A28DDE2A"

The process LiveUpdateWPP.exe:2000 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 F2 82 BE BE C9 28 91 C9 BE 23 A0 21 AC A2 76"

The process LiveUpdateWPP.exe:240 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 19 64 2E F3 FA 89 F6 A2 8A DE 83 85 9E 25 C3"

The process find.exe:1152 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 B5 25 06 2D 0E 7A 9D 9A 2A 8D A9 1D 72 A3 4F"

Dropped PE files

MD5 File path
05450face243b3a7472407b999b03a72 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse2.tmp\nsProcess.dll
935bf11b38f5c90c69fff0730d716ac7 c:\Program Files\ThinkProtect\WebProtectorPlus.exe
8e3ce468b29c2e5419c24e4e1c060438 c:\Program Files\ThinkProtect\uninstall.exe
b3d29c207eff7bc122d334b7a138f30f c:\Program Files\ThinkupWP\LiveUpdateWPP.exe
dbb70815d2fa1a03d0cc7222383ee36f c:\Program Files\ThinkupWP\LiveUpdateWPP_uninstaller.exe
9f3d46fff506a4878d3ced167ffc84b3 c:\Program Files\WebProtector\WebProtector.dll
9f3d46fff506a4878d3ced167ffc84b3 c:\Program Files\WebProtector\WebProtector_new.dll
c2c4b5ce6c49484a1d5a05ba642a3b12 c:\Program Files\WebProtector\webprotector_uninstaller.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: wprotectplus4.2.0.2179in
Product Name: pwprotectplus4.2.0.2179inp
Product Version: 4.2.0.2179
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.2.0.2179
File Description:
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 23164 23552 4.45156 71ecbec9470d0e846ce5d68f3bbdbddf
.rdata 28672 4558 4608 3.62903 640f709ec19b4ed0455a4c64e5934d5e
.data 36864 108504 1024 3.4406 bc7151fcf37fc84430446d29785eaf5d
.ndata 147456 53248 0 0 d41d8cd98f00b204e9800998ecf8427e
.rsrc 200704 3008 3072 2.86808 3b597fdaba6058202819b6af26b3681f

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://stat.webprotectionpro.com/pin.gif?e=start&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&adv=&v=4.2.0.2179 37.58.109.2
hxxp://stat.webprotectionpro.com/node/?s=9804&br=4 37.58.109.2
hxxp://stat.webprotectionpro.com/c/LiveUpdateWPP_is.exe 37.58.109.2
hxxp://stat.webprotectionpro.com/node/?s=9804&br=5 37.58.109.2
hxxp://stat.webprotectionpro.com/c/SetupWPP.exe 37.58.109.2
hxxp://stat.webprotectionpro.com/node/?s=9804&br=1 37.58.109.2
hxxp://stat.webprotectionpro.com/c/webprotector_installer.exe 37.58.109.2
hxxp://stat.webprotectionpro.com/pin.gif?e=installer&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&adv=&v=4.2.0.2179 37.58.109.2
hxxp://stat.webprotectionpro.com/pin.gif?e=tracking&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&t=0&v=6.0.2900.5512&b=ie&ai=wppapp1.06&os=5.1x32&osv=2600 37.58.109.2
hxxp://stat.webprotectionpro.com/c/SetupComponents.exe 37.58.109.2
hxxp://webprotectionpro.com/c/SetupWPP.exe 37.58.109.2
hxxp://webprotectionpro.com/node/?s=9804&br=4 37.58.109.2
hxxp://webprotectionpro.com/c/LiveUpdateWPP_is.exe 37.58.109.2
hxxp://webprotectionpro.com/c/webprotector_installer.exe 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=tracking&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&t=0&v=6.0.2900.5512&b=ie&ai=wppapp1.06&os=5.1x32&osv=2600 37.58.109.2
hxxp://webprotectionpro.com/node/?s=9804&br=1 37.58.109.2
hxxp://webprotectionfree.com/c/SetupComponents.exe 37.58.109.2
hxxp://webprotectionpro.com/node/?s=9804&br=5 37.58.109.2


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)

Traffic

GET /pin.gif?e=start&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&adv=&v=4.2.0.2179 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: stat.webprotectionpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:17 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Sun, 22 Nov 2015 08:14:17 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=installer&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&adv=&v=4.2.0.2179 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: stat.webprotectionpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:38 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Sun, 22 Nov 2015 08:14:38 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..



GET /pin.gif?e=tracking&s=9804&i=8C744716-9E7E-4880-A3EC-ECC3A28DDE2A&t=0&v=6.0.2900.5512&b=ie&ai=wppapp1.06&os=5.1x32&osv=2600 HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: stat.webprotectionfree.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:38 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Sun, 22 Nov 2015 08:14:38 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..



GET /node/?s=9804&br=4 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionpro.com
Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/LiveUpdateWPP_is.exe
0......


GET /c/LiveUpdateWPP_is.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:17 GMT
Content-Type: application/octet-stream
Content-Length: 365343
Last-Modified: Tue, 21 Jul 2015 11:42:33 GMT
Connection: keep-alive
ETag: "55ae3029-5931f"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
......8...............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
..8............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

GET /node/?s=9804&br=5 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionpro.com
Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/SetupWPP.exe
0......


GET /c/SetupWPP.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:34 GMT
Content-Type: application/octet-stream
Content-Length: 257237
Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT
Connection: keep-alive
ETag: "54e9a18a-3ecd5"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........(............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...(............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /node/?s=9804&br=1 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionpro.com
Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:35 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/webprotector_installer.exe
0......


GET /c/webprotector_installer.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:35 GMT
Content-Type: application/octet-stream
Content-Length: 288291
Last-Modified: Wed, 14 Oct 2015 14:06:25 GMT
Connection: keep-alive
ETag: "561e6161-46623"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....n
3T.................\...........0.......p....@.........................
[email protected]........
...................................................................p..
.............................text...|Z.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /c/SetupComponents.exe HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: webprotectionfree.com
Cache-Control: no-cache


HTTP/1.1 403 Forbidden
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 22 Nov 2015 08:14:38 GMT
Content-Type: text/html
Content-Length: 177
Connection: keep-ali







The Application connects to the servers at the folowing location(s):







LiveUpdateWPP.exe_240:




.text
`.rdata
@.data
.rsrc
@.reloc
j.Yf;
_tcPVj@
.PjRW
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
%b %d %H : %M : %S %Y
%m / %d / %y
%I : %M : %S %p
%d / %m / %y
0123456789-
GetProcessWindowStation
operator
()$^.* ?[]|\-{},:=!
C:\src\similar\client-updater\bin\Release\LiveUpdateWPP.pdb
WTSAPI32.dll
USERENV.dll
WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpReadData
WINHTTP.dll
KERNEL32.dll
USER32.dll
ReportEventW
RegOpenKeyExW
RegCloseKey
ADVAPI32.dll
SHELL32.dll
GetCPInfo
GetProcessHeap
zcÁ
.?AVARegKey@@
.?AVASysWriteKey@@
.?AVASysRegKey@@
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
11
3O5X5
:%:):/:3:(?
1 1$1(1,1014181<1@1
: :@:\:`:
? ?$?(?,?0?4?`?
Ckernel32.dll
Emscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
USER32.DLL
portuguese-brazilian
{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}
{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}
urls
Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.
AgentTask::Execute :
MainTask::Execute
Software\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Mozilla/4.0 (compatible; __LOCAL__; __WIN_VER__) __DEFAULT_BROWSER__
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
Software\Clients\Windows\StartMenuInternet
http\shell\open\command
firefox
Firefox/
chrome
Chrome/
opera
OPERA
Windows NT
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
ul_cmd
%s : %s
2.1.1.22
%Program Files%\ThinkupWP\LiveUpdateWPP.exe
Maintains your Web Protector Plus synchronized.
LiveUpdateWPP.exe

WebProtectorPlus.exe_544:




.text
`.rdata
@.data
.rsrc
vSSSh
FTPjK
FtPj;
C.PjRV
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
portuguese-brazilian
operator
GetProcessWindowStation
USER32.DLL
X-X-X-XX-XXXXXX
SOFTWARE\WebProtectorPlus\Notify\
SOFTWARE\WebProtectorPlus\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SOFTWARE\Microsoft\Windows NT\
hXXp://stat.webprotectionfree.com/pin.gif?e=remove&s=
hXXp://stat.webprotectionfree.com/pin.gif?e=tracking&s=
Shell32.dll
hXXp://webprotectorplus.com
hXXp://webprotectionfree.com/c/SetupComponents.exe
SetupComponents.exe
Software\WebProtectorPlus\Notify
d:\Project\_Bibyte\WebProtectorPlus NO DLL\Release\WebProtectorPlus NO DLL.pdb
COMCTL32.dll
InternetOpenUrlA
WININET.dll
SHLWAPI.dll
KERNEL32.dll
USER32.dll
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
GetCPInfo
GetConsoleOutputCP
zcÁ
%Program Files%\ThinkProtect\WebProtectorPlus.exe
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
mscoree.dll
KERNEL32.DLL

ntvdm.exe_1220:




.text
`.data
.rsrc
KERNEL32.dll
NTDLL.DLL
ADVAPI32.dll
GDI32.dll
USER32.dll
SoftPC
mscoree.dll
Please contact the application's support team for more information.
GetProcessWindowStation
user32.dll
BIOS keyboard buffer overflow
hardware keyboard buffer overflow
%s Mouse %d.01 already installed
%s Mouse %d.01 installed
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
C:\IBMBIO.SYS
C:\IO.SYS
C:\IBMDOS.SYS
C:\MSDOS.SYS
\ntio404.sys
\ntio411.sys
\ntio412.sys
\ntio804.sys
\ntio.sys
VJOY.DLL
%s %lxh
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
\\.\$VDMLPT2
\\.\$VDMLPT3
\\.\$VDMLPT1
FONT.NT
\ega.cpi
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
Drive %c:
Incompatible DOS diskette, C H R N = %d %d %d %d
\\.\A:
\\.\?:
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
WINDOWS VMM 4.0
WINDOWS NT 3.1
WINDOWS 386 3.0
WINDOWS 286 3.0
\_default.pif
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
VrRemoveOpenNamedPipeInfo
VrConvertLocalNtPipeName
VrAddOpenNamedPipeInfo
VrIsNamedPipeHandle
VrIsNamedPipeName
VrWriteNamedPipe
VrReadNamedPipe
midiOutShortMsg
midiOutLongMsg
WINMM.DLL
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
NtDeviceIoControlFile failed %x
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
NTVDMD.DLL
Check Keyboard Status
\ntdos404.sys
\ntdos411.sys
\ntdos412.sys
\ntdos804.sys
\ntdos.sys
demDosDispCall %s
config.nt
PIPE
%c:%sNUL
Software\Microsoft\Windows\CurrentVersion\Setup
Unimplemented SVC %d
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
%s=%s%s /p %s\system32
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
KEYB
\KEYBOARD.SYS
\KEYJ31.SYS
\KEY02.SYS
\KEY01.SYS
\KEYAX.SYS
%s,%d,%s
\KB16.COM
DosKeybIDs
System\CurrentControlSet\Control\Keyboard Layout\
DosKeybCodes
00000409
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Broken pipe
Inappropriate I/O control operation
Operation not permitted
ega.rom
vga.rom
v7vga.rom
bios4.rom
bios1.rom
profile.spc
.spcprofile
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
CS:x IP:x OP:x x x x x
ntvdm.pdb
Ut.Ht$Ht
ItKIt9It.IIt
tK<%uAj
HHt7Ht.Ht
YYt%F
SSSSSh
s*f;O%s$
V<%ue
t.HtHHt(Ht
GetCPInfo
NtEnumerateValueKey
NtOpenKey
ntdll.dll
RegCloseKey
RegQueryInfoKeyA
RegOpenKeyExA
GetConsoleOutputCP
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
SetConsoleKeyShortcuts
VDMConsoleOperation
GetConsoleKeyboardLayoutNameA
EnumWindows
GetKeyState
VkKeyScanW
MapVirtualKeyA
GetKeyboardType
NtQueryValueKey
GetProcessHeap
ntvdm.exe
SoftPcEoi
cmdCheckTemp
cmdCheckTempInit
demIsShortPathName
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
$$$(((---222888???
!"#$%&'( 
SoftPC-AT Version 3
89:;<=>?
autoexec.nt
00030<0?0
30333<3?3
<0<3<<<?<
?0?3?<???
!"#$%&'()
Userenv.dll
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
%SystemRoot%
\System32\command.com
%System%\ntvdm.exe
\\.\B:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%
NTVDM.EXE
5.1.2600.5512 (xpsp.080413-2111)
Windows
Operating System
5.1.2600.5512
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.<The memory resources needed by NTVDM could not be allocated.
LAn installation file required by NTVDM is missing, execution must terminate.
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
16 bit Windows Subsystem
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate<The system cannot open %s port requested by the application.

ntvdm.exe_1220_rwx_00000000_00010000:




C:\PROGRA~1\THINKP~1\SETUPC~1.EXE
SETUPC~1EXE
."/\[]:|<> =;,
c:\wina20.386
%WinDir%\SYSTEM32\COUNTRY.SYS
89:;<=>?
1234567890-=
!@#$%^&*()_ 
789-456 1230.
!"#$%&,-./012
C:\PROGRA~1\THINKP~1
%WinDir%\SYSTEM32\COMMAND.COM
%File allocation table bad, drive %1
Invalid COMMAND.COM
!Press any key to continue . . .
Cannot execute %1
Error in EXE file
%WinDir%\TEMP\scs11.tmp
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
<hr><center>nginx/1.4.6 (Ubuntu)</center>
\COMMAND.COM
COMSPEC=\COMMAND.COM
BMicrosoft(R) Windows DOS
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
H [drive:]path Specifies the directory containing COMMAND.COM file.
N /MSG Specifies that all error messages be stored in memory. You
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
$B | (pipe)
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32
[]|<> =;"

ntvdm.exe_1220_rwx_00010000_00090000:




COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\TEMP\scs11.tmp
89:;<=>?
0WINDOWS MS-DOS STARTUP FILE
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0NTCMDPROMPT
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0CONFIG.NT OR OTHER STARTUP FILE.
0WANT THE SYSTEM TO SUPPORT. 1 <= ALTREGSETS <= 255. THE
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
D%WinDir%\SYSTEM32\HIMEM.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
S%WinDir%\SYSTEM32\COMMAND.COM
/P %WinDir%\SYSTEM32
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
%WinDir%\SYSTEM32\COUNTRY.SYS
[]|<> =;"
%WinDir%\TEMP\scs10.tmp
%WinDir%\SYSTEM32\COMMAND.COM
NTCMDPROMPTT
Unrecognized command in CONFIG.SYS
Insufficient memory for COUNTRY.SYS file
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
1234567890-=
!@#$%^&*()_ 
789-456 1230.
!"#$%&,-./012
00030<0?0
30333<3?3
<0<3<<<?<
?0?3?<???
Windows NT MS-DOS subsystem Mouse Driver
/)()(00)(
/@%}-{.Nb#b
!Press any key to continue . . .
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
$B | (pipe)
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32\DOSX
NT.EXE
C:\PROGRA~1\THINKP~1\SETUPC~1.EXE
nt.exe
DOSX.EXE

ntvdm.exe_1220_rwx_000A0000_00020000:




66666666
6666666
6666666666666666
6666666676666666
6666667076666666

ntvdm.exe_1220_rwx_000C9000_00013000:




COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
%System%\DOSX.EXE
%System%\mscdexnt.exe
VCDEX.DLL
%System%\redir
(load before dosx.exe)
C:\LANMAN.DOS
%System%\dosx
%System%\krnl386.exe
krnl386.exe
SYSTEM.INI

ntvdm.exe_1220_rwx_000E8000_00008000:




00030<0?0
30333<3?3
<0<3<<<?<
?0?3?<???
Windows NT MS-DOS subsystem Mouse Driver

ntvdm.exe_1220_rwx_00100000_00010000:




C:\PROGRA~1\THINKP~1\SETUPC~1.EXE
SETUPC~1EXE
."/\[]:|<> =;,
c:\wina20.386
%WinDir%\SYSTEM32\COUNTRY.SYS
89:;<=>?
1234567890-=
!@#$%^&*()_ 
789-456 1230.
!"#$%&,-./012
C:\PROGRA~1\THINKP~1
%WinDir%\SYSTEM32\COMMAND.COM
%File allocation table bad, drive %1
Invalid COMMAND.COM
!Press any key to continue . . .
Cannot execute %1
Error in EXE file
%WinDir%\TEMP\scs11.tmp
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
<hr><center>nginx/1.4.6 (Ubuntu)</center>
\COMMAND.COM
COMSPEC=\COMMAND.COM
BMicrosoft(R) Windows DOS
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
H [drive:]path Specifies the directory containing COMMAND.COM file.
N /MSG Specifies that all error messages be stored in memory. You
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
$B | (pipe)
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32
[]|<> =;"






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    WebProtectorPlus.exe:544
    f4.exe:1032
    f1.exe:1168
    wmic.exe:1536
    f5.exe:1432
    schtasks.exe:188
    schtasks.exe:1368
    %original file name%.exe:2040
    LiveUpdateWPP.exe:2000
    LiveUpdateWPP.exe:240
    find.exe:1152
    

    2. 

  2. Delete the original Application file.
    3. 

  3. Delete or disinfect the following files created/modified by the Application:
    

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pin[1].gif (34 bytes)
    %Program Files%\ThinkProtect\SetupComponents.exe (177 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Program Files%\ThinkupWP\LiveUpdateWPP_uninstaller.exe (4164 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\nsExec.dll (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns7.tmp (6 bytes)
    %Program Files%\ThinkupWP\LiveUpdateWPP.exe (11656 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\safed.dll (4092 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\ns6.tmp (6 bytes)
    %Program Files%\WebProtector\ToolbarData.ini (847 bytes)
    %Program Files%\WebProtector\WebProtector.dll (3073 bytes)
    %Program Files%\WebProtector\webprotector_uninstaller.exe (1279 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsyE.tmp\System.dll (11 bytes)
    %Program Files%\WebProtector\hotbtn.ico (1 bytes)
    %Program Files%\WebProtector\btn.ico (1 bytes)
    %Program Files%\WebProtector\WebProtector_new.dll (9765 bytes)
    %WinDir%\Temp\scs11.tmp (10145 bytes)
    %Documents and Settings%\%current user%\FAVORITES (4 bytes)
    %WinDir%\Temp\scs10.tmp (33880 bytes)
    %Documents and Settings%\All Users\APPLICATION DATA (4 bytes)
    %Program Files%\Internet Explorer (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (636 bytes)
    %System%\wbem\Repository\FS (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (848 bytes)
    %Documents and Settings%\All Users\Documents\My Music (4 bytes)
    C:\$Directory (1200 bytes)
    %WinDir%\Prefetch\F5.EXE-26097A9F.pf (24 bytes)
    %WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
    %WinDir%\Prefetch\IEXPLORE.EXE-27122324.pf (1072 bytes)
    %Documents and Settings%\%current user%\My Documents (4 bytes)
    %Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
    %System%\config (8 bytes)
    %Documents and Settings%\All Users\Start Menu (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
    %WinDir%\Temp\Perflib_Perfdata_668.dat (4 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
    %Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
    %Program Files%\ThinkProtect\TempWmicBatchFile.bat (0 bytes)
    %Program Files%\ThinkProtect\WebProtectorPlus.exe (9320 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsC.tmp (6 bytes)
    %Program Files%\ThinkProtect\uninstall.exe (877 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\nsExec.dll (6 bytes)
    %Program Files%\ThinkProtect\uninst.bat (135 bytes)
    %Program Files%\ThinkProtect\Setup32.bat (457 bytes)
    %Program Files%\ThinkProtect\SetupOld32.bat (429 bytes)
    %Program Files%\ThinkProtect\SetupVista64.bat (458 bytes)
    %Program Files%\ThinkProtect\SetupOld64.bat (438 bytes)
    %Program Files%\ThinkProtect\SetupVista32.bat (449 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
    %Program Files%\ThinkProtect\Setup64.bat (466 bytes)
    %Program Files%\ThinkProtect\verdata (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nshA.tmp (12336 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\nsProcess.dll (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsr8.tmp (156 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f4.exe (46772 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f1.exe (37172 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (34 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\JkSO3fz.dll (3796 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp\f5.exe (33956 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (34 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Web Protector Plus Agent" = "%Program Files%\ThinkProtect\WebProtectorPlus.exe"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now