Should I block it?

98%

Yes, 98% block recommendation.

Possible reasons:

Multiple malware detections

Performance resource utilization

Additional versions

2,6,1519,190	6.49%
2,6,1339,144	20.78%
2,6,1125,80	1.30%
2,6,1095,52	28.57%
2,6,1095,52	14.29%
2,6,1070,41	5.19%
2,6,1040,25	9.09%
2,5,1005,80	5.19%
2,5,986,67	9.09%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Child process

schtasks.exe (Task Scheduler Configuration Tool by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegisterEventSourceA, GetLengthSid, ConvertSidToStringSidW, ControlService, StartServiceW, ChangeServiceConfig2W, CreateServiceW, RegEnumValueW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryInfoKeyW, RegEnumKeyExW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, GetTokenInformation, DuplicateTokenEx, CreateProcessAsUserW, OpenSCManagerW, OpenServiceW, QueryServiceConfigW, ChangeServiceConfigW, CloseServiceHandle, SetServiceStatus, RegEnumKeyW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, ConvertStringSecurityDescriptorToSecurityDescriptorA, GetSecurityDescriptorSacl, SetSecurityDescriptorSacl, RegSetValueExW, RegQueryValueExW, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, IsValidSid, DeregisterEventSource, InitializeAcl, ReportEventA, AddAce, OpenThreadToken, OpenProcessToken, GetSecurityInfo, GetAclInformation, GetAce, DeleteAce, SetSecurityInfo, RegDeleteKeyW, RegDeleteValueW, DeleteService

gdi32.dll

CreateDIBSection, CreateFontIndirectW, GetObjectW, DeleteObject, SelectObject, SetBkMode, SetTextColor, Rectangle, CreatePen, DeleteDC, RoundRect, CreateSolidBrush, CreatePatternBrush, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt

kernel32.dll

DllMain

ole32.dll

StringFromGUID2, CoInitializeEx, CoInitializeSecurity, CoInitialize, CoUninitialize, CoCreateInstance, CoSetProxyBlanket

rpcrt4.dll

UuidFromStringA

shell32.dll

SHFileOperationW, CommandLineToArgvW, SHGetSpecialFolderPathW

shlwapi.dll

PathFileExistsW, PathAddExtensionW, PathAppendW, PathFindExtensionW, PathRemoveExtensionW, PathStripPathW, StrCpyW, PathFindFileNameW, PathIsDirectoryW, PathRemoveFileSpecW, SHGetValueW, StrCmpNIW, PathIsRootW, PathRenameExtensionW, PathRemoveFileSpecA, PathStripToRootW, StrCmpW

user32.dll

EndPaint, BeginPaint, GetClientRect, GetWindowTextLengthW, GetWindowTextW, DrawTextW, GetSystemMetrics, LoadImageW, GetCursorPos, TrackMouseEvent, GetClassInfoExW, LoadCursorW, InvalidateRect, FindWindowW, DestroyWindow, RegisterClassExW, CreateWindowExW, GetUserObjectInformationW, GetProcessWindowStation, GetDesktopWindow, MessageBoxA, MessageBoxW, SetFocus, SetWindowPos, MapWindowPoints, GetMonitorInfoW, MonitorFromWindow, GetWindow, UnregisterClassA, GetTopWindow, ChildWindowFromPoint, KillTimer, ScreenToClient, ShowWindow, GetParent, GetSysColorBrush, GetSysColor, GetWindowRect, MoveWindow, EndDialog, GetDlgItem, GetDC, ReleaseDC, FillRect, SetLayeredWindowAttributes, LoadStringA, SendMessageW, SetWindowTextW, SetTimer, PeekMessageW, GetMessageW, TranslateMessage, DispatchMessageW, SystemParametersInfoW, GetActiveWindow, DialogBoxParamW, CallWindowProcW, GetWindowLongW, DefWindowProcW, SetWindowsHookExW, UnhookWindowsHookEx, SetWindowLongW, IsWindow

userenv.dll

CreateEnvironmentBlock

uxtheme.dll

DrawThemeBackground, IsThemeBackgroundPartiallyTransparent, OpenThemeData, CloseThemeData, DrawThemeParentBackground

version.dll

GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

winhttp.dll

WinHttpReceiveResponse, WinHttpAddRequestHeaders, WinHttpQueryDataAvailable, WinHttpReadData, WinHttpConnect, WinHttpSetStatusCallback, WinHttpOpenRequest, WinHttpGetIEProxyConfigForCurrentUser, WinHttpGetProxyForUrl, WinHttpCloseHandle, WinHttpOpen, WinHttpSendRequest, WinHttpQueryHeaders, WinHttpSetOption

wtsapi32.dll

WTSQueryUserToken

browserprotect.exe

Application Manager by Bit89 Inc. (Signed)

Remove browserprotect.exe

Version:	2,6,1339,144
MD5:	981794879e8fd26cdd6abcff3f3f65ef
SHA1:	efe10525395591ca4fb6ec083f6f22c9e0db2d9d
SHA256:	99bac75534f35115354cdc5020ef493350fe9798f3a9eb56e944d771132884a4

Warning 25 antivirus scanners has detected malware.

What is browserprotect.exe?

The PerformerSoft Browser Manager (Application Manager) program classified mostly as exhibiting adware like actions, is bundled with PerformerSoft products including PC Performer. Browser Manager is designed to protect its bundled programs and make sure they remain installed or unchanged by other thrid party programs. The Browser Manager program was developed by Bit89 (Bit89.com) a know adware maker.

Overview

browserprotect.exe is malware that runs as a service under the name BrowserDefendert (FindAmo Manager) with extensive SYSTEM privileges (full administrator access) as a shared service. It is installed with a couple of know programs including BrowserProtect published by Bit89 Inc, bProtector for Windows from PerformerSoft LLC and bProtector for Windows by PerformerSoft LLC. The file is digitally signed by Bit89 Inc. which was issued by the GoDaddy.com certificate authority (CA).

Details

File name:	browserprotect.exe
Publisher:	PerformerSoft LLC
Product name:	Application Manager
Typical file path:	C:\ProgramData\browserprotect\2.5.986.67\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\browserprotect.exe
File version:	2,6,1339,144
Size:	2.94 MB (3,085,264 bytes)
Build date:	6/3/2013 4:57 PM
Certificate
Issued to:	Bit89 Inc.
Authority (CA):	GoDaddy.com
Effective date:	Tuesday, September 4, 2012
Expiration date:	Friday, September 4, 2015
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

BrowserProtect

Bit89 Inc

66% remove

The PerformerSoft BrowserProtect (Browser Manager) program classified mostly as exhibiting actions, is bundled with PerformerSoft products including PC Performer. BrowserProtect is designed to protect its bundled programs and make sure they remain installed or unchanged by other thrid party programs. The BrowserProtect program was developed by Bit89 (Bit89.com) a known adware maker. PerformerSoft BrowserProtect is a third party web bro...

Browser Manager

Bit89 Inc

85% remove

Browser Manager is a third party web browser add-in classified as a potentially unwanted application that used to be bundled with PerformerSoft products including PC Performer. At one point PerformerSoft was attempting to monetize their products with the Bit89 line of browser adware products (but this might not be the case any longer.) Bit89.com, the maker of this program is a known adware/malware distributor, so caution should be taken...

PC Performer Manager

Performersoft Inc

69% remove

PC Performer Manager is bundled with various PC Performer registry optimization products.

bProtector for Windows

PerformerSoft LLC

86% remove

bProtector for Windows (also known as BrowserDefender) is a potentially unwanted application that is typically bundled with shareware third party installers. bProtector will prevent various security and other web browser extensions and toolbars from running. This service will prevent other applications (and sometimes the user) from modifying the web browser's home and search pages as well as the search provider set by the bProtector pr...

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' as a shared service by the Service Host (svchost.exe)

BrowserDefendert
'FindAmo Manager'
'BrowserProtect'

Malware detections

Based on 40+ industry antivirus scanners, 25 of them detected the following malware.

Antivirus engine	Engine version	Detection
Avira AntiVir	7.11.105.38	APPL/BProtector.Gen
Antiy Labs AVL	2.0.3.7	AdWare/Win32.Bromngr
avast!	8.0.1489.320	Win32:BProtect-A [PUP]
AVG	13.0.0.3169	Generic5.AFSW
BitDefender	7.2	Application.BProtector.A
CAT Quick Heal	9.13.12.00	AdWare.Bromngr.j (Not a Virus)
Comodo Internet Security	17020	Application.Win32.Bprotect.f
ESET NOD32	7.8855	a variant of Win32/bProtector.A
Fortinet	5.1.147.0	Adware/Bprotect
F-Secure	11.0.19100.45	Application.BProtector.A
G Data	13.9.22	Application.BProtector.A
K7 AntiVirus	9.172.9720	Adware
K7GW	12.7.0.14	Adware
Kaspersky	9.0.0.837	not-a-virus:AdWare.Win32.Bromngr.j
Malwarebytes	1.75.0.1	PUP.Optional.PerformerSoft.A
McAfee	5.600.1067	Adware-Bprotect
McAfee Gateway Anti-Malware	v2013-dat	Adware-Bprotect
eScan by MicroWorld	12.0.250.0	Application.BProtector.A
PC Tools	9.0.0.2	Adware.GoonSquad!rem
Sophos	4.93.0	BProtector
Symantec	20131.1.5.61	Adware.GoonSquad
Trend Micro	9.740.0.1012	ADW_GOONSQUAD
Trend Micro HouseCall	9.700.0.1001	TROJ_GEN.R0CBH05HT13
Vba32 AntiVirus	3.12.24.3	AdWare.Bromngr
VIPRE Antivirus	21938	Adware.GoonSquad

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00630147%	0.028634%
Kernel CPU:	0.00174375%	0.013761%
User CPU:	0.00455772%	0.014873%
Kernel CPU time:	1,214,342,311 ms/min	100,923,805ms/min
CPU cycles:	11,054,022/sec	17,470,203/sec
Context switches:	15/sec	284/sec
Memory
Private memory:	4.34 MB	21.59 MB
Private (maximum):	7.43 MB
Private (minimum):	5.13 MB
Non-paged memory:	4.34 MB	21.59 MB
Virtual memory:	164.83 MB	140.96 MB
Virtual memory (peak):	189.95 MB	169.69 MB
Working set:	5.77 MB	18.61 MB
Working set (peak):	7.51 MB	37.95 MB
Page faults:	21,158,366/min	2,039/min
I/O
I/O read transfer:	370 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	58 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	328 Bytes/sec	448.09 KB/min
I/O other operations:	6/sec	1,671/min
Resource allocations
Threads:	12	12
Handles:	260	600
GUI GDI count:	8	103
GUI GDI peak:	10	142
GUI USER count:	4	49
GUI USER peak:	6	71

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command lines:	C:\ProgramData\browserprotect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\browserprotect.exe "C:\ProgramData\browserprotect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\browserprotect.exe" /protect "C:\Documents and Settings\user\Application data\browserprotect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\browserprotect.exe" "C:\Documents and Settings\user\Application data\browserprotect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\browserprotect.exe" /protect "C:\ProgramData\findamo manager\2.6.1339.144\{6966eb49-dd7d-4549-9612-4e6fdf35cbad}\findamomngr.exe" "C:\ProgramData\findamo manager\2.6.1339.144\{6966eb49-dd7d-4549-9612-4e6fdf35cbad}\findamomngr.exe" /protect
Owner:	SYSTEM
Windows Service
Service name:	FindAmo Manager
Display name:	BrowserDefendert
Description:	“Your browser protector service”
Type:	Win32ShareProcess
Parent processes:	browserprotect.exe (Application Manager by Bit89 Inc.) services.exe (by Microsoft)

Threads