Should I block it?

98%

Yes, 98% block recommendation.

Possible reasons:

Multiple malware detections

Performance resource utilization

Additional versions

2,6,1519,190	6.49%
2,6,1339,144	20.78%
2,6,1125,80	1.30%
2,6,1095,52	28.57%
2,6,1095,52	14.29%
2,6,1070,41	5.19%
2,6,1040,25	9.09%
2,5,1005,80	5.19%
2,5,986,67	9.09%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegisterEventSourceA, GetLengthSid, ConvertSidToStringSidW, ControlService, StartServiceW, ChangeServiceConfig2W, CreateServiceW, RegEnumValueW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryInfoKeyW, RegEnumKeyExW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, GetTokenInformation, DuplicateTokenEx, CreateProcessAsUserW, OpenSCManagerW, OpenServiceW, QueryServiceConfigW, ChangeServiceConfigW, CloseServiceHandle, SetServiceStatus, RegEnumKeyW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, ConvertStringSecurityDescriptorToSecurityDescriptorA, GetSecurityDescriptorSacl, SetSecurityDescriptorSacl, RegSetValueExW, RegQueryValueExW, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, IsValidSid, DeregisterEventSource, InitializeAcl, ReportEventA, AddAce, OpenThreadToken, OpenProcessToken, GetSecurityInfo, GetAclInformation, GetAce, DeleteAce, SetSecurityInfo, RegDeleteKeyW, RegDeleteValueW, DeleteService

gdi32.dll

CreateDIBSection, CreateFontIndirectW, GetObjectW, DeleteObject, SelectObject, SetBkMode, SetTextColor, Rectangle, CreatePen, DeleteDC, RoundRect, CreateSolidBrush, CreatePatternBrush, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt

kernel32.dll

DllMain

ole32.dll

StringFromGUID2, CoInitializeEx, CoInitializeSecurity, CoInitialize, CoUninitialize, CoCreateInstance, CoSetProxyBlanket

rpcrt4.dll

UuidFromStringA

shell32.dll

SHFileOperationW, CommandLineToArgvW, SHGetSpecialFolderPathW

shlwapi.dll

PathFileExistsW, PathAddExtensionW, PathAppendW, PathFindExtensionW, PathRemoveExtensionW, PathStripPathW, StrCpyW, PathFindFileNameW, PathIsDirectoryW, PathRemoveFileSpecW, SHGetValueW, StrCmpNIW, PathIsRootW, PathRenameExtensionW, PathRemoveFileSpecA, PathStripToRootW, StrCmpW

user32.dll

EndPaint, BeginPaint, GetClientRect, GetWindowTextLengthW, GetWindowTextW, DrawTextW, GetSystemMetrics, LoadImageW, GetCursorPos, TrackMouseEvent, GetClassInfoExW, LoadCursorW, InvalidateRect, FindWindowW, DestroyWindow, RegisterClassExW, CreateWindowExW, GetUserObjectInformationW, GetProcessWindowStation, GetDesktopWindow, MessageBoxA, MessageBoxW, SetFocus, SetWindowPos, MapWindowPoints, GetMonitorInfoW, MonitorFromWindow, GetWindow, UnregisterClassA, GetTopWindow, ChildWindowFromPoint, KillTimer, ScreenToClient, ShowWindow, GetParent, GetSysColorBrush, GetSysColor, GetWindowRect, MoveWindow, EndDialog, GetDlgItem, GetDC, ReleaseDC, FillRect, SetLayeredWindowAttributes, LoadStringA, SendMessageW, SetWindowTextW, SetTimer, PeekMessageW, GetMessageW, TranslateMessage, DispatchMessageW, SystemParametersInfoW, GetActiveWindow, DialogBoxParamW, CallWindowProcW, GetWindowLongW, DefWindowProcW, SetWindowsHookExW, UnhookWindowsHookEx, SetWindowLongW, IsWindow

userenv.dll

CreateEnvironmentBlock

uxtheme.dll

DrawThemeBackground, IsThemeBackgroundPartiallyTransparent, OpenThemeData, CloseThemeData, DrawThemeParentBackground

version.dll

GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

winhttp.dll

WinHttpReceiveResponse, WinHttpAddRequestHeaders, WinHttpQueryDataAvailable, WinHttpReadData, WinHttpConnect, WinHttpSetStatusCallback, WinHttpOpenRequest, WinHttpGetIEProxyConfigForCurrentUser, WinHttpGetProxyForUrl, WinHttpCloseHandle, WinHttpOpen, WinHttpSendRequest, WinHttpQueryHeaders, WinHttpSetOption

wtsapi32.dll

WTSQueryUserToken

browserprotect.exe

Application Manager by Bit89 Inc. (Signed)

Remove browserprotect.exe

Version:	2,6,1125,80
MD5:	ca2e0aaa6943618108d786ff31848989
SHA1:	03624682714fbf40c451a318f57676c5b2bb2de9
SHA256:	63d0c8511f4163f32e5a553aa2951c993b418339655b84c45e879bbdad352fb3

Warning 22 antivirus scanners has detected malware.

What is browserprotect.exe?

The PerformerSoft Browser Manager (Application Manager) program classified mostly as exhibiting adware like actions, is bundled with PerformerSoft products including PC Performer. Browser Manager is designed to protect its bundled programs and make sure they remain installed or unchanged by other thrid party programs. The Browser Manager program was developed by Bit89 (Bit89.com) a know adware maker.

Overview

browserprotect.exe is malware that runs as a service under the name BrowserDefendert (FindAmo Manager) with extensive SYSTEM privileges (full administrator access) as a shared service. It is installed with a couple of know programs including Browser Manager published by Bit89 Inc, PC Performer Manager from Performersoft Inc and PC Performer Manager by Performersoft Inc. The file is digitally signed by Bit89 Inc. which was issued by the GoDaddy.com certificate authority (CA).

Details

File name:	browserprotect.exe
Publisher:	PerformerSoft LLC
Product name:	Application Manager
Typical file path:	C:\ProgramData\browserprotect\2.5.986.67\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\browserprotect.exe
File version:	2,6,1125,80
Size:	2.45 MB (2,569,168 bytes)
Certificate
Issued to:	Bit89 Inc.
Authority (CA):	GoDaddy.com
Effective date:	Tuesday, September 4, 2012
Expiration date:	Friday, September 4, 2015
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

Browser Manager

Bit89 Inc

85% remove

Browser Manager is a third party web browser add-in classified as a potentially unwanted application that used to be bundled with PerformerSoft products including PC Performer. At one point PerformerSoft was attempting to monetize their products with the Bit89 line of browser adware products (but this might not be the case any longer.) Bit89.com, the maker of this program is a known adware/malware distributor, so caution should be taken...

BrowserProtect

Bit89 Inc

88% remove

PerformerSoft BrowserProtect is a third party web browser add-in classified mostly as a potentially unwanted software application that used to be bundled with PerformerSoft products including PC Performer. The maker of this program is a known adware/malware distributor, so caution should be taken. The PerformerSoft BrowserProtect (Browser Manager) program classified mostly as exhibiting adware like actions, is bundled with PerformerSoft...

PC Performer Manager

Performersoft Inc

69% remove

PC Performer Manager is bundled with various PC Performer registry optimization products.

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' as a shared service by the Service Host (svchost.exe)

BrowserDefendert
'FindAmo Manager'
'BrowserProtect'

Malware detections

Based on 40+ industry antivirus scanners, 22 of them detected the following malware.

Antivirus engine	Engine version	Detection
Antiy Labs AVL	2.0.3.7	Trojan/Win32.Patched
avast!	8.0.1489.320	Win32:BProtect-D [Trj]
AVG	13.0.0.3169	Bprotect.E
Baidu Antivirus	3.5.1.41473	Adware.Win32.bProtector.45
Clam AntiVirus	0.97.3.0	Win.Adware.BProtector
Comodo Internet Security	17506	Application.Win32.Agent.~BPT
Dr.Web	8.13.9.28	Adware.BGuard.18
ESET NOD32	7.9190	a variant of Win32/bProtector.A
F-Secure	11.0.19100.45	Application:W32/BProtector.A
G Data	13.9.22	Win32.Application.BHO.A
K7 AntiVirus	9.174.10644	Trojan ( 0048c54b1 )
K7GW	9.174.10644	Trojan ( 0048c54b1 )
Kaspersky	12.0.0.1221	Trojan.Win32.Bromngr.m
McAfee	5.600.1067	Adware-Bprotect.b
McAfee Gateway Anti-Malware	v2013-dat	Artemis!CA2E0AAA6943
Microsoft Security Essentials	1.10201.0	TrojanDropper:Win32/Rotbrow.A
Panda Antivirus	10.0.3.5	Trj/dtcontx.I
Sophos	4.96.0	BProtector
Symantec	20131.1.5.61	Adware.GoonSquad
Trend Micro	9.740.0.1012	ADW_BPROTECT
Trend Micro HouseCall	9.700.0.1001	ADW_BPROTECT
VIPRE Antivirus	24798	Bprotector (fs)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00221263%	0.028634%
Kernel CPU:	0.00083479%	0.013761%
User CPU:	0.00137784%	0.014873%
Kernel CPU time:	152,803 ms/min	100,923,805ms/min
Memory
Private memory:	4.06 MB	21.59 MB
Private (maximum):	8.14 MB
Private (minimum):	7.13 MB
Non-paged memory:	4.06 MB	21.59 MB
Virtual memory:	223.1 MB	140.96 MB
Virtual memory (peak):	247.09 MB	169.69 MB
Working set:	7.45 MB	18.61 MB
Working set (peak):	8.23 MB	37.95 MB
Resource allocations
Threads:	18	12
Handles:	297	600
GUI GDI count:	9	103
GUI GDI peak:	10	142
GUI USER count:	9	49
GUI USER peak:	10	71

Process properties

Integrety level:	System
Platform:	32-bit
Command lines:	C:\ProgramData\browserprotect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\browserprotect.exe "C:\ProgramData\browserprotect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\browserprotect.exe" /protect
Owner:	SYSTEM
Windows Service
Service name:	FindAmo Manager
Display name:	BrowserDefendert
Description:	“Your browser protector service”
Type:	Win32ShareProcess
Parent processes:	services.exe (Services and Controller app by Microsoft) browserprotect.exe (Application Manager by Bit89 Inc.)

Threads