Should I block it?
90% of PCs block this file from running.
Possible reason:
Multiple malware detections
Additional versions
(Note, the developer publishes each variation of this file with the same version, but the hashes are unique.)
 PE file structure
|
Show functions |
Import table
advapi32.dll
RegCloseKey, RegEnumKeyExW, CheckTokenMembership, RegOpenKeyExW, FreeSid, RegEnumValueW, AllocateAndInitializeSid, RegDeleteValueW, RegDeleteKeyW, RegQueryValueExW, RegCreateKeyExW, ConvertSidToStringSidW, IsValidSid, GetTokenInformation, OpenProcessToken, RegSetValueExW
kernel32.dll
DllMain
Export table
sprotector.dll
| MD5: | 5ad02ab70f681d5f2ab94892879938ff |
| SHA1: | 0cc909aba8ddb717772ce2589ad733ddd55d18b7 |
| SHA256: | c966888fd5008d25475dc61cb8cd5941850d2e4edf3e9c7809c18aba5bfe143a |
Warning 6 antivirus scanners has detected malware.
What is sprotector.dll?
SProtector has been detected as 'malware' by multiple antivirus products. TrendMicro classifies it as TROJ_GEN.RCBH1L8. ESET calls it a variant of Win32/SProtector.A. QuickHeal identifies SProtector.dll as Worm.SProtector.A3. Avast classifies it as a potentially unwanted program (PUP) Win32:SProtector-B [PUP] and DrWeb flags it as Adware.BGuard. The program, specifically the sprotector.dll file is loaded into Google Chrome and connects to the Internet.
Overview
sprotector.dll is malware that is loaded as dynamic link library that runs in the context of a process. This is typically installed with the program ContinueToSave 1.74 published by BetterSoft and is most likely removed by most users once installed (77% removed).
Details
| File name: | sprotector.dll |
| Typical file path: | C:\Program Files\ContinueToSave\sprotector.dll |
| Size: | 1.01 MB (1,057,280 bytes) |
| Digital DNA |
| File packed: | No |
| .NET CLR: | No |
More details
Programs
The following program will install this file
ContinueToSave from BetterSoft is an adware program in the form of a process and a web browser plugin. The Plugin is designed to monitor the user's search and browsing habits and deliver advertising by overwriting the content HTML within the user's web browser. The background service which is executed as a Windows scheduled task is designed to make sure the web browser plugin remains active as well as automatically keeps the software up...
Malware detections
Based on 40+ industry antivirus scanners, 6 of them detected the following malware.
| Antivirus engine | Engine version | Detection |
| avast! |
8.0.1489.320 |
Win32:SProtector-A [PUP] |
| AVG |
2014.0.3629 |
Sprotect.C |
| Comodo Internet Security |
16925 |
ApplicUnwnt |
| Dr.Web |
8.13.8.11 |
Adware.BGuard.11 |
| ESET NOD32 |
7.8790 |
a variant of Win32/SProtector.A |
| VIPRE Antivirus |
21402 |
Trojan.Win32.Generic!BT |
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Ultimate |
30.95% |
|
| Microsoft Windows XP |
28.57% |
|
| Windows 7 Home Premium |
26.19% |
|
| Windows 7 Professional |
4.76% |
|
| Windows Vista Home Premium |
4.76% |
|
| Windows 7 Home Basic |
4.76% |
|
Distribution by country
United States installs about 11.90% of sprotector.dll.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| ASUS |
23.53% |
|
| Dell |
15.69% |
|
| Hewlett-Packard |
13.73% |
|
| GIGABYTE |
13.73% |
|
| Acer |
7.84% |
|
| Sony |
7.84% |
|
| American Megatrends |
5.88% |
|
| Intel |
3.92% |
|
| Lenovo |
3.92% |
|
| Toshiba |
3.92% |
|
