Should I block it?

98%

Yes, 98% block recommendation.

Possible reasons:

Multiple malware detections

Performance resource utilization

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Child process

schtasks.exe (Manages scheduled tasks by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryInfoKeyW, RegEnumKeyExW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, GetTokenInformation, DuplicateTokenEx, CreateProcessAsUserW, SetServiceStatus, RegEnumKeyW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, ConvertStringSecurityDescriptorToSecurityDescriptorA, GetSecurityDescriptorSacl, SetSecurityDescriptorSacl, RegSetValueExW, RegQueryValueExW, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegEnumValueW, CreateServiceW, ChangeServiceConfig2W, RegDeleteValueW, RegDeleteKeyW, SetSecurityInfo, DeleteAce, GetAce, GetAclInformation, GetSecurityInfo, OpenProcessToken, StartServiceW, OpenSCManagerW, OpenServiceW, ControlService, DeleteService, CloseServiceHandle, RegisterEventSourceA, ReportEventA, DeregisterEventSource, IsValidSid, ConvertSidToStringSidW, GetLengthSid, InitializeAcl, OpenThreadToken, AddAce

gdi32.dll

CreateFontIndirectW, GetObjectW, DeleteObject, SelectObject, SetBkMode, SetTextColor, Rectangle, CreatePen, DeleteDC, RoundRect, CreateSolidBrush, CreatePatternBrush, CreateCompatibleDC, CreateCompatibleBitmap, CreateDIBSection, BitBlt

kernel32.dll

DllMain

ole32.dll

StringFromGUID2, CoInitializeEx, CoInitializeSecurity, CoInitialize, CoUninitialize, CoCreateInstance, CoSetProxyBlanket

rpcrt4.dll

UuidFromStringA

shell32.dll

SHGetSpecialFolderPathW, SHFileOperationW, CommandLineToArgvW

shlwapi.dll

SHGetValueW, StrCmpW, PathRemoveFileSpecW, PathIsDirectoryW, PathFindFileNameW, StrCpyW, PathStripPathW, PathRemoveExtensionW, PathFindExtensionW, PathAppendW, PathAddExtensionW, PathFileExistsW, PathStripToRootW, PathRemoveFileSpecA, PathRenameExtensionW, PathIsRootW, StrCmpNIW

user32.dll

GetWindowLongW, CallWindowProcW, SystemParametersInfoW, DispatchMessageW, TranslateMessage, DefWindowProcW, MessageBoxA, GetClassInfoExW, LoadCursorW, IsWindow, FindWindowW, DestroyWindow, RegisterClassExW, CreateWindowExW, GetUserObjectInformationW, GetProcessWindowStation, GetDesktopWindow, MessageBoxW, SetFocus, SetWindowPos, MapWindowPoints, GetMonitorInfoW, MonitorFromWindow, GetWindow, UnregisterClassA, SetWindowsHookExW, UnhookWindowsHookEx, LoadStringA, SetWindowLongW, GetMessageW, PeekMessageW, SetTimer, SetWindowTextW, SendMessageW, GetDlgItem, EndDialog, MoveWindow, ScreenToClient, ShowWindow, KillTimer, ChildWindowFromPoint, GetTopWindow, TrackMouseEvent, GetCursorPos, DialogBoxParamW, LoadImageW, GetSystemMetrics, DrawTextW, GetWindowTextW, GetWindowTextLengthW, GetClientRect, GetActiveWindow, SetLayeredWindowAttributes, FillRect, ReleaseDC, GetDC, GetWindowRect, GetSysColor, GetSysColorBrush, GetParent, InvalidateRect, EndPaint, BeginPaint

userenv.dll

CreateEnvironmentBlock

uxtheme.dll

CloseThemeData, OpenThemeData, IsThemeBackgroundPartiallyTransparent, DrawThemeBackground, DrawThemeParentBackground

version.dll

GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

winhttp.dll

WinHttpReceiveResponse, WinHttpAddRequestHeaders, WinHttpQueryDataAvailable, WinHttpOpen, WinHttpConnect, WinHttpSetStatusCallback, WinHttpReadData, WinHttpSendRequest, WinHttpOpenRequest, WinHttpQueryHeaders, WinHttpSetOption, WinHttpGetIEProxyConfigForCurrentUser, WinHttpGetProxyForUrl, WinHttpCloseHandle

wtsapi32.dll

WTSQueryUserToken

videomngr.exe

Application Manager by ForwardTech Inc (Signed)

Remove videomngr.exe

Version:	2,4,897,175
MD5:	a3333663e400b6327e0a0b98cad20a24
SHA1:	9b8a626ded941d373951f2ada71cf4c7aaacb806
SHA256:	0e368cf7100fc8721384b317ce0bd49feeca72506a66a672dd753744c1960927

Warning 12 antivirus scanners has detected malware.

What is videomngr.exe?

The PerformerSoft Browser Manager (Application Manager) program classified mostly as exhibiting adware like actions, is bundled with PerformerSoft products including PC Performer. Browser Manager is designed to protect its bundled programs and make sure they remain installed or unchanged by other thrid party programs. The Browser Manager program was developed by Bit89 (Bit89.com) a know adware maker.

About videomngr.exe (from ForwardTech Inc)

“Automatically optimize your registry settings to prevent crashes and help speed up your computer. Manage start up – goes to the Start Up Manager and shows the programs that are loaded when Windows s”

Details

File name:	videomngr.exe
Publisher:	PerformerSoft LLC
Product name:	Application Manager
Typical file path:	C:\ProgramData\video performer manager\2.4.897.175\{16cdff19-861d-48e3-a751-d99a27784753}\videomngr.exe
File version:	2,4,897,175
Size:	2.29 MB (2,400,800 bytes)
Certificate
Issued to:	ForwardTech Inc
Authority (CA):	GoDaddy.com
Effective date:	Wednesday, September 12, 2012
Expiration date:	Saturday, September 12, 2015
Digital DNA
File packed:	No
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' as a shared service by the Service Host (svchost.exe)

'PC Performer Manager'
Browser Manager

Malware detections

Based on 40+ industry antivirus scanners, 12 of them detected the following malware.

Antivirus engine	Engine version	Detection
AVG	2014.0.3629	Generic5.SCR
BitDefender	7.2	Trojan.BHO.BProtector.A
ESET NOD32	7.7949	a variant of Win32/bProtector.A
Fortinet	5.0.26.0	W32/BProtector.A
F-Secure	11.0.19020.35	Trojan.BHO.BProtector.A
G Data	13.4.22	Trojan.BHO.BProtector.A
eScan by MicroWorld	12.0.250.0	Trojan.BHO.BProtector.A
nProtect	2013-01-30.01	Trojan.BHO.BProtector.A
Trend Micro	9.740.0.1011	ADW_BROMNGR
Trend Micro HouseCall	9.700.0.1001	ADW_BROMNGR
Vba32 AntiVirus	3.12.18.5	AdWare.Bromngr.a
VIPRE Antivirus	15292	Bprotector (fs)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.01217324%	0.028634%
Kernel CPU:	0.00856573%	0.013761%
User CPU:	0.00360751%	0.014873%
Kernel CPU time:	217,928,548 ms/min	100,923,805ms/min
CPU cycles:	17,187,860/sec	17,470,203/sec
Memory
Private memory:	2.74 MB	21.59 MB
Private (maximum):	5.77 MB
Private (minimum):	2.95 MB
Non-paged memory:	2.74 MB	21.59 MB
Virtual memory:	160.28 MB	140.96 MB
Virtual memory (peak):	179.62 MB	169.69 MB
Working set:	3.84 MB	18.61 MB
Working set (peak):	6.27 MB	37.95 MB
Page faults:	7,451,980/min	2,039/min
I/O
I/O read transfer:	113 KB/sec	1.02 MB/min
I/O read operations:	12/sec	343/min
I/O write transfer:	1.78 KB/sec	274.99 KB/min
I/O write operations:	2/sec	227/min
I/O other transfer:	7.9 KB/sec	448.09 KB/min
I/O other operations:	571/sec	1,671/min
Resource allocations
Threads:	11	12
Handles:	236	600
GUI GDI count:	9	103
GUI GDI peak:	10	142
GUI USER count:	10	49
GUI USER peak:	10	71

Process properties

Integrety level:	System
Platform:	32-bit
Command lines:	"C:\ProgramData\browser manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe" "C:\ProgramData\browser manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe" /protect "C:\ProgramData\pc performer manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\pcpmngr.exe" "C:\ProgramData\pc performer manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\pcpmngr.exe" /protect
Owner:	SYSTEM
Windows Service
Service name:	PC Performer Manager
Display name:	Browser Manager
Type:	Win32ShareProcess
Parent processes:	services.exe (Services and Controller app by Microsoft) videomngr.exe (Application Manager by ForwardTech Inc)

Threads