Should I block it?

98%

Yes, 98% block recommendation.

Possible reason:

Multiple malware detections

Additional versions

1.0.0.1	50.00%
1.0.0.1	50.00%

(Note, Banyan Tree Technology Limited publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

ConvertStringSidToSidW, SetTokenInformation, CreateProcessAsUserW, GetTokenInformation, GetLengthSid, RegSetKeySecurity, FreeSid, AddAccessAllowedAce, AllocateAndInitializeSid, InitializeAcl, AdjustTokenPrivileges, LookupPrivilegeValueW, RegQueryValueExW, OpenProcessToken, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, ControlService, ReportEventW, UnlockServiceDatabase, QueryServiceStatusEx, SetServiceStatus, ChangeServiceConfigW, QueryServiceStatus, StartServiceW, ChangeServiceConfig2W, LockServiceDatabase, DeregisterEventSource, RegisterServiceCtrlHandlerExW, OpenServiceW, StartServiceCtrlDispatcherW, OpenSCManagerW, DeleteService, CloseServiceHandle, RegisterEventSourceW, CreateServiceW, RegSetValueExW, RegCloseKey, RegOpenKeyExW, RegCreateKeyExW, DuplicateTokenEx

dbghelp.dll

MiniDumpWriteDump

kernel32.dll

QueryDosDeviceW, GetFileSize, SetFilePointer, SetEndOfFile, CreateDirectoryW, WriteFile, ReadFile, DeleteFileW, SetFileAttributesW, GlobalAlloc, DeviceIoControl, GetVolumeInformationW, HeapAlloc, HeapFree, GetProcessHeap, FindFirstFileW, GetSystemWindowsDirectoryW, GetFileAttributesW, GetLongPathNameW, FlushFileBuffers, FindClose, FindNextFileW, GetQueuedCompletionStatus, InitializeCriticalSectionAndSpinCount, RaiseException, ResetEvent, GetExitCodeThread, PostQueuedCompletionStatus, CreateIoCompletionPort, ProcessIdToSessionId, SetStdHandle, IsValidLocale, EnumSystemLocalesA, GetSystemDirectoryW, GetLogicalDriveStringsW, GetEnvironmentVariableW, GetCurrentThreadId, GetLocalTime, CreateFileW, SetUnhandledExceptionFilter, lstrcmpiW, GetSystemInfo, GetVersionExW, GetModuleHandleW, GetSystemDefaultLangID, QueueUserWorkItem, LocalAlloc, SetLastError, InterlockedExchange, WideCharToMultiByte, lstrlenA, LocalFree, SetConsoleCtrlHandler, lstrlenW, FormatMessageW, GetCommandLineW, GetCurrentProcessId, GlobalFree, MultiByteToWideChar, CreateThread, CreateEventW, EnterCriticalSection, LeaveCriticalSection, Sleep, TerminateThread, SetPriorityClass, CloseHandle, DeleteCriticalSection, WaitForMultipleObjects, GetProcAddress, GetLastError, GetModuleFileNameW, TerminateProcess, LoadLibraryW, OpenProcess, InitializeCriticalSection, GetTickCount, SetEvent, WaitForSingleObject, GetCurrentProcess, GetLocaleInfoA, GetUserDefaultLCID, QueryPerformanceCounter, GetEnvironmentStringsW, WriteConsoleW, FreeEnvironmentStringsW, GetStringTypeW, GetConsoleMode, GetConsoleCP, HeapCreate, GetFileType, SetHandleCount, GetLocaleInfoW, GetStdHandle, ExitProcess, IsProcessorFeaturePresent, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, IsValidCodePage, GetOEMCP, GetACP, IsDebuggerPresent, UnhandledExceptionFilter, GetCPInfo, LCMapStringW, RtlUnwind, GetStartupInfoW, HeapSetInformation, ExitThread, GetSystemTimeAsFileTime, HeapSize, HeapReAlloc, HeapDestroy, DecodePointer, EncodePointer, InterlockedDecrement, InterlockedIncrement, FreeLibrary, GetEnvironmentVariableA, LoadLibraryA, GetModuleHandleA, VirtualProtect, WriteProcessMemory

ole32.dll

CoInitializeEx, CoInitialize, CoUninitialize, CoCreateInstance

psapi.dll

GetModuleFileNameExW, EnumProcessModules, EnumProcesses

sensapi.dll

IsNetworkAlive

shell32.dll

SHGetFolderPathW, CommandLineToArgvW

shlwapi.dll

SHRegSetUSValueW, SHRegCloseUSKey, PathFindFileNameW, PathFindExtensionW, StrChrW, StrCpyW, SHRegGetUSValueW, SHRegOpenUSKeyW, PathAppendW, SHRegEnumUSKeyW, PathFileExistsW, StrRChrW, StrTrimW, StrCmpIW

user32.dll

GetSystemMetrics, wsprintfW

userenv.dll

CreateEnvironmentBlock, DestroyEnvironmentBlock

winhttp.dll

WinHttpOpenRequest, WinHttpGetProxyForUrl, WinHttpCrackUrl, WinHttpReadData, WinHttpReceiveResponse, WinHttpSetTimeouts, WinHttpOpen, WinHttpGetIEProxyConfigForCurrentUser, WinHttpSendRequest, WinHttpWriteData, WinHttpConnect, WinHttpAddRequestHeaders, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpQueryHeaders, WinHttpCloseHandle

wininet.dll

InternetReadFile, InternetCrackUrlW, HttpSendRequestW, InternetSetOptionW, HttpAddRequestHeadersW, HttpOpenRequestW, InternetCheckConnectionW, InternetCloseHandle, HttpQueryInfoW, InternetOpenUrlW, InternetOpenW, InternetConnectW

ws2_32.dll

getaddrinfo, freeaddrinfo

DProtectSvc.exe

eBP Security Protection by Banyan Tree Technology Limited (Signed)

Remove DProtectSvc.exe

Version:	1.0.0.1
MD5:	76c7617847cce2e948701365beb45ce2
SHA1:	5dbc73c79d3764f539ad5d15733614788f8436bd
SHA256:	329bf72c7c0b921f0d18b5fa4aa8c46dfb5a880bfadaad0771ef28d9d644125b

Warning 16 antivirus scanners has detected malware.

Overview

dprotectsvc.exe is malware that runs as a service under the name DPService with extensive SYSTEM privileges (full administrator access). This is typically installed with the program DProtect published by DProtect Lab and is most likely removed by most users once installed (78% removed). The file is digitally signed by Banyan Tree Technology Limited which was issued by the GlobalSign nv-sa certificate authority (CA).

Details

File name:	dprotectsvc.exe
Publisher:	Woodtale Technology Inc
Product name:	eBP Security Protection
Description:	eBPSvc
Typical file path:	C:\users\user\appdata\local\dprotect\dprotectsvc.exe
File version:	1.0.0.1
Size:	334.56 KB (342,592 bytes)
Build date:	9/3/2013 9:07 AM
Certificate
Issued to:	Banyan Tree Technology Limited
Authority (CA):	GlobalSign nv-sa
Effective date:	Tuesday, October 1, 2013
Expiration date:	Sunday, November 1, 2015
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

DProtect

DProtect Lab

78% remove

DProtect is an adware web browser extension that will display various popup and banner ads as well as modify the user's web browser search and home page settings. In some cases, the program will monitor a user's behavior and will inject rival advertisements over existing one or just inject new ones all together. As part of the installation process the publisher may offer changes to your Internet Browser settings. These changes if app...

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'DPService'

Malware detections

Based on 40+ industry antivirus scanners, 16 of them detected the following malware.

Antivirus engine	Engine version	Detection
avast!	8.0.1489.320	Win32:Staser-A [Trj]
CAT Quick Heal	10.13.12.00	Trojan.Staser.fv
Comodo Internet Security	17072	UnclassifiedMalware
Dr.Web	8.13.10.10	Adware.Mutabaha.24
ESET NOD32	7.8889	a variant of Win32/ELEX.T
Fortinet	5.1.147.0	W32/Staser.FV!tr
Kaspersky	9.0.0.837	Trojan.Win32.Staser.fv
Kingsoft	2013.4.9.267	Win32.Troj.Staser.fv.(kcloud)
Malwarebytes	1.75.0.1	Trojan.Staser
McAfee	5.600.1067	Adware-Bprotect
McAfee Gateway Anti-Malware	v2013-dat	Adware-Bprotect
Sophos	4.93.0	Generic PUA FN
Symantec	20131.1.5.61	WS.Reputation.1
Trend Micro HouseCall	9.700.0.1001	TROJ_GEN.F47V0904
Vba32 AntiVirus	3.12.24.3	Trojan.Staser
VIPRE Antivirus	22192	Elex Installer (fs)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00064969%	0.028634%
Kernel CPU:	0.00026723%	0.013761%
User CPU:	0.00038246%	0.014873%
Kernel CPU time:	202,109 ms/min	100,923,805ms/min
Memory
Private memory:	5.23 MB	21.59 MB
Private (maximum):	1.61 MB
Private (minimum):	612 KB
Non-paged memory:	5.23 MB	21.59 MB
Virtual memory:	67.85 MB	140.96 MB
Virtual memory (peak):	88.15 MB	169.69 MB
Working set:	700 KB	18.61 MB
Working set (peak):	8.02 MB	37.95 MB
Resource allocations
Threads:	16	12
Handles:	357	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\users\user\appdata\local\dprotect\dprotectsvc.exe
Owner:	SYSTEM
Windows Service
Service name:	DPService
Description:	“DProtect Service”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads