Should I block it?

98%
Yes, 98% block recommendation.
Possible reason:
Multiple malware detections

VersionsAdditional versions

1.0.0.1 50.00%
1.0.0.1 50.00%
(Note, Banyan Tree Technology Limited publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process
Related files

PE structurePE file structure

Show functions
Import table
advapi32.dll
ConvertStringSidToSidW, SetTokenInformation, CreateProcessAsUserW, GetTokenInformation, GetLengthSid, RegSetKeySecurity, FreeSid, AddAccessAllowedAce, AllocateAndInitializeSid, InitializeAcl, AdjustTokenPrivileges, LookupPrivilegeValueW, RegQueryValueExW, OpenProcessToken, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, ControlService, ReportEventW, UnlockServiceDatabase, QueryServiceStatusEx, SetServiceStatus, ChangeServiceConfigW, QueryServiceStatus, StartServiceW, ChangeServiceConfig2W, LockServiceDatabase, DeregisterEventSource, RegisterServiceCtrlHandlerExW, OpenServiceW, StartServiceCtrlDispatcherW, OpenSCManagerW, DeleteService, CloseServiceHandle, RegisterEventSourceW, CreateServiceW, RegSetValueExW, RegCloseKey, RegOpenKeyExW, RegCreateKeyExW, DuplicateTokenEx
dbghelp.dll
MiniDumpWriteDump
kernel32.dll
QueryDosDeviceW, GetFileSize, SetFilePointer, SetEndOfFile, CreateDirectoryW, WriteFile, ReadFile, DeleteFileW, SetFileAttributesW, GlobalAlloc, DeviceIoControl, GetVolumeInformationW, HeapAlloc, HeapFree, GetProcessHeap, FindFirstFileW, GetSystemWindowsDirectoryW, GetFileAttributesW, GetLongPathNameW, FlushFileBuffers, FindClose, FindNextFileW, GetQueuedCompletionStatus, InitializeCriticalSectionAndSpinCount, RaiseException, ResetEvent, GetExitCodeThread, PostQueuedCompletionStatus, CreateIoCompletionPort, ProcessIdToSessionId, SetStdHandle, IsValidLocale, EnumSystemLocalesA, GetSystemDirectoryW, GetLogicalDriveStringsW, GetEnvironmentVariableW, GetCurrentThreadId, GetLocalTime, CreateFileW, SetUnhandledExceptionFilter, lstrcmpiW, GetSystemInfo, GetVersionExW, GetModuleHandleW, GetSystemDefaultLangID, QueueUserWorkItem, LocalAlloc, SetLastError, InterlockedExchange, WideCharToMultiByte, lstrlenA, LocalFree, SetConsoleCtrlHandler, lstrlenW, FormatMessageW, GetCommandLineW, GetCurrentProcessId, GlobalFree, MultiByteToWideChar, CreateThread, CreateEventW, EnterCriticalSection, LeaveCriticalSection, Sleep, TerminateThread, SetPriorityClass, CloseHandle, DeleteCriticalSection, WaitForMultipleObjects, GetProcAddress, GetLastError, GetModuleFileNameW, TerminateProcess, LoadLibraryW, OpenProcess, InitializeCriticalSection, GetTickCount, SetEvent, WaitForSingleObject, GetCurrentProcess, GetLocaleInfoA, GetUserDefaultLCID, QueryPerformanceCounter, GetEnvironmentStringsW, WriteConsoleW, FreeEnvironmentStringsW, GetStringTypeW, GetConsoleMode, GetConsoleCP, HeapCreate, GetFileType, SetHandleCount, GetLocaleInfoW, GetStdHandle, ExitProcess, IsProcessorFeaturePresent, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, IsValidCodePage, GetOEMCP, GetACP, IsDebuggerPresent, UnhandledExceptionFilter, GetCPInfo, LCMapStringW, RtlUnwind, GetStartupInfoW, HeapSetInformation, ExitThread, GetSystemTimeAsFileTime, HeapSize, HeapReAlloc, HeapDestroy, DecodePointer, EncodePointer, InterlockedDecrement, InterlockedIncrement, FreeLibrary, GetEnvironmentVariableA, LoadLibraryA, GetModuleHandleA, VirtualProtect, WriteProcessMemory
ole32.dll
CoInitializeEx, CoInitialize, CoUninitialize, CoCreateInstance
psapi.dll
GetModuleFileNameExW, EnumProcessModules, EnumProcesses
sensapi.dll
IsNetworkAlive
shell32.dll
SHGetFolderPathW, CommandLineToArgvW
shlwapi.dll
SHRegSetUSValueW, SHRegCloseUSKey, PathFindFileNameW, PathFindExtensionW, StrChrW, StrCpyW, SHRegGetUSValueW, SHRegOpenUSKeyW, PathAppendW, SHRegEnumUSKeyW, PathFileExistsW, StrRChrW, StrTrimW, StrCmpIW
user32.dll
GetSystemMetrics, wsprintfW
userenv.dll
CreateEnvironmentBlock, DestroyEnvironmentBlock
winhttp.dll
WinHttpOpenRequest, WinHttpGetProxyForUrl, WinHttpCrackUrl, WinHttpReadData, WinHttpReceiveResponse, WinHttpSetTimeouts, WinHttpOpen, WinHttpGetIEProxyConfigForCurrentUser, WinHttpSendRequest, WinHttpWriteData, WinHttpConnect, WinHttpAddRequestHeaders, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpQueryHeaders, WinHttpCloseHandle
wininet.dll
InternetReadFile, InternetCrackUrlW, HttpSendRequestW, InternetSetOptionW, HttpAddRequestHeadersW, HttpOpenRequestW, InternetCheckConnectionW, InternetCloseHandle, HttpQueryInfoW, InternetOpenUrlW, InternetOpenW, InternetConnectW
ws2_32.dll
getaddrinfo, freeaddrinfo

DProtectSvc.exe

eBP Security Protection by Banyan Tree Technology Limited (Signed)

Remove DProtectSvc.exe
Version:   1.0.0.1
MD5:   957c9c20b7df85c3f8d08e53f4720ba1
SHA1:   700338ae3b8c8c4b716cc479e373089a17beb685
SHA256:   66ad685420c85fcbf28f2ef6c1a7814e192f23c3c7ab678263a7147bc457b3ba
Warning 20 antivirus scanners has detected malware.

Overview

dprotectsvc.exe is malware that runs as a service under the name DPService with extensive SYSTEM privileges (full administrator access). This is typically installed with the program DProtect published by DProtect Lab and is most likely removed by most users once installed (78% removed). The file is digitally signed by Banyan Tree Technology Limited which was issued by the GlobalSign nv-sa certificate authority (CA).

DetailsDetails

File name:dprotectsvc.exe
Publisher:Woodtale Technology Inc
Product name: eBP Security Protection
Description:eBPSvc
Typical file path:C:\users\user\appdata\local\dprotect\dprotectsvc.exe
File version:1.0.0.1
Size:337.06 KB (345,152 bytes)
Build date:9/16/2013 2:51 AM
Certificate
Issued to:Banyan Tree Technology Limited
Authority (CA):GlobalSign nv-sa
Effective date:Tuesday, October 1, 2013
Expiration date:Sunday, November 1, 2015
Digital DNA
PE subsystem:Windows GUI
File packed:No
.NET CLR:No
More details

ResourcesPrograms

The following program will install this file
DProtect Lab
  78% remove
DProtect is an adware web browser extension that will display various popup and banner ads as well as modify the user's web browser search and home page settings. In some cases, the program will monitor a user's behavior and will inject rival advertisements over existing one or just inject new ones all together. As part of the installation process the publisher may offer changes to your Internet Browser settings. These changes if app...

BehaviorsBehaviors

Service
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
  • 'DPService'

MalwareMalware detections

Based on 40+ industry antivirus scanners, 20 of them detected the following malware.
Antivirus engineEngine versionDetection
Antiy Labs AVL 2.0.3.7 Trojan/Win32.Staser
avast! 8.0.1489.320 Win32:Staser-A [Trj]
CAT Quick Heal 10.13.12.00 Trojan.Staser.fv
Comodo Internet Security 17053 UnclassifiedMalware
Dr.Web 8.13.10.15 Adware.Mutabaha.28
Fortinet 5.1.147.0 W32/Staser.FV!tr
G Data 13.10.22 Win32.Trojan.Agent.IX3DHN
Ikarus T3.1.5.4.0 Trojan.Win32.Staser
Kaspersky 9.0.0.837 Trojan.Win32.Staser.fv
Kingsoft 2013.4.9.267 Win32.Troj.Staser.fv.(kcloud)
Malwarebytes 1.75.0.1 Trojan.Staser
McAfee 5.600.1067 Adware-Bprotect
McAfee Gateway Anti-Malware v2013-dat Adware-Bprotect
Panda Antivirus 10.0.3.5 Generic Malware
Sophos 4.93.0 Generic PUA HA
Trend Micro 9.740.0.1012 ADW_BPROTECT
Trend Micro HouseCall 9.700.0.1001 ADW_BPROTECT
Vba32 AntiVirus 3.12.24.3 Trojan.Staser
VIPRE Antivirus 22102 Elex Installer (fs)
ViRobot 2011.4.7.4223 Trojan.Win32.S.Agent.345152

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00560868%
0.028634%
Kernel CPU:0.00261814%
0.013761%
User CPU:0.00299054%
0.014873%
Kernel CPU time:13,697 ms/min
100,923,805ms/min
CPU cycles:26,229,402/sec
17,470,203/sec
Context switches:2/sec
284/sec
Memory
Private memory:4.76 MB
21.59 MB
Private (maximum):4.22 MB
Private (minimum):612 KB
Non-paged memory:4.76 MB
21.59 MB
Virtual memory:67.99 MB
140.96 MB
Virtual memory (peak):80.65 MB
169.69 MB
Working set:736 KB
18.61 MB
Working set (peak):6.32 MB
37.95 MB
Page faults:103,229/min
2,039/min
I/O
I/O read transfer:1.27 MB/sec
1.02 MB/min
I/O read operations:987/sec
343/min
I/O write transfer:21.1 KB/sec
274.99 KB/min
I/O write operations:12/sec
227/min
I/O other transfer:162.33 KB/sec
448.09 KB/min
I/O other operations:6,610/sec
1,671/min
Resource allocations
Threads:17
12
Handles:274
600

BehaviorsProcess properties

Integrety level:System
Platform:32-bit
Command line:C:\users\user\appdata\local\dprotect\dprotectsvc.exe
Owner:SYSTEM
Windows Service
Service name:DPService
Description:“DProtect Service”
Type:Win32OwnProcess
Parent process:services.exe (Services and Controller app by Microsoft)

ResourcesThreads

Averages
 
DProtectSvc.exe (main module)
Total CPU:0.04586379%
0.272967%
Kernel CPU:0.02563923%
0.107585%
User CPU:0.02022456%
0.165382%
CPU cycles:1,215,151/sec
5,741,424/sec
Memory:364 KB
1.16 MB
sechost.dll
Total CPU:0.00011706%
Kernel CPU:0.00000000%
User CPU:0.00011706%
CPU cycles:26,304/sec
Memory:100 KB

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Ultimate 50.00%
Windows 7 Professional 50.00%

Distribution by countryDistribution by country

India installs about 50.00% of eBP Security Protection.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
MSI 66.67%
Samsung 33.33%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE