Should I block it?

98%

Yes, 98% block recommendation.

Possible reason:

Multiple malware detections

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegCloseKey, RegOpenKeyExW, RegQueryValueExW

kernel32.dll

GetModuleHandleW, CreateFileW, FindFirstFileW, InterlockedIncrement, InterlockedDecrement, GetFullPathNameW, CloseHandle, FindNextFileW, FindClose, GetFileAttributesW, GetProcAddress, GetLastError, SetLastError, lstrlenW, GetStringTypeW, HeapFree, HeapAlloc, EncodePointer, DecodePointer, GetCurrentThreadId, GetCommandLineA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, HeapDestroy, IsProcessorFeaturePresent, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, RaiseException, Sleep, HeapSize, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, GetStartupInfoW, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, LoadLibraryW, RtlUnwind, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LCMapStringW, MultiByteToWideChar

user32.dll

LoadStringW

eBPSD.dll

By Banyan Tree Technology Limited (Signed)

Remove eBPSD.dll

MD5:	5dd25706efaf888499dafc6a0c9d6aa3
SHA1:	d686d40ae2534a4e06b01ef2123d787ce3976d0a
SHA256:	d89580773f3994c585288fb57415debe102df7dd3e9183be6ace8fe099be8018

Warning 22 antivirus scanners has detected malware.

Overview

eBPSD.dll is malware that is loaded as dynamic link library that runs in the context of a process. This is typically installed with the program DProtect published by DProtect Lab and is most likely removed by most users once installed (78% removed). The file is digitally signed by Banyan Tree Technology Limited which was issued by the GlobalSign nv-sa certificate authority (CA).

Details

File name:	eBPSD.dll
Typical file path:	C:\users\user\appdata\Local\DProtect\eBPSD.dll
Size:	60.56 KB (62,016 bytes)
Build date:	8/28/2013 7:27 PM
Certificate
Issued to:	Banyan Tree Technology Limited
Authority (CA):	GlobalSign nv-sa
Effective date:	Tuesday, October 1, 2013
Expiration date:	Sunday, November 1, 2015
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

DProtect

DProtect Lab

78% remove

DProtect is an adware web browser extension that will display various popup and banner ads as well as modify the user's web browser search and home page settings. In some cases, the program will monitor a user's behavior and will inject rival advertisements over existing one or just inject new ones all together. As part of the installation process the publisher may offer changes to your Internet Browser settings. These changes if app...

Malware detections

Based on 40+ industry antivirus scanners, 22 of them detected the following malware.

Antivirus engine	Engine version	Detection
AhnLab V3 Internet Security	2013.10.05	Trojan/Win32.Staser
avast!	8.0.1489.320	Win32:Staser-A [Trj]
BitDefender	7.2	Application.ExqPage.H
CAT Quick Heal	10.13.12.00	Trojan.Staser.fv
Comodo Internet Security	17053	UnclassifiedMalware
Dr.Web	8.13.10.10	Adware.Mutabaha.24
Fortinet	5.1.147.0	W32/Staser.FV!tr
F-Secure	11.0.19100.45	Application.ExqPage.H
G Data	13.10.22	Application.ExqPage.H
Jiangmin	16.0.100	Trojan/Staser.ac
Kaspersky	9.0.0.837	Trojan.Win32.Staser.fv
Kingsoft	2013.4.9.267	Win32.Troj.Staser.fv.(kcloud)
Malwarebytes	1.75.0.1	Trojan.Staser
McAfee	5.600.1067	Adware-Bprotect
McAfee Gateway Anti-Malware	v2013-dat	Adware-Bprotect
eScan by MicroWorld	12.0.250.0	Application.ExqPage.H
Sophos	4.93.0	Generic PUA NG
Trend Micro	9.740.0.1012	TROJ_FRS.PMA000J313
Trend Micro HouseCall	9.700.0.1001	TROJ_FRS.PMA000J313
Vba32 AntiVirus	3.12.24.3	Trojan.Staser
VIPRE Antivirus	22100	Elex Installer (fs)
ViRobot	2011.4.7.4223	Trojan.Win32.S.Agent.62016