home

protector.dll

Performersoft LLC

This is the Performersoft setup installer. The module protector.dll by Performersoft has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. Also know as BrowserDefender, this bundled service will prevent various web browser toolbars and extensions from running as well as block changes to the search page and provider. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
bProtector  (signed by Performersoft LLC)

Product:
bProtector

Version:
2,2,448,52

MD5:
851b4c661de562d685bff71621e9527e

SHA-1:
b289a08b8dfc05f57a269a597fc4df9859a71858

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
This service will prevent resources from modifying the web browser's home and search pages as well as the search provider set by the product, an affiliate search engine partner.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/23/2024 12:03:39 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/BProtector.Gen
7.11.114.86

ESET NOD32
Win32/bProtector (variant)
9.9065

McAfee
Artemis!851B4C661DE5
5600.6809

Microsoft Security Essentials
TrojanDropper:Win32/Rotbrow.B
1.163.1557.0

Reason Heuristics
PUP.Bundler.Performersoft
15.3.31.21

Sophos
BProtector
4.94

Trend Micro House Call
TROJ_GEN.F47V1118
7.2.90

VIPRE Antivirus
Bprotector
23512

File size:
1.9 MB (2,007,072 bytes)

Product version:
2,2,448,52

Copyright:
Copyright 2011

File type:
Dynamic link library (Win32 DLL)

Bundler/Installer:
InstallBrain

Language:
English (United States)

Common path:
C:\Documents and Settings\{user}\Application data\bprotectorforwindows\2.2.448.52\protector.dll

Digital Signature
Signed by:
Performersoft LLC

Authority:
GoDaddy.com, Inc.

Valid from:
7/13/2011 3:38:26 PM

Valid to:
6/25/2012 8:20:46 PM

Subject:
CN=Performersoft LLC, O=Performersoft LLC, L=Beaverton, S=OR, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
277B96F94D20C1

File PE Metadata
Compilation timestamp:
6/4/2012 9:03:57 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
49152:UIuPNiAaSJo0Qz+rqc9/qI3fZsnta6TpevI:Xu1iAjrqc9/X3fZQ

Entry address:
0x11769D

Entry point:
8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, A6, EF, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 83, EC, 14, 53, 33, DB, 56, 8B, 75, 08, 89, 5D, F8, 89, 5D, F4, 89, 5D, FC, 3B, F3, 75, 1E, E8, 10, 16, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, 60, E5, FF, FF, 83, C4, 14, 8B, C6, E9, 3B, 02, 00, 00, 57, 6A, 24, 68, FF, 00, 00, 00, 56, E8, 08, E2, FF, FF, 8B, 7D, 0C, 83, C4, 0C, 3B, FB, 75, 19, E8, DA, 15, 00, 00, 6A, 16, 5E, 53, 53, 53...
 
[+]

Code size:
1.4 MB (1,448,960 bytes)

Ini File Mappings System INI
Name:
AppInit_DLLs


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

Remove protector.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.