home

protocolfilters.dll

Adtrustmedia, LLC

The module protocolfilters.dll by Adtrustmedia has been detected as a potentially unwanted program by 8 anti-malware scanners.
Publisher:
Adtrustmedia, LLC  (signed and verified)

MD5:
474549642a491ebf975e760518780c86

SHA-1:
640593c8222eb3a55b25459a99b9d8f46d7267e1

SHA-256:
7cfbbb17dda86a17918e0b4f54dd143772dd4cf2e69652488ff825808c9f429a

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Displays advertising 'Trusted Advertisements' in the user's web browser in pages that normally would not show ads. Ads from AdTrustMedia are indicated by "AT-M Ad" displayed on the bottom right of the advertisement.

Analysis date:
7/19/2025 3:54:23 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/NetFilter.A potentially unsafe (variant)
9.11279

G Data
Win32.Application.Agent.271GAS
15.3.25

K7 AntiVirus
Trojan
13.200.15179

McAfee
Artemis!474549642A49
5600.6825

Reason Heuristics
PUP.Adtrustmedia
15.3.16.4

Sophos
PrivDog
4.98

Trend Micro House Call
Suspicious_GEN.F47V0227
7.2.75

VIPRE Antivirus
AdTrustMedia
38170

File size:
1.2 MB (1,244,288 bytes)

File type:
Dynamic link library (Win32 DLL)

Common path:
C:\Program Files\adtrustmedia\privdog\3.0.108.0\privdogmanager\plugins\protocolfilters.dll

Digital Signature
Signed by:
Adtrustmedia, LLC

Authority:
COMODO CA Limited

Valid from:
11/21/2014 4:00:00 AM

Valid to:
11/22/2015 3:59:59 AM

Subject:
CN="Adtrustmedia, LLC", O="Adtrustmedia, LLC", STREET="41 Watchung Plaza \#330", L=Montclair, S=New Jersey, PostalCode=07042, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
131790B1A4D73A5143B0A32A894B1AEC

File PE Metadata
Compilation timestamp:
2/26/2015 12:58:41 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:JnlYn3Etj/Nr/8vw5A/PsIOZlkLyr1xmRZAnYLcCkx1Y6Dp5Pp/ABTfOxzJ7bTDa:CMt/OaAEJ0245ERzPp/GTfA7bTDa

Entry address:
0x2ECB5

Entry point:
8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, 11, 90, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00...
 
[+]

Entropy:
6.6703

Code size:
850.5 KB (870,912 bytes)

Remove protocolfilters.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.