PUP.WebProtect

Posted: December 13, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	12,289
Threat Level:	2/10
Infected PCs:	58,056

First Seen:	December 13, 2013
Last Seen:	March 3, 2025
OS(es) Affected:	Windows

PUP.WebProtect is a Potentially Unwanted Program that fakes possessing useful browser security features for an easy excuse to modify your browser. Most modifications are used to display advertisements or redirect traffic to third party content, which may endanger your PC – besides being a significant performance hindrance. PUP.WebProtect isn't a threat, but because malware researchers also often see PUP.WebProtect installed along with what appear to be separate threats to your PC with actual attack functions, it would be wise to consider using general anti-malware scans as part of your solution for removing PUP.WebProtect from your Web browser.

The Protection that's as Good as Gold... to Advertisers

While PUP.WebProtect claims that its features will protect your PC (and, notably, also uses the same name as a legitimate WebProtect add-on that does include such functionality), PUP.WebProtect is categorized as adware for its primary purpose of displaying advertisements, as opposed to helping your browser in any way. Where PUP.WebProtect lacks in security features that could protect you from risky sites, PUP.WebProtect overcompensates with monetized advertising functions. Malware experts count these and other undesirable functions that may be based on PUP.WebProtect as follows:

PUP.WebProtect may update itself, which may periodically harm your PC's performance and may add new functions to PUP.WebProtect that aren't beneficial.
PUP.WebProtect may redirect your browser by hijacking your default search engine, homepage, new tab page or error page.
PUP.WebProtect may modify Web pages to show extra advertisements as banners, sponsored results, etc.
PUP.WebProtect may launch pop-ups and other independent windows for advertising content.

Unfortunately, unlike the WebProtect add-on that doesn't include any of the drawbacks listed here, PUP.WebProtect doesn't have any functional browser-protection features that would balance out these problems in any respect.

Why PC Protection from PUP.WebProtect Starts with the User

Theoretically, PUP.WebProtect may be installed through the direct intervention of harmful software or Web-based PC threats like exploit kits. On the other hand, these attacks often are lesser-used strategy for adware programs like PUP.WebProtect, which often prefer to be installed through free software bundles. Avoiding these bundles and sites that are known for distributing them is what malware researchers would call the simplest way of keeping PUP.WebProtect off of your browser – along with any number of other low-level PC threats like browser hijackers and undesired toolbars.

Removing PUP.WebProtect with all browser changes deleted with PUP.WebProtect is less a matter of identifying PUP.WebProtect than of using the appropriate tools to make identification as streamlined and automated as possible. Since PUP.WebProtect may be installed in any of several variants and may make unusual system changes that PUP.WebProtect doesn't remove upon request, anti-malware products should be considered the least troublesome way of uninstalling PUP.WebProtect software. When used properly, these products also can be useful for identifying potential installers for PUP.WebProtect, including disguised bundles.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%PROGRAMFILES(x86)%\Web Protect\MyOSProtect.dll

File name: MyOSProtect.dll
Size: 304.77 KB (304776 bytes)
MD5: f2e5a0cc408405c595a9cdbf854a38e1
Detection count: 8,026
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Web Protect\MyOSProtect.dll
Group: Malware file
Last Updated: March 3, 2025

%WINDIR%\system32\PCProtect64.dll

File name: PCProtect64.dll
Size: 330.62 KB (330624 bytes)
MD5: 02301d454602d0f04268332810745328
Detection count: 1,560
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\system32\PCProtect64.dll
Group: Malware file
Last Updated: December 13, 2024

%PROGRAMFILES(x86)%\Web Protect\MyOSProtect64.dll

File name: MyOSProtect64.dll
Size: 350.76 KB (350768 bytes)
MD5: bd7ea9aecc6e518f26aec7b3da2ceb50
Detection count: 862
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Web Protect\MyOSProtect64.dll
Group: Malware file
Last Updated: March 3, 2025

D:\Daten alte Festplatte\AdwCleaner\Quarantine\C\Program Files\Web Protect\postcollect.exe.vir

File name: postcollect.exe.vir
Size: 48.5 KB (48501 bytes)
MD5: 0244d0b696aa1a3bf755ba2e9356b1d5
Detection count: 412
Mime Type: unknown/vir
Path: D:\Daten alte Festplatte\AdwCleaner\Quarantine\C\Program Files\Web Protect\postcollect.exe.vir
Group: Malware file
Last Updated: December 13, 2024

C:\Program Files (x86)\PCTRunner\PCProxyDLL.dll

File name: PCProxyDLL.dll
Size: 827.39 KB (827392 bytes)
MD5: 6fe3ec92e563a87c493eb7a23819fdfc
Detection count: 337
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\Program Files (x86)\PCTRunner\PCProxyDLL.dll
Group: Malware file
Last Updated: March 3, 2025

%PROGRAMFILES(x86)%\Web Protect\pcwtc64f.sys

File name: pcwtc64f.sys
Size: 24.06 KB (24064 bytes)
MD5: b5aab452c9ad325d3728f8272303d1d0
Detection count: 323
File type: System file
Mime Type: unknown/sys
Path: %PROGRAMFILES(x86)%\Web Protect\pcwtc64f.sys
Group: Malware file
Last Updated: March 3, 2025

C:\Program Files (x86)\PCTRunner\postcollect.exe

File name: postcollect.exe
Size: 48.75 KB (48756 bytes)
MD5: 9b6a1af8a5a13bf8156eb83043fb9829
Detection count: 309
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\PCTRunner\postcollect.exe
Group: Malware file
Last Updated: March 3, 2025

%PROGRAMFILES(x86)%\Web Protect\pcwatch.sys

File name: pcwatch.sys
Size: 19.84 KB (19840 bytes)
MD5: 3182a7b614220dd26804589bd910e28d
Detection count: 281
File type: System file
Mime Type: unknown/sys
Path: %PROGRAMFILES(x86)%\Web Protect\pcwatch.sys
Group: Malware file
Last Updated: August 17, 2023

D:\Daten alte Festplatte\AdwCleaner\Quarantine\C\Program Files\Web Protect\PCCertInstaller.dll.vir

File name: PCCertInstaller.dll.vir
Size: 182.28 KB (182288 bytes)
MD5: 3b82bbece671402e3021c16f3c191a82
Detection count: 241
Mime Type: unknown/vir
Path: D:\Daten alte Festplatte\AdwCleaner\Quarantine\C\Program Files\Web Protect\PCCertInstaller.dll.vir
Group: Malware file
Last Updated: December 13, 2024

C:\Program Files (x86)\PCTRunner\RegisterMyOSProtect64.exe

File name: RegisterMyOSProtect64.exe
Size: 308.58 KB (308584 bytes)
MD5: dc32db1869f7fe61d94663391e3e4c1f
Detection count: 73
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\PCTRunner\RegisterMyOSProtect64.exe
Group: Malware file
Last Updated: August 17, 2023

MyOSProtect.exe

File name: MyOSProtect.exe
Size: 602.64 KB (602644 bytes)
MD5: b77ddcec1c53797b3540e8218a6a3bb4
Detection count: 53
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: November 18, 2014

precollect.exe

File name: precollect.exe
Size: 46.84 KB (46842 bytes)
MD5: c3d87d947ba5e16351b53db2ee2b20c1
Detection count: 47
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: November 4, 2022

C:\Program Files (x86)\PCTRunner\uninstaller.exe

File name: uninstaller.exe
Size: 241.16 KB (241167 bytes)
MD5: 2a2b487af1b8fe5be996d299abf703ae
Detection count: 44
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\PCTRunner\uninstaller.exe
Group: Malware file
Last Updated: October 12, 2022

%PROGRAMFILES(x86)%\PCTRunner\uninstallhelper.exe

File name: uninstallhelper.exe
Size: 661.76 KB (661767 bytes)
MD5: a0e7f08be0f01bdb9cf3554b911d557e
Detection count: 19
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\PCTRunner
Group: Malware file
Last Updated: May 15, 2020

%TEMP%\n3922\wp_us_1402-6ac27449.exe

File name: wp_us_1402-6ac27449.exe
Size: 5.75 MB (5758504 bytes)
MD5: 20c8a6ad65741678811b2c237bb16945
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%\n3922
Group: Malware file
Last Updated: September 25, 2024

More files

Registry Modifications

The following newly produced Registry Values are:

CLSID{06FD4518-2CAB-4473-AA8D-0508134C6C1F}{0C27B569-9410-406B-BA79-3EF654739236}{1A86F607-D30E-46c7-A7F5-44F690F0ABB7}{2F101D36-9749-4730-AA02-F1F8BD1193EA}{3E4048A7-8F44-48DC-9163-16A4803F7826}{4A55DCF1-2410-4139-A579-15DED320D84A}{59A8D713-E25C-4c3f-AB27-44A4FEDD9328}{632ACF93-7DAA-4CFD-8BB5-9DCBB9116176}{6DA234CD-4043-46C6-922F-A39529AE3D4B}{704C6F87-E9C5-44FE-B5AF-A84DB18AFB54}{94B83936-77EA-4708-8FC5-F3BBC55C2A32}{C64747EF-5093-48B3-A876-579B3A529C27}{DA5534ED-88FD-49fa-9D2D-B92584CB21AC}{DE4EF20E-BC71-4a63-BC1E-C13B37815A00}{E2179B6D-BB95-4004-8A51-B9E8FBE9FF24}{E3F16E3B-4C44-445B-8854-EB76DC059891}{E3F32F05-71B6-44c5-8BEE-13D239E27E98}Regexp file mask%WINDIR%\System32\Drivers\pcwatch.sys%windir%\System32\MyOSProtect.ini%windir%\System32\MyOSProtectOff.ini%WINDIR%\SysWOW64\MyOSProtect.ini%WINDIR%\SysWOW64\MyOSProtectOff.iniHKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\AppID\MyOSProtect.EXESoftware\PCTRunnerSoftware\WebProtectSOFTWARE\Wow6432Node\Classes\AppID\MyOSProtect.EXESOFTWARE\Wow6432Node\PCTRunnerSOFTWARE\Wow6432Node\WebProtectSYSTEM\ControlSet001\Control\SafeBoot\Minimal\pcwatch.sysSYSTEM\ControlSet001\Control\SafeBoot\Network\MyOSProtectSYSTEM\ControlSet001\Control\SafeBoot\Network\PCProtectSYSTEM\ControlSet001\Control\SafeBoot\Network\pcwatch.sysSYSTEM\ControlSet001\services\MyOSProtectSYSTEM\ControlSet001\services\PCProtectSYSTEM\ControlSet001\services\pcwatchSYSTEM\ControlSet001\services\ProtectMonitorSYSTEM\ControlSet002\Control\SafeBoot\Minimal\pcwatch.sysSYSTEM\ControlSet002\Control\SafeBoot\Network\MyOSProtectSYSTEM\ControlSet002\Control\SafeBoot\Network\PCProtectSYSTEM\ControlSet002\Control\SafeBoot\Network\pcwatch.sysSYSTEM\ControlSet002\services\MyOSProtectSYSTEM\ControlSet002\services\PCProtectSYSTEM\ControlSet002\services\pcwatchSYSTEM\ControlSet002\services\ProtectMonitorSYSTEM\ControlSet003\Control\SafeBoot\Minimal\pcwatch.sysSYSTEM\ControlSet003\Control\SafeBoot\Network\pcwatch.sysSYSTEM\ControlSet003\services\pcwatchSYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\pcwatch.sysSYSTEM\CurrentControlSet\Control\SafeBoot\Network\MyOSProtectSYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCProtectSYSTEM\CurrentControlSet\Control\SafeBoot\Network\pcwatch.sysSYSTEM\CurrentControlSet\services\MyOSProtectSYSTEM\CurrentControlSet\services\PCProtectSYSTEM\CurrentControlSet\services\pcwatchSYSTEM\CurrentControlSet\services\ProtectMonitorHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}wp-adinject-adkwp-adkwp-aplwp-dcollect-tgu

Additional Information

The following directories were created:

%PROGRAMFILES%\PCTRunner%PROGRAMFILES%\ThinkProtect%PROGRAMFILES%\ThinkupWP%PROGRAMFILES(x86)%\PCTRunner%PROGRAMFILES(x86)%\ThinkProtect%PROGRAMFILES(x86)%\ThinkupWP

The following URL's were detected:

wpplink.com