Home Malware Programs Potentially Unwanted Programs (PUPs) Web Protector Plus

Web Protector Plus

Posted: April 20, 2015

Threat Metric

Ranking: 9,327
Threat Level: 2/10
Infected PCs: 19,856
First Seen: April 14, 2015
Last Seen: October 1, 2023
OS(es) Affected: Windows

Web Protector Plus is a Potentially Unwanted Program (PUP) with adware behavior. It is a new variant of Web Protector. The application is developed by Safe Samurai and promoted as a security tool. According to its creators, Web Protector Plus will notify the user when he finds himself on compromised Internet pages. However, the real purpose of the PUP is not to assist its clients but to increase the web traffic towards third-party sites. In order to achieve this task, Web Protector Plus inserts plenty of ads directly into the browser. The user may notice pop-ups and banners as he surfs the web, which causes inconvenience and slows down the browsing speed. In order to display more suitable ads, Web Protector Plus monitors the history. Clicking on these ads isn't encouraged as they may lead to harmful pages. You should consider removing Web Protector Plus and leaving the PC's security to a reputable anti-malware tool instead of dubious PUPs.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



C:\Program Files (x86)\LiveUpdateWPP\LiveUpdateWPP.exe File name: LiveUpdateWPP.exe
Size: 425.98 KB (425984 bytes)
MD5: 6acb17f9ef3c6c1862c7880667f88f8e
Detection count: 6,417
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\LiveUpdateWPP\LiveUpdateWPP.exe
Group: Malware file
Last Updated: October 1, 2023
C:\Program Files (x86)\WebProtectorPlus\server64\WebProtectorPlusServer.exe File name: WebProtectorPlusServer.exe
Size: 361.47 KB (361472 bytes)
MD5: e186758c30941490ab3bf7fd1f83b629
Detection count: 4,497
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\WebProtectorPlus\server64\WebProtectorPlusServer.exe
Group: Malware file
Last Updated: April 9, 2023
file.exe File name: file.exe
Size: 10.84 MB (10848361 bytes)
MD5: 3262592a720f86a593d70f75ab0bf539
Detection count: 47
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: August 20, 2022

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%WINDIR%\System32\Tasks\Web Protector Plus%WINDIR%\System32\Tasks\Web Protector Plus ServerHKEY..\..\..\..{RegistryKeys}SOFTWARE\LiveUpdateWPPSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Protector PlusSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Web Protector Plus ServerSOFTWARE\Microsoft\Windows\CurrentVersion\Run\Web Protector Plus UISOFTWARE\WebProtectorPlusSOFTWARE\Wow6432Node\LiveUpdateWPPSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Web Protector Plus UISYSTEM\ControlSet001\services\LiveUpdateWPP ManagerSYSTEM\ControlSet002\services\LiveUpdateWPP ManagerSYSTEM\CurrentControlSet\services\LiveUpdateWPP ManagerHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}LiveUpdateWPPLiveWPPUpdateWebProtectorPlus

Additional Information

The following directories were created:
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Web Protector Plus%PROGRAMFILES%\LiveUpdateWPP%PROGRAMFILES%\LiveWPPUpdate%PROGRAMFILES%\WebProtectorPlus%PROGRAMFILES(x86)%\LiveUpdateWPP%PROGRAMFILES(x86)%\LiveWPPUpdate%PROGRAMFILES(x86)%\WebProtectorPlus
Loading...