What is MyPC Backup?

MyPC Backup is software application developed by JDI BACKUP LIMITED. It is most commonly found on computers running Windows 7 with nearly 56.52% of installations running this operating system. MyPC Backup's installer is typically 27.00 MB in size and installs around 41 files.

MyPC Backup is most popular in the United States with 46.95% of installations residing in this country.

MyPC Backup adds 3 scheduled tasks to the Windows Task Scheduler launching the program at randomly scheduled times. When using a computer that is connected to the internet, MyPC Backup is known to create 1 firewall exception to allow inbound and outbound connectivity.

About MyPC Backup?

MyPC Backup is a software program that is often bundled with adware installers and third-party download managers such as CBS Interactive, Somoto, Conduit, Bechiro, and others. After installation, it bombards users with frequent pop-up notifications encouraging them to sign up for the service. MyPC Backup is part of the Just Develop It! group of backup brands, distributed under the sub company MyPCBackup Ltd/Backup Software Limited. This company offers web hosting and online backup services through JDI Backup, which is the parent company to similar brands Backup Genie and JustCloud.

Multiple virus scanners have detected malware in MyPC Backup.

uninst.exe (MD5: 461420b8a9a8546ba3b9d4bf1e88ce49) has been flagged by 2 scanners:

Scanner Software	Version	Result
SUPERAntiSpyware	5.6.0.1008	Trojan.Agent/Gen-FraudPack
TrendMicro-HouseCall	9.700.0.1001	HV_ZYX_BK08294A.TOMC

BackupStack.exe (MD5: 9697bb01cc775dbec6e7a52bdb6dc3e3) has been flagged by 52 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	912	Win32.Runouce.B@mm
Agnitum Outpost	7.1.1	I-Worm.Chir.B
AhnLab-V3	2014.07.07	Win32/ChiHack.6652
Avira AntiVir	7.11.158.174	W32/Chir.B
Antiy-AVL	1.0.0.1	Worm[Email]/Win32.Runouce.b
avast!	2014.9-140807	Win32:Oncer
AVG	2015.0.3390	Win32/Chir.B@mm
Baidu-International	4.0.3.1487	Virus.Win32.Runouce.$a
Bitdefender	1.0.20.1095	Win32.Runouce.B@mm
Bkav FE	1.3.0.4959	W32.ChirBPE
CAT-QuickHeal	8.14.14.00	W32.Runouce.B
Clam AntiVirus	0.98/21411	WIN.Worm.Brontok
CMC Antivirus	1.1.0.977	Virus.Worm.Win32.Runouce.1!O
Commtouch SDK	5.4.1.7	W32/Thecid.B@mm
Comodo Security	18788	EmailWorm.Win32.Runonce.~v001
Dr.Web	9.0.0.0219	Win32.Runonce.6652
Emsisoft Anti-Malware	8.14.08.07.05	Win32.Runouce.B@mm
ESET-NOD32	8.10053	Win32/Chir.B
Fortinet FortiGate	8/7/2014	W32/Chir.B@mm
F-Prot	v6.4.7.1.166	W32/Thecid.B@mm
F-Secure	11.2014-07-08_5	Win32.Runouce.B@mm
G Data	14.8.24	Win32.Runouce.B@mm
IKARUS anti.virus	t3scan.1.6.1.0	Email-Worm.Win32.Runouce
Jiangmin	KV140807	Win32/cnPeace.b
K7 AntiVirus	13.180.12626	EmailWorm
K7GW	13.180.12626	EmailWorm ( 00176e371 )
Kaspersky	14.0.0.3444	Email-Worm.Win32.Runouce
Kingsoft AntiVirus	331020.49267	Win32.Type.b.6637
Malwarebytes	v2014.08.07.05	Virus.Chir
McAfee	5600.7046	W32/Chir.b@MM
McAfee-GW-Edition	7.7046	Heuristic.LooksLike.Win32.SuspiciousPE.J
Microsoft Security Essentials	1.10701	Virus:Win32/Chir.B@mm
MicroWorld-eScan	15.0.0.657	Win32.Runouce.B@mm
NANO AntiVirus	0.28.0.60577	Virus.Win32.Runouce.bxafx
Norman	10.20140807	Agent.VAFM
nProtect	14.07.06.01	Win32.Runouce.B@mm
Panda Antivirus	14.08.07.05	W32/Chir.B
Qihoo-360	1.0.0.1015	Virus.Win32.CNHacker.C
Rising Antivirus	23.00.65.14805	PE:Worm.ChineseHacker-2!23772
Sophos	4.98	W32/Chir-A
Symantec	8/7/2014 rev. 5	W32.Chir.B@mm
Tencent	1.0.0.1	Virus.Win32.ChineseHacker.a
The Hacker	6.8.0.5.470	W32/Chir.b.dannado
Total Defense	37.0.11042	Win32/Chir.B
Trend Micro	10.465.07	PE_Chir.B
TrendMicro-HouseCall	7.2.219	PE_Chir.B
Vba32 AntiVirus	3.12.26.3	Virus.Win32.Chur.A
VIPRE Antivirus	31020	Win32.chir.b (v)
ViRobot	2011.4.7.4223	Win32.Chir.B
Zillya	2.0.0.1846	Worm.Runouce.Win32.2
AVware	1.5.0.21	MyPC Backup (fs)
SUPERAntiSpyware	5.6.0.1008	Trojan.Agent/Gen-FraudPack

Signup Wizard.exe (MD5: 9d0cc110ab0605885d98ae08377f6f66) has been flagged by 6 scanners:

Scanner Software	Version	Result
AVG	15.0.0.4328	MyBackup.940
AVware	1.5.0.21	MyPC Backup (fs)
Bkav FE	1.3.0.6379	W32.HfsAdware.C479
Trend Micro	9.740.0.1012	ADW_MYPCBACKUP
TrendMicro-HouseCall	9.700.0.1001	ADW_MYPCBACKUP
VIPRE Antivirus	39216	MyPC Backup (fs) (not malicious)

MyPC Backup.exe (MD5: 732761dfcfad0863e216931e29c75630) has been flagged by 18 scanners:

Scanner Software	Version	Result
AVG	15.0.0.4328	Generic.DE7
AVware	1.5.0.21	MyPC Backup (fs)
Bkav FE	1.3.0.6379	W32.HfsAdware.4655
ESET-NOD32	11462	a variant of MSIL/MyPCBackup.A potentially unwanted
Malwarebytes	1.75.0.1	PUP.Optional.MyPCBackup.A
Symantec	20141.2.0.56	MyPCBackup!gen1
VIPRE Antivirus	39274	MyPC Backup (fs) (not malicious)
SUPERAntiSpyware	5.6.0.1008	Trojan.Agent/Gen-FraudPack
TrendMicro-HouseCall	9.700.0.1001	HV_ZYX_BK08294A.TOMC
Agnitum Outpost	7.1.1	Riskware.BackupMyPC
CAT-QuickHeal	4.15.14.00	RiskTool.BackupMyPC.r3 (Not a Virus)
Cyren	5.4.16.7	W32/BackupMyPC.VBBU-8711
F-Prot	v6.4.7.1.166	W32/BackupMyPC.A
K7 AntiVirus	13.202.15530	Unwanted-Program
K7GW	13.202.15530	Unwanted-Program ( 004a8e8b1 )
Kaspersky	14.0.0.2199	not-a-virus:RiskTool.Win32.BackupMyPC
Trend Micro	10.465.13	ADW_MYPCBACKUP
Panda Antivirus	4.6.4.2	PUP/MyPCBackup

Software Behaviors

Services:

BackupStack.exe runs as a service named 'Computer Backup (MyPC Backup)' (BackupStack).

Firewall:

MyPC Backup.exe is added as a firewall exception for 'C:\Program Files\MyPC Backup\MyPC Backup.exe'.

Scheduled tasks:

MyPC Backup.exe is scheduled as a task named 'LaunchApp' (runs monthly on Tuesdays at 7:53 AM).
Signup Wizard.exe is scheduled as a task named 'LaunchSignup' (runs monthly on Tuesdays at 8:41 PM).
uninst.exe is scheduled as a task with the class '{407B1493-012F-4ED0-9C36-CCDB1587665F}' (runs on registration).

Software Details

URL:

https://www.mypcbackup.com

Support:

https://support.mypcbackup.com

Installation path:

C:\Program Files\mypc backup

Uninstaller:

C:\Program Files\MyPC Backup\uninst.exe

Size:

27.00 MB

Language:

English

MyPC Backup Executable Details

Primary executable:

MyPC Backup.exe

Name:

MyPC Backup

Path:

C:\Program Files\mypc backup\MyPC Backup.exe

MD5:

732761dfcfad0863e216931e29c75630

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

uninst.exe

Malware

461420b8a9a8546ba3b9d4bf1e88ce49

EXE

Updater.exe

aa609c085da8fd87fd8dfc98e702c00f

DLL

Updater.dll

1f2ff331749c95d76c2cb42ce5391e58

DLL

Newtonsoft.Json.Net20.dll

c8f23b2e1a611e58726c9606ea55e985

DLL

alphafs.dll

cdf7fd58dd52c854ddbe7aeaa6417e8c

DLL

Ionic.Zip.dll

c40ebac4346522a0f69af12b00e2dd6f

EXE

RestartExplorer.exe

158c16d067a3e27c1234b03aa69120b2

EXE

RegisterExtensionDotNet20_x86.exe

74a8c01b69adedd7f1330245cd994821

EXE

RegisterExtensionDotNet20_x64.exe

4bb211393828d585cb5396a273008d94

DLL

MPCBIconOverlays.dll

df27c73d54e7a9a99de263b02b10abe4

File Type	Filename	MD5
EXE	uninst.exe Malware	461420b8a9a8546ba3b9d4bf1e88ce49
EXE	Updater.exe	aa609c085da8fd87fd8dfc98e702c00f
DLL	Updater.dll	1f2ff331749c95d76c2cb42ce5391e58
DLL	Newtonsoft.Json.Net20.dll	c8f23b2e1a611e58726c9606ea55e985
DLL	alphafs.dll	cdf7fd58dd52c854ddbe7aeaa6417e8c
DLL	Ionic.Zip.dll	c40ebac4346522a0f69af12b00e2dd6f
EXE	RestartExplorer.exe	158c16d067a3e27c1234b03aa69120b2
EXE	RegisterExtensionDotNet20_x86.exe	74a8c01b69adedd7f1330245cd994821
EXE	RegisterExtensionDotNet20_x64.exe	4bb211393828d585cb5396a273008d94
DLL	MPCBIconOverlays.dll	df27c73d54e7a9a99de263b02b10abe4