What is Wifi Protector BI?

Wifi Protector BI is software application developed by WFprotect. It is most commonly found on computers running Windows 7 with nearly 77.42% of installations running this operating system. Wifi Protector BI's installer is typically 9.00 MB in size and installs around 348 files. The most common release is 1.34.8.12 with 46.77% of all installations currently using this version.

Wifi Protector BI is most popular in Brazil with 58.21% of installations residing in this country.

Wifi Protector BI adds 6 scheduled tasks to the Windows Task Scheduler launching the program at randomly scheduled times.

Multiple virus scanners have detected malware in Wifi Protector BI.

Wifi Protector BI-firefoxinstaller.exe (MD5: 11201274bced423a0ea8e90102bd069a) has been flagged by 29 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	806	Adware.Generic.1009856
AegisLab	1.5	Troj.W32.Gen
avast!	2014.9-141121	Win32:Crossrider-AI [PUP]
AVG	2015.0.3284	Generic5
Avira	7.11.183.52	ADWARE/CrossRider.Gen2
AVware	1.5.0.21	Crossrider (fs)
Baidu-International	4.0.3.141121	Adware.Win32.CrossRider.bJ
Bitdefender	1.0.20.1625	Adware.Generic.1009856
Dr.Web	9.0.0.0325	Trojan.Crossrider.27966
Emsisoft Anti-Malware	8.14.11.21.05	Adware.Generic.1009856
ESET-NOD32	8.10672	a variant of Win32/Toolbar.CrossRider.J
F-Prot	v6.4.7.1.166	W32/A-eb9ef301
F-Secure	11.2014-21-11_6	Adware.Generic.1009856
G Data	14.11.24	Adware.Generic.1009856
Malwarebytes	v2014.11.21.05	PUP.Optional.WifiProtector.A
McAfee	5600.6940	Artemis!11201274BCED
McAfee-GW-Edition	7.6940	BehavesLike.Win32.AdwareCross.bh
MicroWorld-eScan	15.0.0.975	Adware.Generic.1009856
NANO AntiVirus	0.28.6.62995	Trojan.Win32.Crossrider.ddxixk
Symantec	11/21/2014 rev. 6	Adware.FindLyrics
Trend Micro	10.465.21	TROJ_GEN.R0C1C0OJU14
TrendMicro-HouseCall	7.2.325	TROJ_GEN.R0C1C0OJU14
VIPRE Antivirus	34526	Crossrider (fs)
Zillya	2.0.0.1975	Adware.Lyckriks.Win32.676
Bkav FE	1.3.0.4613	W32.Clod9ca.Trojan.9bee
K7 AntiVirus	9.175.10750	Trojan ( 0048c18f1 )
K7GW	9.175.10750	Trojan ( 0048c18f1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
Norman	7.03.02	Suspicious_Gen4.FKHBN

Wifi Protector BI-codedownloader.exe (MD5: a9aad59f364736f31469c55fd185e76b) has been flagged by 4 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	HackTool.Win32.CrossRider.K
ESET-NOD32	9062	a variant of Win32/Toolbar.CrossRider.K
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
VIPRE Antivirus	23488	Crossrider (fs)

Wifi Protector BI-chromeinstaller.exe (MD5: 70b72abcece3442dd5271240b95ada58) has been flagged by 10 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	Trojan.Win32.Toolbar.CrossRider.J
ESET-NOD32	9031	a variant of Win32/Toolbar.CrossRider.J
K7 AntiVirus	9.173.10137	Trojan ( 0048c68d1 )
K7GW	9.173.10137	Trojan ( 0048c68d1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
McAfee	5.600.0.1067	Artemis!70B72ABCECE3
McAfee-GW-Edition	2013	Artemis!70B72ABCECE3
Symantec	20131.1.5.61	WS.Reputation.1
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1025
VIPRE Antivirus	23258	Crossrider (fs)

Wifi Protector BI-bho.dll (MD5: 4a8fa2692155aeaa21c0487c8453a780) has been flagged by 12 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	HackTool.Win32.CrossRider.H
Bkav FE	1.3.0.4613	W32.Clod9ca.Trojan.9bee
ESET-NOD32	9257	a variant of Win32/Toolbar.CrossRider.H
K7 AntiVirus	9.175.10750	Trojan ( 0048c18f1 )
K7GW	9.175.10750	Trojan ( 0048c18f1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
McAfee	5.600.0.1067	Artemis!4A8FA2692155
McAfee-GW-Edition	2013	Artemis!4A8FA2692155
Norman	7.03.02	Suspicious_Gen4.FKHBN
Symantec	20131.1.5.61	Adware.Crossid
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1025
VIPRE Antivirus	25158	Crossrider (fs)

Software Behaviors

Scheduled tasks:

270fdbee-632c-4089-9663-52c1b42da3ab-7.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-1'.
4bfce921-50c8-436d-8632-66ea3157fd1f.exe is scheduled as a task named 'temp_4bfce921-50c8-436d-8632-66ea3157fd1f'.
270fdbee-632c-4089-9663-52c1b42da3ab-6.exe is scheduled as a task named 'temp_270fdbee-632c-4089-9663-52c1b42da3ab-6'.
270fdbee-632c-4089-9663-52c1b42da3ab-5.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-5_user'.
270fdbee-632c-4089-9663-52c1b42da3ab-4.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-4'.
270fdbee-632c-4089-9663-52c1b42da3ab-2.exe is scheduled as a task named 'temp_270fdbee-632c-4089-9663-52c1b42da3ab-2'.

Startup Entries

Startup tasks:

2c916b1c-c976-4b46-93ff-f874e596d246-11.exe is automatically launched at startup through a scheduled task named 2c916b1c-c976-4b46-93ff-f874e596d246-11.
367e345e-ea74-42a0-b5c3-60afdeed8df9-7.exe is automatically launched at startup through a scheduled task named ef992c94-8901-4b49-851e-928aee493a0e-1.
367e345e-ea74-42a0-b5c3-60afdeed8df9-6.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-6.
367e345e-ea74-42a0-b5c3-60afdeed8df9-5.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-5_user.
367e345e-ea74-42a0-b5c3-60afdeed8df9-4.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-4.
367e345e-ea74-42a0-b5c3-60afdeed8df9-11.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-11.

Software Details

URL:

–

Support:

–

Installation path:

C:\Program Files\wifi protector bi

Uninstaller:

C:\Program Files\Wifi Protector BI\Uninstall.exe /fcp=1

Size:

9.00 MB

Language:

English

Wifi Protector BI Executable Details

Primary executable:

utils.exe

Name:

Wifi Protector BI

Path:

C:\Program Files\wifi protector bi\utils.exe

MD5:

–

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

XPI

ebf0ceb7-ba29-4f4c-8e5e-8ebf0ed281cb.xpi

9a64c3e62c7861518b394b85b4c17055

DLL

98ce88f8-c180-4c95-9e20-f1c1920338b2.dll

1a2d066c3a9d6b986845882eb564ed0d

EXE

9dc922a9-ac67-4dc0-8a47-999a8ac8ed26-11.exe

429bf7810bbcf323c426c8714ff2c539

EXE

9dc922a9-ac67-4dc0-8a47-999a8ac8ed26-2.exe

bd396272d033ae4922a0d22c18ef4139

EXE

9dc922a9-ac67-4dc0-8a47-999a8ac8ed26-4.exe

96e84e085d9c25a8cafae93b58c582ee

EXE

9dc922a9-ac67-4dc0-8a47-999a8ac8ed26-5.exe

a76f73435d0d338745cc537d3696a060

EXE

9dc922a9-ac67-4dc0-8a47-999a8ac8ed26-6.exe

3833f9aec76bd2df0028859de84948c6

EXE

9dc922a9-ac67-4dc0-8a47-999a8ac8ed26-64.exe

571048a6cbc55387efbd89c03a76050d

EXE

9dc922a9-ac67-4dc0-8a47-999a8ac8ed26-7.exe

c7a594e405fc32f6e59aa658e9a3bd12

EXE

c2376eae-f09a-47eb-a200-5188e4cd3cec.exe

b24aad6dd651887c495ee727e6ad77de