What is Wifi Protector BI?

Wifi Protector BI is software application developed by WFprotect. It is most commonly found on computers running Windows 7 with nearly 77.42% of installations running this operating system. Wifi Protector BI's installer is typically 9.00 MB in size and installs around 348 files. The most common release is 1.34.8.12 with 46.77% of all installations currently using this version.

Wifi Protector BI is most popular in Brazil with 58.21% of installations residing in this country.

Wifi Protector BI adds 6 scheduled tasks to the Windows Task Scheduler launching the program at randomly scheduled times.

Multiple virus scanners have detected malware in Wifi Protector BI.

Wifi Protector BI-firefoxinstaller.exe (MD5: 11201274bced423a0ea8e90102bd069a) has been flagged by 29 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	806	Adware.Generic.1009856
AegisLab	1.5	Troj.W32.Gen
avast!	2014.9-141121	Win32:Crossrider-AI [PUP]
AVG	2015.0.3284	Generic5
Avira	7.11.183.52	ADWARE/CrossRider.Gen2
AVware	1.5.0.21	Crossrider (fs)
Baidu-International	4.0.3.141121	Adware.Win32.CrossRider.bJ
Bitdefender	1.0.20.1625	Adware.Generic.1009856
Dr.Web	9.0.0.0325	Trojan.Crossrider.27966
Emsisoft Anti-Malware	8.14.11.21.05	Adware.Generic.1009856
ESET-NOD32	8.10672	a variant of Win32/Toolbar.CrossRider.J
F-Prot	v6.4.7.1.166	W32/A-eb9ef301
F-Secure	11.2014-21-11_6	Adware.Generic.1009856
G Data	14.11.24	Adware.Generic.1009856
Malwarebytes	v2014.11.21.05	PUP.Optional.WifiProtector.A
McAfee	5600.6940	Artemis!11201274BCED
McAfee-GW-Edition	7.6940	BehavesLike.Win32.AdwareCross.bh
MicroWorld-eScan	15.0.0.975	Adware.Generic.1009856
NANO AntiVirus	0.28.6.62995	Trojan.Win32.Crossrider.ddxixk
Symantec	11/21/2014 rev. 6	Adware.FindLyrics
Trend Micro	10.465.21	TROJ_GEN.R0C1C0OJU14
TrendMicro-HouseCall	7.2.325	TROJ_GEN.R0C1C0OJU14
VIPRE Antivirus	34526	Crossrider (fs)
Zillya	2.0.0.1975	Adware.Lyckriks.Win32.676
Bkav FE	1.3.0.4613	W32.Clod9ca.Trojan.9bee
K7 AntiVirus	9.175.10750	Trojan ( 0048c18f1 )
K7GW	9.175.10750	Trojan ( 0048c18f1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
Norman	7.03.02	Suspicious_Gen4.FKHBN

Wifi Protector BI-codedownloader.exe (MD5: a9aad59f364736f31469c55fd185e76b) has been flagged by 4 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	HackTool.Win32.CrossRider.K
ESET-NOD32	9062	a variant of Win32/Toolbar.CrossRider.K
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
VIPRE Antivirus	23488	Crossrider (fs)

Wifi Protector BI-chromeinstaller.exe (MD5: 70b72abcece3442dd5271240b95ada58) has been flagged by 10 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	Trojan.Win32.Toolbar.CrossRider.J
ESET-NOD32	9031	a variant of Win32/Toolbar.CrossRider.J
K7 AntiVirus	9.173.10137	Trojan ( 0048c68d1 )
K7GW	9.173.10137	Trojan ( 0048c68d1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
McAfee	5.600.0.1067	Artemis!70B72ABCECE3
McAfee-GW-Edition	2013	Artemis!70B72ABCECE3
Symantec	20131.1.5.61	WS.Reputation.1
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1025
VIPRE Antivirus	23258	Crossrider (fs)

Wifi Protector BI-bho.dll (MD5: 4a8fa2692155aeaa21c0487c8453a780) has been flagged by 12 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	HackTool.Win32.CrossRider.H
Bkav FE	1.3.0.4613	W32.Clod9ca.Trojan.9bee
ESET-NOD32	9257	a variant of Win32/Toolbar.CrossRider.H
K7 AntiVirus	9.175.10750	Trojan ( 0048c18f1 )
K7GW	9.175.10750	Trojan ( 0048c18f1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
McAfee	5.600.0.1067	Artemis!4A8FA2692155
McAfee-GW-Edition	2013	Artemis!4A8FA2692155
Norman	7.03.02	Suspicious_Gen4.FKHBN
Symantec	20131.1.5.61	Adware.Crossid
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1025
VIPRE Antivirus	25158	Crossrider (fs)

Software Behaviors

Scheduled tasks:

270fdbee-632c-4089-9663-52c1b42da3ab-7.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-1'.
4bfce921-50c8-436d-8632-66ea3157fd1f.exe is scheduled as a task named 'temp_4bfce921-50c8-436d-8632-66ea3157fd1f'.
270fdbee-632c-4089-9663-52c1b42da3ab-6.exe is scheduled as a task named 'temp_270fdbee-632c-4089-9663-52c1b42da3ab-6'.
270fdbee-632c-4089-9663-52c1b42da3ab-5.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-5_user'.
270fdbee-632c-4089-9663-52c1b42da3ab-4.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-4'.
270fdbee-632c-4089-9663-52c1b42da3ab-2.exe is scheduled as a task named 'temp_270fdbee-632c-4089-9663-52c1b42da3ab-2'.

Startup Entries

Startup tasks:

2c916b1c-c976-4b46-93ff-f874e596d246-11.exe is automatically launched at startup through a scheduled task named 2c916b1c-c976-4b46-93ff-f874e596d246-11.
367e345e-ea74-42a0-b5c3-60afdeed8df9-7.exe is automatically launched at startup through a scheduled task named ef992c94-8901-4b49-851e-928aee493a0e-1.
367e345e-ea74-42a0-b5c3-60afdeed8df9-6.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-6.
367e345e-ea74-42a0-b5c3-60afdeed8df9-5.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-5_user.
367e345e-ea74-42a0-b5c3-60afdeed8df9-4.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-4.
367e345e-ea74-42a0-b5c3-60afdeed8df9-11.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-11.

Software Details

URL:

–

Support:

–

Installation path:

C:\Program Files\wifi protector bi

Uninstaller:

C:\Program Files\Wifi Protector BI\Uninstall.exe /fcp=1

Size:

9.00 MB

Language:

English

Wifi Protector BI Executable Details

Primary executable:

utils.exe

Name:

Wifi Protector BI

Path:

C:\Program Files\wifi protector bi\utils.exe

MD5:

–

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60-11.exe

d96bfc59420d158465c17dc054f42663

EXE

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60-2.exe

ee5cff6a7cce12d07d7085e6eb6cdbbe

EXE

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60-4.exe

9456df36a6690d8f8960757925324f96

EXE

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60-5.exe

28adb1a19cec396d81378b551201a7c0

EXE

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60-6.exe

0e4798f7ec266d19b7878f5eebbbef09

EXE

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60-64.exe

46d0fe00e07bb48e12556a9bb5021703

EXE

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60-7.exe

6f4ddaecc66f53ebbc7c92083dfcc47b

CRX

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60.crx

e04f655fb06f07fe46fb2284a217b82d

XPI

f89b1486-c6b4-4e5d-ae2b-4f6feadf2a60.xpi

08826bb90912881c4195804aad2db10b

DLL

354737ed-0928-466d-b34e-4ca9ca437113.dll

c4b67c3474ceee4cd9a85146c6ae0ea6