What is Wifi Protector BI?

Wifi Protector BI is software application developed by WFprotect. It is most commonly found on computers running Windows 7 with nearly 77.42% of installations running this operating system. Wifi Protector BI's installer is typically 9.00 MB in size and installs around 348 files. The most common release is 1.34.8.12 with 46.77% of all installations currently using this version.

Wifi Protector BI is most popular in Brazil with 58.21% of installations residing in this country.

Wifi Protector BI adds 6 scheduled tasks to the Windows Task Scheduler launching the program at randomly scheduled times.

Multiple virus scanners have detected malware in Wifi Protector BI.

Wifi Protector BI-firefoxinstaller.exe (MD5: 11201274bced423a0ea8e90102bd069a) has been flagged by 29 scanners:

Scanner Software	Version	Result
Lavasoft Ad-Aware	806	Adware.Generic.1009856
AegisLab	1.5	Troj.W32.Gen
avast!	2014.9-141121	Win32:Crossrider-AI [PUP]
AVG	2015.0.3284	Generic5
Avira	7.11.183.52	ADWARE/CrossRider.Gen2
AVware	1.5.0.21	Crossrider (fs)
Baidu-International	4.0.3.141121	Adware.Win32.CrossRider.bJ
Bitdefender	1.0.20.1625	Adware.Generic.1009856
Dr.Web	9.0.0.0325	Trojan.Crossrider.27966
Emsisoft Anti-Malware	8.14.11.21.05	Adware.Generic.1009856
ESET-NOD32	8.10672	a variant of Win32/Toolbar.CrossRider.J
F-Prot	v6.4.7.1.166	W32/A-eb9ef301
F-Secure	11.2014-21-11_6	Adware.Generic.1009856
G Data	14.11.24	Adware.Generic.1009856
Malwarebytes	v2014.11.21.05	PUP.Optional.WifiProtector.A
McAfee	5600.6940	Artemis!11201274BCED
McAfee-GW-Edition	7.6940	BehavesLike.Win32.AdwareCross.bh
MicroWorld-eScan	15.0.0.975	Adware.Generic.1009856
NANO AntiVirus	0.28.6.62995	Trojan.Win32.Crossrider.ddxixk
Symantec	11/21/2014 rev. 6	Adware.FindLyrics
Trend Micro	10.465.21	TROJ_GEN.R0C1C0OJU14
TrendMicro-HouseCall	7.2.325	TROJ_GEN.R0C1C0OJU14
VIPRE Antivirus	34526	Crossrider (fs)
Zillya	2.0.0.1975	Adware.Lyckriks.Win32.676
Bkav FE	1.3.0.4613	W32.Clod9ca.Trojan.9bee
K7 AntiVirus	9.175.10750	Trojan ( 0048c18f1 )
K7GW	9.175.10750	Trojan ( 0048c18f1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
Norman	7.03.02	Suspicious_Gen4.FKHBN

Wifi Protector BI-codedownloader.exe (MD5: a9aad59f364736f31469c55fd185e76b) has been flagged by 4 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	HackTool.Win32.CrossRider.K
ESET-NOD32	9062	a variant of Win32/Toolbar.CrossRider.K
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
VIPRE Antivirus	23488	Crossrider (fs)

Wifi Protector BI-chromeinstaller.exe (MD5: 70b72abcece3442dd5271240b95ada58) has been flagged by 10 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	Trojan.Win32.Toolbar.CrossRider.J
ESET-NOD32	9031	a variant of Win32/Toolbar.CrossRider.J
K7 AntiVirus	9.173.10137	Trojan ( 0048c68d1 )
K7GW	9.173.10137	Trojan ( 0048c68d1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
McAfee	5.600.0.1067	Artemis!70B72ABCECE3
McAfee-GW-Edition	2013	Artemis!70B72ABCECE3
Symantec	20131.1.5.61	WS.Reputation.1
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1025
VIPRE Antivirus	23258	Crossrider (fs)

Wifi Protector BI-bho.dll (MD5: 4a8fa2692155aeaa21c0487c8453a780) has been flagged by 12 scanners:

Scanner Software	Version	Result
Baidu-International	3.5.1.41473	HackTool.Win32.CrossRider.H
Bkav FE	1.3.0.4613	W32.Clod9ca.Trojan.9bee
ESET-NOD32	9257	a variant of Win32/Toolbar.CrossRider.H
K7 AntiVirus	9.175.10750	Trojan ( 0048c18f1 )
K7GW	9.175.10750	Trojan ( 0048c18f1 )
Kingsoft AntiVirus	2013.4.9.267	Win32.Troj.Generic.a.(kcloud)
McAfee	5.600.0.1067	Artemis!4A8FA2692155
McAfee-GW-Edition	2013	Artemis!4A8FA2692155
Norman	7.03.02	Suspicious_Gen4.FKHBN
Symantec	20131.1.5.61	Adware.Crossid
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1025
VIPRE Antivirus	25158	Crossrider (fs)

Software Behaviors

Scheduled tasks:

270fdbee-632c-4089-9663-52c1b42da3ab-7.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-1'.
4bfce921-50c8-436d-8632-66ea3157fd1f.exe is scheduled as a task named 'temp_4bfce921-50c8-436d-8632-66ea3157fd1f'.
270fdbee-632c-4089-9663-52c1b42da3ab-6.exe is scheduled as a task named 'temp_270fdbee-632c-4089-9663-52c1b42da3ab-6'.
270fdbee-632c-4089-9663-52c1b42da3ab-5.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-5_user'.
270fdbee-632c-4089-9663-52c1b42da3ab-4.exe is scheduled as a task named '270fdbee-632c-4089-9663-52c1b42da3ab-4'.
270fdbee-632c-4089-9663-52c1b42da3ab-2.exe is scheduled as a task named 'temp_270fdbee-632c-4089-9663-52c1b42da3ab-2'.

Startup Entries

Startup tasks:

2c916b1c-c976-4b46-93ff-f874e596d246-11.exe is automatically launched at startup through a scheduled task named 2c916b1c-c976-4b46-93ff-f874e596d246-11.
367e345e-ea74-42a0-b5c3-60afdeed8df9-7.exe is automatically launched at startup through a scheduled task named ef992c94-8901-4b49-851e-928aee493a0e-1.
367e345e-ea74-42a0-b5c3-60afdeed8df9-6.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-6.
367e345e-ea74-42a0-b5c3-60afdeed8df9-5.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-5_user.
367e345e-ea74-42a0-b5c3-60afdeed8df9-4.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-4.
367e345e-ea74-42a0-b5c3-60afdeed8df9-11.exe is automatically launched at startup through a scheduled task named 367e345e-ea74-42a0-b5c3-60afdeed8df9-11.

Software Details

URL:

–

Support:

–

Installation path:

C:\Program Files\wifi protector bi

Uninstaller:

C:\Program Files\Wifi Protector BI\Uninstall.exe /fcp=1

Size:

9.00 MB

Language:

English

Wifi Protector BI Executable Details

Primary executable:

utils.exe

Name:

Wifi Protector BI

Path:

C:\Program Files\wifi protector bi\utils.exe

MD5:

–

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

EXE

03c49bb1-7ce4-4804-bb66-6d5d1a5af21e-4.exe

571d8b824b111059f45c1c80bba755f3

EXE

03c49bb1-7ce4-4804-bb66-6d5d1a5af21e-2.exe

d319b6ce281e090df8d42ae6f5776eb1

EXE

03c49bb1-7ce4-4804-bb66-6d5d1a5af21e-11.exe

457123d53d796b01826b09854dfb7750

EXE

7c61d8a9-7c67-4fca-8f2a-fef5a21e25a8.exe

324703ac78a2dcc636e5172cd39a126e

EXE

96b07ce1-12d8-41df-b30b-ff680daa1f92.exe

c8244ca97fd13faef8b80ca31879e1b5

CRX

a04fdada-88ad-4de0-9d24-61157ee2b4fa.crx

481dea4c346171a5b88bcb4fa0ccc892

DLL

bfcf8c3e-6770-49f7-8875-3ef5c5c54ed4.dll

f08f980f13b2193e9ff87293918acb0a

EXE

ea6cb054-5fe4-4f2c-83c3-4667ba430c84-11.exe

4c3b49590fe47965f3e2beb084045379

EXE

ea6cb054-5fe4-4f2c-83c3-4667ba430c84-2.exe

dc86f780ba7484b0db0c47685f0409c7

EXE

ea6cb054-5fe4-4f2c-83c3-4667ba430c84-4.exe

8bb3d0bcbf0f385974064e7efd80d9bf