We received the file WINWEBPROTECTION.DLL and detected that WINWEBPROTECTION.DLL is not good.
WINWEBPROTECTION.DLL is Adware. You should remove the file WINWEBPROTECTION.DLL.
Kill the process WINWEBPROTECTION.DLL and remove WINWEBPROTECTION.DLL from Windows.
Malware Analysis of WINWEBPROTECTION.DLL
Full path on a computer: %Common Appdata%\WinWeb protection\WinWebprotection.dll
Detected by UnHackMe:
WINWEBPROTECTION.DLL
Default location: %Common Appdata%\WinWeb protection\WinWebprotection.dll
Removal Results: Success
Number of reboot: 1
WINWEBPROTECTION.DLL is known as:
Adware.SProtector.D
WINWEBPROTECTION.DLL hash:
- MD5: 7c40d33afcca97e2f98ea71663ef0af0
The file tries to connect to the dangerous web site.
How to quickly detect WINWEBPROTECTION.DLL presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKLM\System\CurrentControlSet\Services\84f07a66\ImagePath: “”%SysDir%\rundll32.exe” “c:\docume~1\alluse~1\applic~1\winweb~1\WinWebprotectionSvc.dll”,service”
- HKLM\System\CurrentControlSet\Services\84f07a66\DisplayName: “WinWeb protection”
- HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs: “c:\docume~1\alluse~1\applic~1\winweb~1\winweb~1.dll”
Folders:- %Common Appdata%\WinWeb protection
Files:- %Temp%\__tmp_152ab627
- %Common Appdata%\WinWeb protection\WinWebprotection.dll
- %Common Appdata%\WinWeb protection\WinWebprotectionSvc.dll