McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.
See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program". It purports to be an system repair/maintenance application, but requires paid registration before any issues found can be fixed. Many of the "invalid" items found appear suspect. This has been reported to be distributed in wild via trojan Vundo. Other incarnations of this software exist with the same model and similar web presences (for example WinFixer). When trojan Vundo is installed following installation screen is presented.

Privacy and EULA

No privacy policy or EULA is displayed during installation. However, both can be accessed online: http://www.sysprotect.com

System Changes

General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files
"*" - Denotes files that, though installed along with the software, are by themselves innocent and not included in detection.

Files Added

%ProgramFiles%\SysProtect\Activate.dat
%ProgramFiles%\SysProtect\bnlink.dat
%ProgramFiles%\SysProtect\compclr.dll
%ProgramFiles%\SysProtect\DataBase.sav
%ProgramFiles%\SysProtect\df_fixer.dll
%ProgramFiles%\SysProtect\df_proxy.dll
%ProgramFiles%\SysProtect\FFWrapr.dll
%ProgramFiles%\SysProtect\flash.ini
%ProgramFiles%\SysProtect\flfxr10.dll
%ProgramFiles%\SysProtect\FTRec.dll
%ProgramFiles%\SysProtect\FxCore.dll
%ProgramFiles%\SysProtect\Install.exe
%ProgramFiles%\SysProtect\lapv.dat
%ProgramFiles%\SysProtect\License.rtf
%ProgramFiles%\SysProtect\lock.dat
%ProgramFiles%\SysProtect\MMFx.dll
%ProgramFiles%\SysProtect\Program.sav
%ProgramFiles%\SysProtect\pv.dat
%ProgramFiles%\SysProtect\sr.exe
%ProgramFiles%\SysProtect\sr.log
%ProgramFiles%\SysProtect\sscan.sys
%ProgramFiles%\SysProtect\StrRes.dll
%ProgramFiles%\SysProtect\SYP.exe
%ProgramFiles%\SysProtect\SYP.url
%ProgramFiles%\SysProtect\Template.dbx
%ProgramFiles%\SysProtect\trace.log
%ProgramFiles%\SysProtect\unins000.dat
%ProgramFiles%\SysProtect\unins000.exe
%SystemDir%\drivers\sscan.sys
%ProgramFiles%\Common Files\SysProtect\PCheck.dll
C:\Documents and Settings\All Users\Start Menu\Programs\SysProtect\SysProtect on the Web.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SysProtect\SysProtect.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\SysProtect\Uninstall SysProtect.lnk

Registry Added

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysProtect: "%ProgramFiles%\SysProtect\syp.exe /scan"
• HKEY_LOCAL_MACHINE\SOFTWARE\SysProtect
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SYP_is1\UninstallString: ""%ProgramFiles%\SysProtect\unins000.exe""
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SYP_is1\QuietUninstallString: ""%ProgramFiles%\SysProtect\unins000.exe" /SILENT"
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sscan\ImagePath: "\??\%SystemDir%\drivers\sscan.sys"
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\CheckProduct2_1.DLL
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\compclr.dll
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\FFWrapr.DLL
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\FxCore.DLL
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MMFxCtrl.DLL
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1C02CE6B-CC12-4ea1-B2D8-113F611F25C2}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4F5E5D72-C915-4f3b-908B-527D064B0FAA}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8A1E94DA-725D-4f64-B110-DB3F73ADB6F7}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{E7E155EE-EEF2-46af-99B7-65F1269DC3CF}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EE10A303-0C60-4acb-A033-95A790FA4DCD}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D178DBE-C867-417f-8A4E-D5DEFA4CD4E7}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C8416A2-2408-4f4d-8D26-EC9A07E8DC98}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C102B96-4845-4756-991E-4F9294965536}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9CB12DAD-32C7-4f34-9758-C9FDD26D4D22}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1EA2421-BC9A-4546-943C-126F9D818EFB}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3E2988E-1433-469d-BFC1-4080D131FE1A}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF080118-CDA5-429d-A8BD-EC7ECA74663F}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3377825-230D-4a12-805C-132557FA1A8B}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7136B99-FC27-4DC1-8497-5444D49B426A}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD45A464-7763-43EE-A756-5F2C93B0CF5E}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E4A3F67D-5237-43fa-B3F2-41C37C1204B9}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E78EA05B-B6A7-4dc4-879D-444DCD224CB4}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF130E77-0A34-4365-BFB7-218FD3DDCD5F}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDA9BFC7-4ECD-43a0-AC1E-2E7DDE0C81B0}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02946FD1-2D99-46E6-A790-3A089714EDD9}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BEA1806-F5C7-4696-B0A0-26CFD6A958DD}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{258E07A2-FF65-493B-B6BD-421A1F2992A3}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{258E07A2-FF65-493B-B6BD-421A1F2992A3}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B6A7638-0999-4924-93B7-C5738E1BAEE1}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5585C185-B318-4072-A00D-8385F443AE07}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{622423BD-B825-4989-BA65-86D0B990D328}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7516C86C-2F3D-4724-BD4E-1608F1BDAE12}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8E0A02C1-974F-4379-BFD3-69FFB9E0659D}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9793B356-4337-44AC-9A22-DF6A7930602C}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1DDDD67-64B2-4CAB-BE0B-E34F3F12AED0}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A56B6D30-FDE0-42A9-BE6B-18B5D3F2F519}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6E398B2-A288-4D76-B0D0-8F153D14B66E}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B22EE952-9A58-4495-AE78-C0146FA1A3C7}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C1EA2421-BC9A-4546-943C-126F9D818EFB}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C3896A1E-8ECD-490B-8A1C-39FE9F7D64A1}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C88B2356-A6FE-41EC-B0FB-41F2C82C867E}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7136B99-FC27-4DC1-8497-5444D49B426A}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DE3C77B8-7378-4A4C-B6F8-4A008B4A6009}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E95F8133-A554-4C0C-9B9A-EEEE3B82CEDE}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F18701B3-185D-42FD-A55E-F47FDAC8F362}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9AC5167-2C13-4607-B924-81C1C2251C84}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB752175-36D8-4792-9302CFB8018C0DEC}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{03A78DBD-AA12-4DB4-AB2C-564460D385DC}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{09AF1CF9-825C-4017-A7DC-088C68770F31}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{223CEDCA-738B-4C4D-B8AE-C68B68C90A4A}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{223CEDCA-738B-4C4D-B8AE-C68B68C90A4A}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5940CA88-8F1A-4A74-89E4-B3407E5E7348}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{61C1FC79-7120-4824-A563-D4D11D80BAFB}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7EACF70B-302F-4049-AC68-2D62EB43E473}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8C9AD38-7708-4BEB-A20C-B79614B4F120}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FB42F450-C8B1-4799-99F1-87FA9CA92AB9}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CheckProd.CheckProduct
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.AppCleaner
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.CCQuickScan
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.CCQuickScan.1
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.FileCleaner
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.FileCleaner.1
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.InetCleaner\CLSID
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.InetCleaner.1
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.RegCleaner
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.RegCleaner.1
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.SystemCleaner
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ComCleanCore.SystemCleaner.1
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\df_fixr.Fixer
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FFWraper.FFEnginWrapr
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FixCor.MMFixCore
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FlFxr10.FlFixer10
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMFixCtrl.CoFixEngin2
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\sscan.sys
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\sscan.sys
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sscan.sys
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sscan.sys

 Network Impact

Additional overhead in bandwidth due to possible download of updates or other content.

Removal

Aliases

Aliases

N/A