What is ASCPlugin_Protection.dll?

ASCPlugin_Protection.dll is part of Surfing Protection and developed by IObit according to the ASCPlugin_Protection.dll version information.

ASCPlugin_Protection.dll's description is "Plugin_Protection"

ASCPlugin_Protection.dll is digitally signed by IObit Information Technology.

ASCPlugin_Protection.dll is usually located in the 'C:\PROGRA~2\IObit\Advanced SystemCare\Surfing Protection\BrowerProtect\' folder.

Some of the anti-virus scanners at VirusTotal detected ASCPlugin_Protection.dll.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

VirusTotal report

3 of the 69 anti-virus programs at VirusTotal detected the ASCPlugin_Protection.dll file. That's a 4% detection rate.

Scanner	Detection Name
DrWeb	Program.Unwanted.2520
eGambit	PUP.Optional.IObit
GData	Win32.Application.iObit.B

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "file_opened": [
        "C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui"
    ],
    "file_exists": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\35a734f0f4c7c63d128ea2e766ad91793a417f2810f5dfb28b2e4ccd5a17e897.bin.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\35a734f0f4c7c63d128ea2e766ad91793a417f2810f5dfb28b2e4ccd5a17e897.bin.dll.manifest"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\WMR\\Disable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
    ],
    "dll_loaded": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\35a734f0f4c7c63d128ea2e766ad91793a417f2810f5dfb28b2e4ccd5a17e897.bin.dll"
    ]
}

Generic

[
    {
        "process_path": "C:\\Windows\\SysWOW64\\rundll32.exe",
        "process_name": "rundll32.exe",
        "pid": 1512,
        "summary": {
            "file_opened": [
                "C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui"
            ],
            "file_exists": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\35a734f0f4c7c63d128ea2e766ad91793a417f2810f5dfb28b2e4ccd5a17e897.bin.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\35a734f0f4c7c63d128ea2e766ad91793a417f2810f5dfb28b2e4ccd5a17e897.bin.dll.manifest"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\WMR\\Disable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
            ],
            "dll_loaded": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\35a734f0f4c7c63d128ea2e766ad91793a417f2810f5dfb28b2e4ccd5a17e897.bin.dll"
            ]
        },
        "first_seen": 1571835185.875,
        "ppid": 1564
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1571835185.5938,
        "ppid": 376
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "The executable contains unknown PE section names indicative of a packer (could be a false positive)",
        "severity": 1,
        "marks": [
            {
                "category": "section",
                "ioc": ".itext",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_features"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Foreign language identified in PE resource",
        "severity": 2,
        "marks": [
            {
                "name": "RT_MANIFEST",
                "language": "LANG_CHINESE",
                "offset": "0x000e1410",
                "filetype": "XML 1.0 document, ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x0000043e"
            }
        ],
        "references": [],
        "name": "origin_langid"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 662,
            "time": 6.2081611156464,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5190,
            "time": 6.1568109989166,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5518,
            "time": 4.1472520828247,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5846,
            "time": 6.166876077652,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6174,
            "time": 4.6799111366272,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6502,
            "time": 3.0512502193451,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 6830,
            "time": 4.7263472080231,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 16628,
            "time": 4.1767921447754,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 25012,
            "time": 6.2579791545868,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "e43676e570d8efcf50e4d2710bca7551a3728b48058e44fd90294e803351aa00",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "6e1d8d70587c8ec5a14a5f22c0b90c788629a007402a7d2ca4fef3aadb5ed7dd",
    "irc": [],
    "https_ex": []
}

Screenshots

ASCPlugin_Protection.dll removal instructions

The instructions below shows how to remove ASCPlugin_Protection.dll with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the ASCPlugin_Protection.dll file for removal, restart your computer and scan it again to verify that ASCPlugin_Protection.dll has been successfully removed. Here are the removal instructions in more detail:

1. Download and install FreeFixer: http://www.freefixer.com/download.html
2. Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.

   
3. When the scan is finished, locate ASCPlugin_Protection.dll in the scan result and tick the checkbox next to the ASCPlugin_Protection.dll file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate ASCPlugin_Protection.dll in the scan result.

   

   

   C:\PROGRA~2\IObit\Advanced Sys..rotection\BrowerProtect\ASCPlugin_Protection.dll

   
4. Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the ASCPlugin_Protection.dll file.

   
5. Restart your computer.
6. Start FreeFixer and scan your computer again. If ASCPlugin_Protection.dll still remains in the scan result, proceed with the next step. If ASCPlugin_Protection.dll is gone from the scan result you're done.
7. If ASCPlugin_Protection.dll still remains in the scan result, check its checkbox again in the scan result and click Fix.
8. Restart your computer.
9. Start FreeFixer and scan your computer again. Verify that ASCPlugin_Protection.dll no longer appear in the scan result.

Filename variants

ASCPlugin_Protection.dll may also use other filenames. The most common variants are listed below:

• ASCPLU~1.DLL

Folder name variants

ASCPlugin_Protection.dll may also be located in other folders than C:\PROGRA~2\IObit\Advanced SystemCare\Surfing Protection\BrowerProtect\. The most common variants are listed below:

• C:\PROGRA~2\IObit\ADVANC~1\SURFIN~1\BROWER~1\
• C:\PROGRA~2\IObit\IObit Malware Fighter\Surfing Protection\BrowerProtect\
• C:\PROGRA~2\IObit\ADVANC~2\Surfing Protection\BrowerProtect\
• C:\Users\DELLA9~1\DOWNLO~1\ADVANC~1.220\App\ADVANC~1\SURFIN~1\BROWER~1\
• D:\SOFTWA~1\IOBIT\Advanced SystemCare\Surfing Protection\BrowerProtect\

Other files also named ASCPlugin_Protection.dll

ASCPlugin_Protection.dll (35 votes)

• Privacy Policy