What is vprodefenderl.exe?

vprodefenderl.exe is part of VPro Defender ?? ???? and developed by VDoctor according to the vprodefenderl.exe version information.

vprodefenderl.exe's description is "VPro Defender ?? ????"

vprodefenderl.exe is digitally signed by DivineMedia Inc..

vprodefenderl.exe is usually located in the 'c:\downloads\' folder.

Some of the anti-virus scanners at VirusTotal detected vprodefenderl.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on vprodefenderl.exe:

Property	Value
Product name	VPro Defender ?? ????
Company name	VDoctor
File description	VPro Defender ?? ????
Internal name	vprodefenderl.exe
Original filename	vprodefenderl.exe
Legal copyright	Copyright (C) 2011 VDoctor. All rights reserved
Product version	1.0.0.0
File version	1.0.0.0

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product name	VPro Defender ?? ????
Company name	VDoctor
File description	VPro Defender ?? ????
Internal name	vprodefenderl.exe
Original filename	vprodefenderl.exe
Legal copyright	Copyright (C) 2011 VDoctor. All righ..
Product version	1.0.0.0
File version	1.0.0.0

Digital signatures [?]

vprodefenderl.exe has a valid digital signature.

Property	Value
Signer name	DivineMedia Inc.
Certificate issuer name	Thawte Code Signing CA - G2
Certificate serial number	75e01a79b0f42738a2368ab6d8fe0fbb

VirusTotal report

24 of the 71 anti-virus programs at VirusTotal detected the vprodefenderl.exe file. That's a 34% detection rate.

Scanner	Detection Name
AhnLab-V3	PUP/Win32.VDoctor.R43973
Alibaba	Trojan:Win32/Adkor.3110b96a
Avast	Win32:Adware-AZC [Adw]
AVG	Win32:Adware-AZC [Adw]
Avira	TR/Adkor.targ
Bkav	W32.HfsAdware.5A96
Cylance	Unsafe
DrWeb	Trojan.Adkor.346
Emsisoft	Application.Generic (A)
F-Secure	Trojan.TR/Adkor.targ
Ikarus	PUA.PCPlus
Invincea	heuristic
MAX	malware (ai score=95)
McAfee	Artemis!D5D4D68F96E2
McAfee-GW-Edition	Artemis
Microsoft	PUA:Win32/DivineMedia
Qihoo-360	Win32/Trojan.bbb
Rising	Malware.Heuristic!ET#83% (CLOUD)
Sophos	Generic PUA BP (PUA)
TheHacker	Posible_Worm32
VBA32	BScope.Trojan.Adkor
Webroot	W32.Malware.Gen
Yandex	Trojan.Adkor!
Zillya	Trojan.AdkorCRTD.Win32.1795

24 of the 71 anti-virus programs detected the vprodefenderl.exe file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "mutex": [
        "VProDefenderL ver 2.0"
    ],
    "directory_enumerated": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\vprodefenderp.exe.bak"
    ],
    "regkey_opened": [
        "HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales",
        "HKEY_CURRENT_USER\\Software\\Borland\\Locales"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
    ],
    "dll_loaded": [
        "advapi32.dll",
        "shell32.dll",
        "KERNEL32.DLL",
        "oleaut32.dll",
        "user32.dll"
    ]
}

Generic

[
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1568055186.3281,
        "ppid": 376
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\89357c883039ac8ce29e207605ac68751c7d57bb21ee8a28dfb986acc9374c6f.bin",
        "process_name": "89357c883039ac8ce29e207605ac68751c7d57bb21ee8a28dfb986acc9374c6f.bin",
        "pid": 2436,
        "summary": {
            "mutex": [
                "VProDefenderL ver 2.0"
            ],
            "directory_enumerated": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\vprodefenderp.exe.bak"
            ],
            "regkey_opened": [
                "HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales",
                "HKEY_CURRENT_USER\\Software\\Borland\\Locales"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
            ],
            "dll_loaded": [
                "advapi32.dll",
                "shell32.dll",
                "KERNEL32.DLL",
                "oleaut32.dll",
                "user32.dll"
            ]
        },
        "first_seen": 1568055186.7031,
        "ppid": 2456
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "The executable uses a known packer",
        "severity": 1,
        "marks": [
            {
                "category": "packer",
                "ioc": "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "peid_packer"
    },
    {
        "markcount": 3,
        "families": [],
        "description": "Foreign language identified in PE resource",
        "severity": 2,
        "marks": [
            {
                "name": "RT_ICON",
                "language": "LANG_KOREAN",
                "offset": "0x000192d4",
                "filetype": "data",
                "sublanguage": "SUBLANG_KOREAN",
                "type": "generic",
                "size": "0x000010a8"
            },
            {
                "name": "RT_GROUP_ICON",
                "language": "LANG_KOREAN",
                "offset": "0x0001a380",
                "filetype": "MS Windows icon resource - 1 icon, 32x32",
                "sublanguage": "SUBLANG_KOREAN",
                "type": "generic",
                "size": "0x00000014"
            },
            {
                "name": "RT_VERSION",
                "language": "LANG_KOREAN",
                "offset": "0x0001a398",
                "filetype": "data",
                "sublanguage": "SUBLANG_KOREAN",
                "type": "generic",
                "size": "0x0000036c"
            }
        ],
        "references": [],
        "name": "origin_langid"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The binary likely contains encrypted or compressed data indicative of a packer",
        "severity": 2,
        "marks": [
            {
                "entropy": 7.8780360558562,
                "section": {
                    "size_of_data": "0x00006e00",
                    "virtual_address": "0x00012000",
                    "entropy": 7.8780360558562,
                    "name": "UPX1",
                    "virtual_size": "0x00007000"
                },
                "type": "generic",
                "description": "A section with a high entropy has been found"
            },
            {
                "entropy": 0.80882352941176,
                "type": "generic",
                "description": "Overall entropy of this PE file is high"
            }
        ],
        "references": [
            "http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
            "http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
        ],
        "name": "packer_entropy"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The executable is compressed using UPX",
        "severity": 2,
        "marks": [
            {
                "section": "UPX0",
                "type": "generic",
                "description": "Section name indicates UPX"
            },
            {
                "section": "UPX1",
                "type": "generic",
                "description": "Section name indicates UPX"
            }
        ],
        "references": [],
        "name": "packer_upx"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 546,
            "time": 3.0782389640808,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 2234,
            "time": 3.0391490459442,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 2562,
            "time": 1.0160410404205,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 2890,
            "time": 3.0510740280151,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3218,
            "time": 1.5186338424683,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3546,
            "time": -0.10156607627869,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 3874,
            "time": 1.5320570468903,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 8350,
            "time": 1.0461390018463,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 12542,
            "time": 3.141667842865,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "00b1723313c60bde5555e40f5dfd33dec441e324b9c120ef63e8b1afbc5bd200",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "ebdd304d0f0f48bb7ad0e634d4d5cc76f843e875c2d142f7bccfe321144693c9",
    "irc": [],
    "https_ex": []
}

Screenshots

vprodefenderl.exe removal instructions

The instructions below shows how to remove vprodefenderl.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the vprodefenderl.exe file for removal, restart your computer and scan it again to verify that vprodefenderl.exe has been successfully removed. Here are the removal instructions in more detail:

Download and install FreeFixer: http://www.freefixer.com/download.html
Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
When the scan is finished, locate vprodefenderl.exe in the scan result and tick the checkbox next to the vprodefenderl.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate vprodefenderl.exe in the scan result.

c:\downloads\vprodefenderl.exe
Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the vprodefenderl.exe file.
Restart your computer.
Start FreeFixer and scan your computer again. If vprodefenderl.exe still remains in the scan result, proceed with the next step. If vprodefenderl.exe is gone from the scan result you're done.
If vprodefenderl.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
Restart your computer.
Start FreeFixer and scan your computer again. Verify that vprodefenderl.exe no longer appear in the scan result.

Free Questionnaires

Hashes [?]

Property	Value
MD5	d5d4d68f96e26ff7a78f718c51a7be61
SHA256	89357c883039ac8ce29e207605ac68751c7d57bb21ee8a28dfb986acc9374c6f

Error Messages

These are some of the error messages that can appear related to vprodefenderl.exe:

vprodefenderl.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

vprodefenderl.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

VPro Defender ?? ???? has stopped working.

End Program - vprodefenderl.exe. This program is not responding.

vprodefenderl.exe is not a valid Win32 application.

vprodefenderl.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with the file?

To help other users, please let us know what you will do with the file:

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

What is vprodefenderl.exe?

Vendor and version information [?]

Digital signatures [?]

VirusTotal report

Sandbox Report

Summary

Summary

Generic

Signatures

Yara

Network

Screenshots

vprodefenderl.exe removal instructions

Hashes [?]

Error Messages

What will you do with the file?

Comments

Leave a reply