PUA

About “PUP.Optional.WinZipPrivacyProtector” infection

Malware Removal

The PUP.Optional.WinZipPrivacyProtector is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What PUP.Optional.WinZipPrivacyProtector virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine PUP.Optional.WinZipPrivacyProtector?


File Info:

crc32: 23675E1D
md5: bd35b293300a7d36e9e0e7ba76643ea5
name: wzpp3.exe
sha1: a6b456fd16f09e68d12af5e6bd9bf94f209fc538
sha256: 29362c3fff97735a55834220b77cbc74a25d31ad81ba5237737615bfedd5abac
sha512: 5a701db008f03398a1e322bdf8ace3660ab729357a89253df9df5878324201bac7e6c2048587328ff1a8bac749cdb75cfdf12bf02c4ef9a4c9d10f556130394f
ssdeep: 196608:d5grSUXbtHtsYLTIOWxAhNdBe+6xV1/4ah+B3kraa6SumggFianE5Pv22h37CdMd:d5jSbsQTlWxyBeTGahWbmmsE5PvDLCNg
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright xa9 2018 Corel Corporation. All Rights Reserved.
FileVersion: 3.9.1.0
CompanyName: Corel Corporation
ProductName: WinZip Privacy Protector
ProductVersion: 3.9.1.0
FileDescription: WinZip Privacy Protector
Translation: 0x0000 0x04b0

PUP.Optional.WinZipPrivacyProtector also known as:

McAfeeArtemis!BD35B293300A
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
Invinceaheuristic
DrWebProgram.Unwanted.3029
McAfee-GW-EditionArtemis
Endgamemalicious (high confidence)
MicrosoftPUA:Win32/Presenoker
VBA32CIL.HeapOverride.Heur
MalwarebytesPUP.Optional.WinZipPrivacyProtector
ESET-NOD32a variant of MSIL/ShieldApps.G potentially unwanted
eGambitUnsafe.AI_Score_85%
AVGWin32:Adware-gen [Adw]
AvastWin32:Adware-gen [Adw]

How to remove PUP.Optional.WinZipPrivacyProtector?

PUP.Optional.WinZipPrivacyProtector removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment