Bprotector is a fairly popular yet unexceptional family of adware. A specific sample has consistently been on top for detection rates on our FireAMP and Immunet products. This detection, based off of 4 samples, ended up covering more than 90% of samples. The goal is always to choose content that is generic enough to cover variants but unique enough to not false positive. For ClamAV coverage I targeted strings that were shared commonly between samples that I had on hand. For the obligatory MD5 dump, here are the majority of samples that the signature alerted on:”]
Source: https://blog.talosintelligence.com/2013/12/a-quick-tutorial-on-clamav-detection.html