Virus Protector is a rogue application that pretends to be a legitimate security software program and tries to trick users into paying for its license. This rogue software reaches the user’s system via Trojans that get downloaded from websites promoting fake video codec packs. Once installed, it creates a number of fake but harmless files on the system. Then Virus Protector performs an endless stream of fake security scans on the computer, returning results that try to convince the user that their computer is heavily infected with malicious software. It also points out the above created harmless files as viruses that should be removed immediately. The aim of all this activity is to convince the user to purchase a license to the ‘full’ version of Virus Protector by claiming that the currently installed ‘trial’ version is insufficient to remove the detected ‘threats’. However, as this is a fake application none of its versions are capable of scanning or cleaning your computer in any way.
As soon as you find a copy of this rogue program on your computer, you should take measures to delete Virus Protector. In order to do this you must stop processes, unregister DLLs, delete files and folders and remove registry entries.
File Removal Procedures
The first step you must take in order to delete Virus Protector is to kill the following process:
- [random characters].exe
Next, you must unregister the following DLL file:
- [random characters].dll
Finally, to complete file deletion, remove the following files and folders:
- c:\Documents and Settings\Bleeping\Application Data\[random characters].exe
- c:\Documents and Settings\Bleeping\Application Data\[random characters].dll
- c:\Documents and Settings\Bleeping\Local Settings\Temp\[random characters].exe
- c:\Documents and Settings\Bleeping\Local Settings\Temp\[random characters].dll
- c:\Program Files\Internet Explorer\[random characters].exe
- c:\Program Files\Internet Explorer\[random characters].dll
- c:\WINDOWS\[random characters].exe
- c:\WINDOWS\[random characters].dll
- c:\WINDOWS\system32\[random characters].exe
- c:\WINDOWS\system32\[random characters].dll
- c:\WINDOWS\system32\drivers\[random characters].exe
- c:\WINDOWS\system32\drivers\[random characters].dll
Now it is safe to say that your hard disk is devoid of anything to do with Virus Protector.
Registry Removal Procedures
File removal alone is not sufficient to properly delete Virus Protector. It is required to remove the following registry entries as well:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Virus Protector”
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows “LoadAppInit_DLLs” = “1″
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows “AppInit_DLLs” = “[random characters].dll”
After this step has been completed, your computer is safe from Virus Protector. In order to make sure of this fact it is recommended to scan the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus.
Conclusion
It is not recommended for inexperienced users to attempt to delete Virus Protector manually, as any mistake made during deletion could cause damage to your system. In order to delete Virus Protector in a safe and efficient manner, inexperienced users should use a web-based scanning/cleaning system such as www.onlinecomputerrepair.org or legitimate antivirus software.