Protection Center is a malicious anti-spyware application that has been derived from a number of rogue programs, namely, Digital Protection, Dr. Guard, Your Protection and Data Protection, and tries to trick users into purchasing its license. This malicious application reaches the user’s computer via Trojans that get downloaded from malicious websites. Once established on the user’s system, Protection Center loads itself as a startup service at boot time. Protection Center proceeds to perform a large number of fake security scans on the system, returning results that state that the computer is dangerously infected with a number of non-existent viruses. It also generates fake warning pop-ups from the Windows taskbar. Finally Protection Center urges the user to purchase a license to the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is incapable of cleaning the detected false ‘threats’. However, all users should be aware that this is a trick aimed at swindling their money, as no version of Protection Center can scan or clean any computer.
The following chapters will show you how to remove Protection Center. Protection Center removal involves the stopping of processes, the unregistering of DLL files, the removal of files and folders and the deletion of registry entries.
File Removal Procedures
The first step you need to take in order to remove Protection Center is to kill the following processes:
- cntprot.exe
- Uninstall.exe
Next, it is necessary to unregister the following DLL files which belong to Protection Center:
- cntext.dll
- cnthook.dll
The final step in the file deletion phase of Protection Center removal is the actual deletion of the following files and folders:
- c:\Program Files\Protection Center\about.ico
- c:\Program Files\Protection Center\activate.ico
- c:\Program Files\Protection Center\buy.ico
- c:\Program Files\Protection Center\cnt.db
- c:\Program Files\Protection Center\cntext.dll
- c:\Program Files\Protection Center\cnthook.dll
- c:\Program Files\Protection Center\cntprot.exe
- c:\Program Files\Protection Center\help.ico
- c:\Program Files\Protection Center\scan.ico
- c:\Program Files\Protection Center\settings.ico
- c:\Program Files\Protection Center\splash.mp3
- c:\Program Files\Protection Center\Uninstall.exe
- c:\Program Files\Protection Center\update.ico
- c:\Program Files\Protection Center\virus.mp3
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Protection Center.lnk
- %UserProfile%\Desktop\Protection Center Support.lnk
- %UserProfile%\Desktop\Protection Center.lnk
- %UserProfile%\Start Menu\Programs\Protection Center\
- %UserProfile%\Start Menu\Programs\Protection Center\About.lnk
- %UserProfile%\Start Menu\Programs\Protection Center\Activate.lnk
- %UserProfile%\Start Menu\Programs\Protection Center\Buy.lnk
- %UserProfile%\Start Menu\Programs\Protection Center\Protection Center Support.lnk
- %UserProfile%\Start Menu\Programs\Protection Center\Protection Center.lnk
- %UserProfile%\Start Menu\Programs\Protection Center\Scan.lnk
- %UserProfile%\Start Menu\Programs\Protection Center\Settings.lnk
- %UserProfile%\Start Menu\Programs\Protection Center\Update.lnk
Now no instances of Protection Center reside on your hard disk any longer. However, in order to certify of this fact it is required to scan the entire computer using a legitimate antivirus product such as Spyware Doctor with Antivirus.
Registry Removal Procedures
In order to completely remove Protection Center, it is necessary to remove the following keys and settings from the Windows Registry:
- HKEY_CURRENT_USER\Software\Classes\secfile
- HKEY_CURRENT_USER\Software\Malware Defense
- HKEY_CURRENT_USER\Software\Paladin Antivirus
- HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
- HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
- HKEY_CLASSES_ROOT\secfile
- HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Protection Center
- HKEY_LOCAL_MACHINE\SOFTWARE\Paladin Antivirus
- HKEY_LOCAL_MACHINE\SOFTWARE\Protection Center
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = “1″
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Protection Center”
After the above steps have been completed, it is safe to say that Protection Center has been completely removed from your computer.
Conclusion
Even though an inexperienced computer user may have full knowledge on how to remove Protection Center, it is not recommended that they attempt it as any mistake made during removal could cause damage to the system. Therefore inexperienced users are advised to make use of a web-based malware scanning/cleaning service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus to remove Protection Center.