Virus Protector is a malicious program that is related to the notorious rogue programs Dr. Guard and User Protection. It tries to trick users into paying for a license to its ‘full’ version. Virus Protector gets installed on user systems via Trojan viruses that get downloaded along with fake video codec packs. Once installed, it immediately blocks any legitimate security software that the user may have installed on their computer. Your Protection also runs endless fake virus scans and reports that the user’s system is infected with dangerous malicious software. It also displays fake warning pop-ups from the Windows taskbar. Meanwhile it constantly requests the user to upgrade to the ‘full’ version of Virus Protector by paying for a software license, claiming that the currently installed ‘trial’ version is incapable of properly removing the detected false ‘threats’. However, no user should allow to be tricked into buying this software, as the ‘full’ version of Virus Protector is just as incapable of cleaning a computer system as the ‘trial’ version is.
As soon as you find a copy of this rogue program on your computer, you should take measures to delete Your Protection. The process of Your Protection removal involves stopping processes, unregistering DLLs, deleting files and folders and removing registry entries.
File Removal Procedures
The first step you must take in order to remove Your Protection is to stop the following processes:
- Uninstall.exe
- urpprot.exe
- mplay32xe.exe
The next step in Your Protection removal is to unregister the following DLL files:
- fiosejgfse.dll
- urpext.dll
- urphook.dll
To complete file removal, delete the following files and folders:
- c:\Documents and Settings\All Users\Application Data\fiosejgfse.dll
- c:\Program Files\Your Protection
- c:\Program Files\Your Protection\about.ico
- c:\Program Files\Your Protection\activate.ico
- c:\Program Files\Your Protection\buy.ico
- c:\Program Files\Your Protection\help.ico
- c:\Program Files\Your Protection\scan.ico
- c:\Program Files\Your Protection\settings.ico
- c:\Program Files\Your Protection\splash.mp3
- c:\Program Files\Your Protection\Uninstall.exe
- c:\Program Files\Your Protection\update.ico
- c:\Program Files\Your Protection\urp.db
- c:\Program Files\Your Protection\urpext.dll
- c:\Program Files\Your Protection\urphook.dll
- c:\Program Files\Your Protection\urpprot.exe
- c:\Program Files\Your Protection\virus.mp3
- %Temp%\4otjesjty.mof
- %Temp%\asd1.tmp
- %Temp%\mplay32xe.exe
- %Temp%\urp.dat
- %Temp%\urpr.dat
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Your Protection.lnk
- %UserProfile%\Desktop\Your Protection Support.lnk
- %UserProfile%\Desktop\Your Protection.lnk
- %UserProfile%\Start Menu\Programs\Your Protection
- %UserProfile%\Start Menu\Programs\Your Protection\About.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Activate.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Buy.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Scan.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Settings.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Update.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Your Protection Support.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Your Protection.lnk
Once the above steps have been completed, Your Protection no longer resides on your hard disk. In order to make sure that Your Protection removal has been completed successfully at file system level it is recommended to scan the entire PC using genuine antivirus software such Spyware Doctor with Antivirus.
Registry Removal Procedures
File removal alone is not sufficient to properly delete Your Protection. It is required to delete the following keys and settings for complete Your Protection removal:
- HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection
- HKEY_LOCAL_MACHINE\SOFTWARE\Your Protection
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = “1″
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “mplay32xe.exe”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Your Protection”
- HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt “(Default)” = “{5E2121EE-0300-11D4-8D3B-444553540000}”
- HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt “(Default)” = “{5E2121EE-0300-11D4-8D3B-444553540000}”
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = “1″
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved “{5E2121EE-0300-11D4-8D3B-444553540000}”
Your Protection has now been completely removed from your computer. Scanning the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus may proof useful as it can reveal other malicious components which may be present on the system.
Conclusion
It is not recommended for inexperienced users to attempt to remove Your Protection manually, as any mistake made during removal could cause damage to your system. In order to ensure safe and efficient Your Protection removal, inexperienced users should use a web-based scanning/cleaning system such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus.