Your Protection Vrius Threat

Description: Your Protection is a fake anti-spyware program that is related to the well-known rogue programs User Protection and Dr. Guard. It gets installed on a user’s computer by using Trojan viruses that get downloaded from websites with fake online scanners and which promote fake video codecs. Once installed, the virus will block any legitimate security programs already installed on the system. It then proceeds to load itself as a startup program and performs a large number of fake scans on the system reporting that the system is dangerously infected with malicious software. The program then urges the user to purchase a license to the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is insufficient to remove the detected ‘threats’. However, it is important to remember that the so-called ‘full’ version of Your Protection is just as incapable of scanning or cleaning any system as the ‘trial’ version is.

Your Protection

Your Protection

» Download Your Protection Removal Software

As soon as you find a copy of this rogue program on your computer, you should take measures to delete this threat. The removal process involves stopping processes, unregistering DLLs, deleting files and folders and removing registry entries.

Your Protection Manual Removal Procedures

The first step you must take in order to remove this is to stop the following processes:

  • Uninstall.exe
  • urpprot.exe
  • mplay32xe.exe

The next step in removal is to unregister the following DLL files:

  • fiosejgfse.dll
  • urpext.dll
  • urphook.dll

To complete file removal, delete the following files and folders:

  • c:\Documents and Settings\All Users\Application Data\fiosejgfse.dll
  • c:\Program Files\Your Protection
  • %Temp%\asd1.tmp
  • %Temp%\mplay32xe.exe
  • %Temp%\urp.dat
  • %Temp%\urpr.dat
  • %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Your Protection.lnk
  • %UserProfile%\Desktop\Your Protection Support.lnk
  • %UserProfile%\Desktop\Your Protection.lnk
  • %UserProfile%\Start Menu\Programs\Your Protection

Your Protection Registry Removal Proedures

File removal alone is not sufficient to properly delete this. It is required to delete the following keys and settings for complete removal.

  • HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Your Protection
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "mplay32xe.exe"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Your Protection"
  • HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt "(Default)" = "{5E2121EE-0300-11D4-8D3B-444553540000}"
  • HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt "(Default)" = "{5E2121EE-0300-11D4-8D3B-444553540000}"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = "1"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5E2121EE-0300-11D4-8D3B-444553540000}"

Your Protection has now been completely removed from your computer.

Your Protection Directories:

  • c:\Program Files\Your Protection

Outside Resources:

http://www.bleepingcomputer.com/virus-removal/remove-your-protection

http://uk.answers.yahoo.com/question/index?qid=20100405130554AATj9fy

RemoveVirus.org cannot be held liable for any damages that may occur from using our community virus removal guides. Viruses cause damage and unless you know what you are doing you may loose your data. We strongly suggest you backup your data before you attempt to remove any virus. Each product or service is a trademark of their respective company. We do make a commission off of each product we recommend. This is how removevirus.org is able to keep writing our virus removal guides. All Free based antivirus scanners recommended on this site are limited. This means they may not be fully functional and limited in use. A free trial scan allows you to see if that security client can pick up the virus you are infected with.