Your Protection Vrius Threat

Description: Your Protection is a fake anti-spyware program that is related to the well-known rogue programs User Protection and Dr. Guard. It gets installed on a user’s computer by using Trojan viruses that get downloaded from websites with fake online scanners and which promote fake video codecs. Once installed, the virus will block any legitimate security programs already installed on the system. It then proceeds to load itself as a startup program and performs a large number of fake scans on the system reporting that the system is dangerously infected with malicious software. The program then urges the user to purchase a license to the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is insufficient to remove the detected ‘threats’. However, it is important to remember that the so-called ‘full’ version of Your Protection is just as incapable of scanning or cleaning any system as the ‘trial’ version is.

Your Protection

» Download Your Protection Removal Software

As soon as you find a copy of this rogue program on your computer, you should take measures to delete this threat. The removal process involves stopping processes, unregistering DLLs, deleting files and folders and removing registry entries.

Your Protection Manual Removal Procedures

The first step you must take in order to remove this is to stop the following processes:

• Uninstall.exe
• urpprot.exe
• mplay32xe.exe

The next step in removal is to unregister the following DLL files:

• fiosejgfse.dll
• urpext.dll
• urphook.dll

To complete file removal, delete the following files and folders:

• c:\Documents and Settings\All Users\Application Data\fiosejgfse.dll
• c:\Program Files\Your Protection
• %Temp%\asd1.tmp
• %Temp%\mplay32xe.exe
• %Temp%\urp.dat
• %Temp%\urpr.dat
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Your Protection.lnk
• %UserProfile%\Desktop\Your Protection Support.lnk
• %UserProfile%\Desktop\Your Protection.lnk
• %UserProfile%\Start Menu\Programs\Your Protection

Your Protection Registry Removal Proedures

File removal alone is not sufficient to properly delete this. It is required to delete the following keys and settings for complete removal.

• HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection
• HKEY_LOCAL_MACHINE\SOFTWARE\Your Protection
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "mplay32xe.exe"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Your Protection"
• HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt "(Default)" = "{5E2121EE-0300-11D4-8D3B-444553540000}"
• HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt "(Default)" = "{5E2121EE-0300-11D4-8D3B-444553540000}"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = "1"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5E2121EE-0300-11D4-8D3B-444553540000}"

Your Protection has now been completely removed from your computer.

Your Protection Directories:

• c:\Program Files\Your Protection

Outside Resources:

http://www.bleepingcomputer.com/virus-removal/remove-your-protection

http://uk.answers.yahoo.com/question/index?qid=20100405130554AATj9fy