English
If You Need Expert Help we recommend you hire a Ninja! Ninja's are well trained in the art of virus removal and can remove all threats from your computer right now. See this User Protection is a fake anti-spyware program that belongs to the same family of rogue security software as Paladin Antivirus and Dr. Guard, which tries to trick users into paying for a software license. It gets installed on a user’s computer by using Trojan viruses that get downloaded from malicious websites. Once installed, User Protection disables essential system tools such as Task Manager and Registry Editor. It then proceeds to load itself as a startup program and performs a large number of fake scans on the system reporting that the system is dangerously infected with malicious software. It also shows the previously created harmless files as viruses that should be removed. This rogue software also hijacks the user’s web browser and redirects it to malicious websites which promote User Protection. User Protection then urges the user to purchase a license to the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is insufficient to remove the detected ‘threats’. However, it is important to remember that the so-called ‘full’ version of User Protection is just as incapable of scanning or cleaning any system as the ‘trial’ version is.
User Protection
» Download User Protection Removal Software
As soon as you find a copy of this rogue program on your computer, you should take measures to delete User Protection. The process of User Protection removal involves stopping processes, unregistering DLLs, deleting files and folders and removing registry entries.
Automatic User Protection Removal
Online User Protection Removal Service
User Protection Manual Removal Procedures
The first step you must take in order to remove User Protection is to stop the following processes:
- asr64_ldm.exe
- uninstall.exe
The next step in User Protection removal is to unregister the following DLL files:
- drgext.dll
- drghook.dll
To complete file removal, delete the following files and folders:
- %Documents and Settings%[UserName]DesktopUser Protection Support.lnk
- %Documents and Settings%[UserName]DesktopUser Protection.lnk
- %Documents and Settings%[UserName]Start MenuProgramsUser Protection
- %Documents and Settings%[UserName]Start MenuProgramsUser ProtectionAbout.lnk
- %Documents and Settings%[UserName]Start MenuProgramsUser ProtectionActivate.lnk
- %Documents and Settings%[UserName]Start MenuProgramsUser ProtectionBuy.lnk
- %Documents and Settings%[UserName]Start MenuProgramsUser ProtectionUser Protection Support.lnk
- c:Documents and SettingsAll UsersApplication Datafiosejgfse.dll
- c:Program FilesUser Protection
- c:Program FilesUser Protectionabout.ico
- c:Program FilesUser Protectionactivate.ico
- c:Program FilesUser Protectionbuy.ico
- c:Program FilesUser Protectionhelp.ico
- c:Program FilesUser Protectionscan.ico
- c:Program FilesUser Protectionsettings.ico
- c:Program FilesUser Protectionsplash.mp3
- c:Program FilesUser Protectionuninstall.exe
- c:Program FilesUser Protectionupdate.ico
- c:Program FilesUser Protectionusr.db
- c:Program FilesUser Protectionusrext.dll
- c:Program FilesUser Protectionusrhook.dll
- c:Program FilesUser Protectionusrprot.exe
- c:Program FilesUser Protectionvirus.mp3
- %UserProfile%Application DataMicrosoftInternet ExplorerQuick LaunchUser Protection.lnk
- %UserProfile%DesktopUser Protection Support.lnk
- %UserProfile%DesktopUser Protection.lnk
- %UserProfile%Desktopusrprot.exe.txt
- %UserProfile%Local SettingsTemp4otjesjty.mof
- %UserProfile%Local SettingsTempusr.dat
- %UserProfile%Local SettingsTempusrr.dat
- %UserProfile%Start MenuProgramsUser Protection
- %UserProfile%Start MenuProgramsUser ProtectionAbout.lnk
- %UserProfile%Start MenuProgramsUser ProtectionActivate.lnk
- %UserProfile%Start MenuProgramsUser ProtectionBuy.lnk
- %UserProfile%Start MenuProgramsUser ProtectionScan.lnk
- %UserProfile%Start MenuProgramsUser ProtectionSettings.lnk
- %UserProfile%Start MenuProgramsUser ProtectionUpdate.lnk
- %UserProfile%Start MenuProgramsUser ProtectionUser Protection Support.lnk
- %UserProfile%Start MenuProgramsUser ProtectionUser Protection.lnk
Once the above steps have been completed, User Protection no longer resides on your hard disk.
If you find this threat too hard to remove yourself and need an expert we recommend www.pcninja.com . They charge far less than others and are great at what they do.
User Protection Registry Removal Proedures
File removal alone is not sufficient to properly delete User Protection. It is required to delete the following keys and settings for complete User Protection removal:
- HKEY_CLASSES_ROOT*shellexContextMenuHandlersSimpleShlExt
- HKEY_CLASSES_ROOTCLSID{5E2121EE-0300-11D4-8D3B-444553540000}
- HKEY_CLASSES_ROOTFoldershellexContextMenuHandlersSimpleShlExt
- HKEY_LOCAL_MACHINESOFTWAREUser Protection
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallUser Protection
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem “DisableTaskMgr”
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “User Protection”
- HKEY_CLASSES_ROOTCLSID{5E2121EE-0300-11D4-8D3B-444553540000}
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShell ExtensionsApproved “{5E2121EE-0300-11D4-8D3B-444553540000}”
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem “DisableTaskMgr” = “1?
- HKEY_CLASSES_ROOTCLSID{5E2121EE-0300-11D4-8D3B-444553540000}
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallUser Protection
- HKEY_LOCAL_MACHINESOFTWAREUser Protection
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "User Protection"
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShell ExtensionsApproved "{5E2121EE-0300-11D4-8D3B-444553540000}"
Now your computer is completely safe from the rogue security application named User Protection. In order to make sure of this fact it is recommended to scan the entire PC using legitimate antivirus software such as Spyware Doctor with Antivirus so that it is possible to identify all other threats and malicious components that may still be present.
User Protection Directories:
- c:Program FilesUser Protection
Conclusion
It is not recommended for inexperienced users to attempt to remove User Protection manually, as any mistake made during removal could cause damage to your system. In order to ensure safe and efficient User Protection removal, inexperienced users should use a web-based scanning/cleaning system such as www.pcninja.com or legitimate antivirus software.
Other Software clients that Removevirus.org likes to use
- Spyware Doctor with Antivirus
- Norton
- Trend Micro
- Kaspersky
- AVG
- MalwareBytes
My name is Jacob and I run the RemoveVirus.org website with several other pros. Our virus removal guides are the most indepth guides around and provide real solutions. If you purchase an Antivirus Client we endorse on this site from one of the links we do make a commision. This helps us run and maintain the virus removal website. To date we have helped ten's of thousands if not hundreds of thousands of people remove their virus threats.
