Your Protection Adware Removal Instructions
The Emsi Software malware research team has discoverd a new outbreak of the Your Protection adware. a-squared Anti-Malware detects this malware as Adware.Win32.YourProtection.
Your Protection is a rogue security program. This is a new variant from User Protection / Dr. Guard /PaladinAntivirus. This rogue application tries to trick you by displaying false positive/misleading scan results report, which says that your computer is infected with viruses or trojan, but you will not be able to delete them before you purchase.
Create new files:
- %ProgramFiles%\Your Protection\help.ico
- %ProgramFiles%\Your Protection\scan.ico
- %ProgramFiles%\Your Protection\settings.ico
- %ProgramFiles%\Your Protection\splash.mp3
- %ProgramFiles%\Your Protection\Uninstall.exe
- %ProgramFiles%\Your Protection\update.ico
- %ProgramFiles%\Your Protection\urp.db
- %ProgramFiles%\Your Protection\urpext.dll
- %ProgramFiles%\Your Protection\urphook.dll
- %ProgramFiles%\Your Protection\urpprot.exe
- %ProgramFiles%\Your Protection\virus.mp3
- %ProgramFiles%\Your Protection\about.ico
- %ProgramFiles%\Your Protection\activate.ico
- %ProgramFiles%\Your Protection\buy.ico
- %AllUsersProfile%\Desktop\nudetube.com.lnk
- %AllUsersProfile%\Desktop\pornotube.com.lnk
- %AllUsersProfile%\Desktop\youporn.com.lnk
- %AllUsersProfile%\Favorites\_favdata.dat
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Your Protection.lnk
- %UserProfile%\Desktop\Your Protection.lnk
- %UserProfile%\Desktop\Your Protection Support.lnk
- %UserProfile%\Local Settings\Temp\mplay32xe.exe
- %UserProfile%\Start Menu\Programs\Your Protection\Scan.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Settings.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Update.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Your Protection.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Your Protection Support.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\About.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Activate.lnk
- %UserProfile%\Start Menu\Programs\Your Protection\Buy.lnk
Create new registry entries:
- HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Uninstall\Your Protection
- HKEY_LOCAL_MACHINE\software\Your Protection
- HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run, “mplay32xe.exe”
- HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run, “Your Protection”
Screenshots:
How to remove the infection of Your Protection (Adware.Win32.YourProtection)?
To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.
Tags: Rogue, YourProtection