The Emsi Software malware research team has discoverd a new outbreak of the Your Protection adware. a-squared Anti-Malware detects this malware as Adware.Win32.YourProtection.

Your Protection is a rogue security program. This is a new variant from User Protection / Dr. Guard /PaladinAntivirus. This rogue application tries to trick you by displaying false positive/misleading scan results report, which says that your computer is infected with viruses or trojan, but you will not be able to delete them before you purchase.

Create new files:

• %ProgramFiles%\Your Protection\help.ico
• %ProgramFiles%\Your Protection\scan.ico
• %ProgramFiles%\Your Protection\settings.ico
• %ProgramFiles%\Your Protection\splash.mp3
• %ProgramFiles%\Your Protection\Uninstall.exe
• %ProgramFiles%\Your Protection\update.ico
• %ProgramFiles%\Your Protection\urp.db
• %ProgramFiles%\Your Protection\urpext.dll
• %ProgramFiles%\Your Protection\urphook.dll
• %ProgramFiles%\Your Protection\urpprot.exe
• %ProgramFiles%\Your Protection\virus.mp3
• %ProgramFiles%\Your Protection\about.ico
• %ProgramFiles%\Your Protection\activate.ico
• %ProgramFiles%\Your Protection\buy.ico
• %AllUsersProfile%\Desktop\nudetube.com.lnk
• %AllUsersProfile%\Desktop\pornotube.com.lnk
• %AllUsersProfile%\Desktop\youporn.com.lnk
• %AllUsersProfile%\Favorites\_favdata.dat
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Your Protection.lnk
• %UserProfile%\Desktop\Your Protection.lnk
• %UserProfile%\Desktop\Your Protection Support.lnk
• %UserProfile%\Local Settings\Temp\mplay32xe.exe
• %UserProfile%\Start Menu\Programs\Your Protection\Scan.lnk
• %UserProfile%\Start Menu\Programs\Your Protection\Settings.lnk
• %UserProfile%\Start Menu\Programs\Your Protection\Update.lnk
• %UserProfile%\Start Menu\Programs\Your Protection\Your Protection.lnk
• %UserProfile%\Start Menu\Programs\Your Protection\Your Protection Support.lnk
• %UserProfile%\Start Menu\Programs\Your Protection\About.lnk
• %UserProfile%\Start Menu\Programs\Your Protection\Activate.lnk
• %UserProfile%\Start Menu\Programs\Your Protection\Buy.lnk

Create new registry entries:

• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Uninstall\Your Protection
• HKEY_LOCAL_MACHINE\software\Your Protection
• HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run, “mplay32xe.exe”
• HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run, “Your Protection”

Screenshots:

How to remove the infection of Your Protection (Adware.Win32.YourProtection)?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

The Emsi Software malware research team has discoverd a new outbreak of the User Antivirus 2010 adware. a-squared Anti-Malware detects this malware as Adware.Win32.UserAntivirus2010.

UserAntivirus2010 is a rogue security program, come from hxxp://userantivirus2010pro.yolasite. com.  A rogue application tries to trick you by displaying false positive/misleading scan results report, which says that your computer is infected with viruses or trojan, but you will not be able to delete them before you purchase.

Screenshots:

How to remove the infection of User Antivirus 2010 (Adware.Win32.UserAntivirus2010)?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.