Your Protection entfernen

**AdminBot** · 01.04.2010, 13:45

Your Protection entfernen

Was ist Your Protection?
Your Protection gehört zur selben Malware-Familie wie Paladin Antivirus. Your Protection ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines trojanischen Pferdes in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Your Protection) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden.

Verbreitet wird Your Protection nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html).

Symptome von Your Protection:

ständige Fake Virenmeldungen von Your Protection
PC läuft langsamer als üblich
stoppt folgende Scanner:

• F-Secure
• NOD32
• Malwarebytes' Anti-Malware
• Norton Internet Security
• Avira AntiVir
• AVG8
• AntiVir
• Agnitum Outpost Security Suite
• avast!

Antivirus Alert - Critical threat detected
Warning: Network attack detected
Network attack has been detected. Process is attempting to access your private data.

Your computer is being attacked from a remote PC.
Process is trying to steal your passwords listed below. It is highly recommended to block this threat now.

User's activity loggers detected!
It's strongly recommended to remove detected threats right now!

A security threat detected on your computer! This malicious program may steal your private data. Click on the message to ensure the protection of your computer.

Harmful viruses detected on your computer. This malicious software may harm your computer. Click on the message to ensure the protection of your computer.

You are running a trial antivirus software version. Activate your antivirus software copy to get full-time antivirus protection. Click on the message to ensure the protection of your computer.

Zlob.Porn.Ad adware has been detected. This adware module advertises websites with explicit content. Be advised of such content being possibly illegal. Please click the button below to locate and remove this threat now.

Most of the viruses and worms on your PC because of visiting pornosites or warez/torrent sites.

ANTIVIRUS IS RUN IN DEMO MODE. ACTIVATE YOUR ANTIVIRUS OTHERWISE ALL THE DATA WILL BE LOST OR DAMAGED!

DANGEROUS! ANTIVIRUS DETECTED SOME HARMFUL PROGRAMS ON YOUR PC! THEY MAY CORRUPT YOUR INFORMATION OR SEND IT TO HACKERS.

Unauthorized person tries to steal your passwords and private information. Click on the message to prevent identity theft.

Unauthorized access to your computer! Click on the message to install up-to-date antivirus software.

System files of your computer are damaged. Please, restart your system ASAP.

Danger!
A security threat detected on your computer. TrojanASPX.JS.Win32. It strongly recommended to remove this threat right now. Click on the message to remove it.

Warning! Virus threat detected!
Virus activity detected!
Trojan-Clicker.Win32 adware has been detected. This adware module advertises websites with explicit content. Be advised of such content being possibly illegal. Please click the button below to locate and remove this threat now.

Dateien von Your Protection:

Code:

ATTFilter

c:\Documents and Settings\All Users\Application Data\fiosejgfse.dll
c:\Program Files\Your Protection
c:\Program Files\Your Protection\about.ico
c:\Program Files\Your Protection\activate.ico
c:\Program Files\Your Protection\buy.ico
c:\Program Files\Your Protection\help.ico
c:\Program Files\Your Protection\scan.ico
c:\Program Files\Your Protection\settings.ico
c:\Program Files\Your Protection\splash.mp3
c:\Program Files\Your Protection\Uninstall.exe
c:\Program Files\Your Protection\update.ico
c:\Program Files\Your Protection\urp.db
c:\Program Files\Your Protection\urpext.dll
c:\Program Files\Your Protection\urphook.dll
c:\Program Files\Your Protection\urpprot.exe
c:\Program Files\Your Protection\virus.mp3
%Temp%\4otjesjty.mof
%Temp%\asd1.tmp
%Temp%\mplay32xe.exe
%Temp%\urp.dat
%Temp%\urpr.dat
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Your Protection.lnk
%UserProfile%\Desktop\Your Protection Support.lnk
%UserProfile%\Desktop\Your Protection.lnk
%UserProfile%\Start Menu\Programs\Your Protection
%UserProfile%\Start Menu\Programs\Your Protection\About.lnk
%UserProfile%\Start Menu\Programs\Your Protection\Activate.lnk
%UserProfile%\Start Menu\Programs\Your Protection\Buy.lnk
%UserProfile%\Start Menu\Programs\Your Protection\Scan.lnk
%UserProfile%\Start Menu\Programs\Your Protection\Settings.lnk
%UserProfile%\Start Menu\Programs\Your Protection\Update.lnk
%UserProfile%\Start Menu\Programs\Your Protection\Your Protection Support.lnk
%UserProfile%\Start Menu\Programs\Your Protection\Your Protection.lnk

Registry-Einträge von Your Protection:

Code:

ATTFilter

HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection
HKEY_LOCAL_MACHINE\SOFTWARE\Your Protection
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "mplay32xe.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Your Protection"
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt "(Default)" = "{5E2121EE-0300-11D4-8D3B-444553540000}"
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt "(Default)" = "{5E2121EE-0300-11D4-8D3B-444553540000}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5E2121EE-0300-11D4-8D3B-444553540000}"

Your Protection im HijackThis-Log:

Code:

ATTFilter

O4 - HKCU\..\Run: [mplay32xe.exe] %Temp%\mplay32xe.exe
O4 - HKCU\..\Run: [Your Protection] "C:\Program Files\Your Protection\urpprot.exe" -noscan

Your Protection entfernen

Anleitungen, FAQs & Links: Your Protection entfernen

Your Protection entfernen

Ähnliche Themen: Your Protection entfernen