Home Malware Programs Rogue Anti-Spyware Programs Your Protection

Your Protection

Posted: April 5, 2010

Threat Metric

Threat Level: 10/10
Infected PCs: 61
First Seen: April 6, 2010
Last Seen: January 23, 2022
OS(es) Affected: Windows

ScreenshotYour Protection is a dangerous rogue anti-spyware program. Your Protection comes from the same family of rogues as Dr. Guard and User Protection. Your Protection can be very deceiving in the way that it alerts computer users through popup messages that may read:

"Antivirus Alert - Critical threat detected
Warning: Network attack detected
Network attack has been detected. Process is attempting to access your private data."

Your Protection is also known to black other legitimate anti-virus or anti-spyware programs. It may be very difficult to attempt manual removal of Your Protection. When installed, Your Protection may initiate system scans that return bogus results. It is very important to take immediate action to remove Your Protection completely from the affected computer.

ScreenshotScreenshotScreenshot

Aliases

TROJ_TDSS.SMDI [TrendMicro]Trojan.FakeAV!gen25 [Symantec]Trojan:Win32/Rundis.gen!A [Microsoft]Trojan.Rundis.258560.A.1 [McAfee-GW-Edition]Trojan-Downloader.Win32.FraudLoad.xacn [Kaspersky]Trojan.Win32.FakeAV [Ikarus]Win32.Kryptik.Dna [eSafe]Gen:Variant.TDss.2 [BitDefender]SHeur3.PSA [AVG]Win32:Jifas-EZ [Avast]TR/Rundis.258560.A.1 [AntiVir]Trojan.Win32.FakeAV!IK [a-squared]FraudTool.Win32.RogueSecurity (v) [Sunbelt]Sus/UnkPack-C [Sophos]Win32/Adware.CoreguardAntivirus [NOD32]
More aliases (38)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



urpext.dll File name: urpext.dll
Size: 40.96 KB (40960 bytes)
MD5: 1a381d401a8e0479b628bcaaf6260e1e
Detection count: 86
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: April 6, 2010
urphook.dll File name: urphook.dll
Size: 22.01 KB (22016 bytes)
MD5: f7c0591c58f803326c0ba27326894b85
Detection count: 85
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: April 6, 2010
urphook.dll File name: urphook.dll
Size: 21.5 KB (21504 bytes)
MD5: 3b2ead11f9d88360e83a8aa393487220
Detection count: 22
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: April 8, 2010
urpprot.exe File name: urpprot.exe
Size: 2.35 MB (2359296 bytes)
MD5: 9e695b48600948e3d3931fe297353ef7
Detection count: 21
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 8, 2010
mplay32xe.exe File name: mplay32xe.exe
Size: 258.56 KB (258560 bytes)
MD5: 62753e392367602dcf68c7bfba5a6851
Detection count: 20
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 8, 2010
C:\Documents and Settings\<username>\Documenti\Download\***s Rogue Pack\***'s Rogue Pack\urpprot.exe File name: urpprot.exe
Size: 2.35 MB (2359296 bytes)
MD5: 5f34bd2e87b1a04114b92beb1fed1682
Detection count: 19
File type: Executable File
Mime Type: unknown/exe
Path: C:\Documents and Settings\<username>\Documenti\Download\***s Rogue Pack\***'s Rogue Pack\urpprot.exe
Group: Malware file
Last Updated: January 23, 2022
mplay32xe.exe File name: mplay32xe.exe
Size: 258.56 KB (258560 bytes)
MD5: fea7430f242a187b56e569718ebf9044
Detection count: 3
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: July 13, 2021

Additional Information

The following directories were created:
%ProgramFiles%\Your Protection

3 Comments

  • Neal Currow says:

    Trying to get Your Protection off my computer. Your suggestions are great but the program has locked me out of my task manager by assigning a new password and will not let me delete the .dll files under the folder. Do you have any other help to rid myself of this "VIRUS". There is no response from the company of course.

  • jcdizon416 says:

    Thank you very much for the information

  • Sam says:

    Here are some more registry items that had the Your Protection stuff in them.

    HKEY_USERS\\\"Random Numbers\"\\Software\\Classes\\Virtual Store\\MACHINE\\SOFTWARE\\Your Protection
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\Audio\\PolicyConfig\\Property Store\\1e48f9c5_0
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Internet Explorer\\ Typed URLS
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Windows\\Current Version\\Run\\Your Protection
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Windows NT\\Current Version\\AppCompatFlags\\Compatability Assistant\\Persigs
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Windows NT\\Current Version\\AppCompatFlags\\Layers

Loading...