User Protection User Protection
By Domesticus in Rogue Anti-Virus Program |
195 views
(2 votes, average: 5.00 out of 5)
Loading ...
Español
Português
User Protection Description
User Protection is a misleading anti-virus application that should not be trusted. User Protection is from the same family as the rogue applications called Paladin Antivirus and Dr. Guard. On infiltrating a system, User Protection will create a start-up registry entry and disable legitimate security programs running on the system. Then User Protection will report fabricated computer threats and convince a user that his/her system is infected with spyware, worms, Trojans etc. The user will then be prompted to purchase the “full version” of User Protection in order to remove all the detected computer threats. Do not waste your money on User Protection it is a fake security application.
Type: Rogue Anti-Virus Program
How Can You Detect User Protection?
User Protection Technical Report
As new User Protection details are reported by our customers and findings from our Threat Research Center, we will update this section.
The following User Protection files with its MD5s were created in the system:
| File Name | File Size | MD5 |
|---|
| usrext.dll | 40960 | fe9bc465085d59f155decb2679fd26d4 |
| usrprot.exe | 2355200 | e94131ff9f26d3b47145d0443b7c9de8 |
| installerUP[1].exe | 181760 | 7dbcb95d5d665f3775659e764bb483c9 |
| usrhook.dll | 22016 | e94e68ce6cfb07809bae5a2133980cc3 |
User Protection has typically the following processes in memory:
- usrprot.exe
User Protection created the following directories, files, paths:
- %ProgramFiles%\User Protection
- %UserProfile%\Start Menu\Programs\User Protection
User Protection creates the following registry entries:
- HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = “1″
- HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\User Protection
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved “{5E2121EE-0300-11D4-8D3B-444553540000}”
- HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt
- HKEY_LOCAL_MACHINE\SOFTWARE\User Protection
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “User Protection”
Important Article Disclaimer
