JustProtectPc

By ZulaZuza in Rogue Anti-Virus Program

JustProtectPc is a rogue system protection tool that is a member of the family and is a clone of the fake anti-virus program Antivirus (Avt.exe). JustProtectPc will unknowingly enter a victim's computer and modify the browser settings. This will cause the victim to be redirected to malicious websites when attempting to surf the internet. JustProtectPc will also block certain security websites that a user may refer to in order to remove JustProtectPc. Then JustProtectPc will run a fake online system scan which will detect dangerous computer threats before prompting a user to purchase the full version of JustProtectPc which will apparently remove the threats. JustProtectPc may look legitimate but do not be fooled; JustProtectPc isn't skilled to find or erase infections from any computer and should be removed from an infected computer immediately after detection, with an skilled anti-malware tool.

Other members of JustProtectPc's family are is a criminal application that can neither detect nor remove computer threats.

Author url of JustProtectPc:

  • just-protect-pc.info

File System Details

JustProtectPc may create the following file(s):
# File Name Detections
1. C:\Program Files\Antivirus\AvBho.dll
2. C:\Documents and Settings\\Local Settings\Temporary Internet Files\Content.IE5\QVWZ2YCX\AvBho[1].dll
3. C:\Program Files\Antivirus\wscsvc32.exe
4. C:\Documents and Settings\\Local Settings\Temporary Internet Files\Content.IE5\MGJCX1Y1\wscsvc32[1].exe
5. C:\Program Files\Antivirus\Antivirus.exe
6. C:\Documents and Settings\\Local Settings\Temp\winupd64x.exe
7. C:\Documents and Settings\\Start Menu\Programs\AntiVirus\AntiVirus.lnk
8. C:\WINDOWS\Prefetch\ANTIVIRUS.EXE-26EDE405.pf
9. C:\Documents and Settings\\Desktop\AntiVirus.lnk
10. C:\SYSTEM VOLUME INFORMATION\_RESTORE{D3113EBC-D804-4C81-9A6A-F59373F8925A}\RP16\A0001034.LNK
11. C:\Program Files\Antivirus\
12. C:\Documents and Settings\\Start Menu\Programs\AntiVirus\Uninstall.lnk

Registry Details

JustProtectPc may create the following registry entry or registry entries:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CLASSES_ROOT\TypeLib\{65da0ce6-30d1-4144-a0b6-59bd01372e26}
HKEY_CLASSES_ROOT\CLSID\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus
HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5}
HKEY_CLASSES_ROOT\avbho.avbhoapp.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscsvc32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9d541c6a-573b-4888-b35e-6816e68c3620}
HKEY_CLASSES_ROOT\Interface\{967a494a-6aec-4555-9caf-fa6eb00acf91}
HKEY_CLASSES_ROOT\avbho.avbhoapp

Trending

Most Viewed

Loading...