Home Malware Programs Trojans Cntprot.exe

Cntprot.exe

Posted: June 2, 2010

Cntprot.exe is a Trojan file related to the rogue Protection Center. Protection Center uses cntprot.exe to redirect the browser to a fake scan page which reports false parasites. Remove this file and all other threats related to Protection Center immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Protection Center.lnk
    2 %UserProfile%\Desktop\Protection Center Support.lnk
    3 %UserProfile%\Desktop\Protection Center.lnk
    4 %UserProfile%\Start Menu\Programs\Protection Center
    5 %UserProfile%\Start Menu\Programs\Protection Center\About.lnk
    6 %UserProfile%\Start Menu\Programs\Protection Center\Activate.lnk
    7 %UserProfile%\Start Menu\Programs\Protection Center\Buy.lnk
    8 %UserProfile%\Start Menu\Programs\Protection Center\Protection Center Support.lnk
    9 %UserProfile%\Start Menu\Programs\Protection Center\Protection Center.lnk
    10 %UserProfile%\Start Menu\Programs\Protection Center\Scan.lnk
    11 %UserProfile%\Start Menu\Programs\Protection Center\Settings.lnk
    12 %UserProfile%\Start Menu\Programs\Protection Center\Update.lnk
    13 C:\Program Files\Protection Center
    14 C:\Program Files\Protection Center\about.ico
    15 C:\Program Files\Protection Center\activate.ico
    16 C:\Program Files\Protection Center\buy.ico
    17 C:\Program Files\Protection Center\cnt.db
    18 C:\Program Files\Protection Center\cntext.dll
    19 C:\Program Files\Protection Center\cnthook.dll
    20 C:\Program Files\Protection Center\cntprot.exe
    21 C:\Program Files\Protection Center\help.ico
    22 C:\Program Files\Protection Center\scan.ico
    23 C:\Program Files\Protection Center\settings.ico
    24 C:\Program Files\Protection Center\splash.mp3
    25 C:\Program Files\Protection Center\uninstall.exe
    26 C:\Program Files\Protection Center\update.ico
    27 C:\Program Files\Protection Center\virus.mp3

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgrHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Protection CenterHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Loading...