Home Malware Programs Rogue Anti-Spyware Programs Your Protection

Your Protection

Posted: April 5, 2010

Threat Metric

Threat Level: 10/10
Infected PCs: 37
First Seen: April 6, 2010
Last Seen: July 13, 2021
OS(es) Affected: Windows

ScreenshotYour Protection is a dangerous rogue anti-spyware program. Your Protection comes from the same family of rogues as Dr. Guard and User Protection. Your Protection can be very deceiving in the way that it alerts computer users through popup messages that may read:

"Antivirus Alert - Critical threat detected
Warning: Network attack detected
Network attack has been detected. Process is attempting to access your private data."

Your Protection is also known to black other legitimate anti-virus or anti-spyware programs. It may be very difficult to attempt manual removal of Your Protection. When installed, Your Protection may initiate system scans that return bogus results. It is very important to take immediate action to remove Your Protection completely from the affected computer.

ScreenshotScreenshotScreenshot

Aliases

TROJ_TDSS.SMDI [TrendMicro]Trojan.FakeAV!gen25 [Symantec]Trojan:Win32/Rundis.gen!A [Microsoft]Trojan.Rundis.258560.A.1 [McAfee-GW-Edition]Trojan-Downloader.Win32.FraudLoad.xacn [Kaspersky]Trojan.Win32.FakeAV [Ikarus]Win32.Kryptik.Dna [eSafe]Gen:Variant.TDss.2 [BitDefender]SHeur3.PSA [AVG]Win32:Jifas-EZ [Avast]TR/Rundis.258560.A.1 [AntiVir]Trojan.Win32.FakeAV!IK [a-squared]FraudTool.Win32.RogueSecurity (v) [Sunbelt]Sus/UnkPack-C [Sophos]Win32/Adware.CoreguardAntivirus [NOD32]
More aliases (38)

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Your Protection may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria .

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%WINDIR%\system32\qonmnk.dll File name: qonmnk.dll
Size: 90.62 KB (90624 bytes)
MD5: ccc3c92fb0671a485d183d0921d2e921
Detection count: 87
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\system32\
Group: Malware file
Last Updated: December 7, 2010
urpext.dll File name: urpext.dll
Size: 40.96 KB (40960 bytes)
MD5: 1a381d401a8e0479b628bcaaf6260e1e
Detection count: 86
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: April 6, 2010
urpprot.exe File name: urpprot.exe
Size: 2.35 MB (2359296 bytes)
MD5: b04a78c75c7cc5f4a5de4bf3f209ca1b
Detection count: 78
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 6, 2010
urphook.dll File name: urphook.dll
Size: 22.01 KB (22016 bytes)
MD5: d9e77ff0377c509f61a9b5c4c0640bcd
Detection count: 77
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: April 6, 2010
mplay32xe.exe File name: mplay32xe.exe
Size: 258.56 KB (258560 bytes)
MD5: 62753e392367602dcf68c7bfba5a6851
Detection count: 20
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 8, 2010

More files

Registry Modifications

The following newly produced Registry Values are:

Directory%ProgramFiles%\Your Protection

3 Comments

  • Neal Currow says:

    Trying to get Your Protection off my computer. Your suggestions are great but the program has locked me out of my task manager by assigning a new password and will not let me delete the .dll files under the folder. Do you have any other help to rid myself of this "VIRUS". There is no response from the company of course.

  • jcdizon416 says:

    Thank you very much for the information

  • Sam says:

    Here are some more registry items that had the Your Protection stuff in them.

    HKEY_USERS\\\"Random Numbers\"\\Software\\Classes\\Virtual Store\\MACHINE\\SOFTWARE\\Your Protection
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\Audio\\PolicyConfig\\Property Store\\1e48f9c5_0
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Internet Explorer\\ Typed URLS
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Windows\\Current Version\\Run\\Your Protection
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Windows NT\\Current Version\\AppCompatFlags\\Compatability Assistant\\Persigs
    HKEY_USERS\\\"Random Numbers\"\\Software\\Microsoft\\Windows NT\\Current Version\\AppCompatFlags\\Layers