Free malware removal tool to remove Data Protection

Written by Administrator | Thursday, 06 May 2010 15:54

Data Protection is a rogue Antispyware, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alarm that there are more malwares on your system. It’s true indeed, there is really a malware in your system but I think the only malware on your system is Data Protection. It invites you to purchase a license to remove malware, do not, it's a scam, you need a license for a malware? This so-called Antivirus tries to scam you. Uninstall Data Protection immediately from your system.

Data Protection

To remove Data Protection (Uninstall Data Protection)

Download this free removal tool for Data Protection
Extract it
Launch
Click on the delete button

Data Protection will be removed from your system in 10s. Restart your computer when it’s finished.

Processes :

datprot.exe
[random].exe

Files :

%AppData%\[random].dll
%AppData%\Microsoft\Internet Explorer\Quick Launch\Data Protection.lnk
%Desktop%\Data Protection Support.lnk
%Desktop%\Data Protection.lnk
%Programs%\Data Protection
%Programs%\Data Protection\About.lnk
%Programs%\Data Protection\Activate.lnk
%Programs%\Data Protection\Buy.lnk
%Programs%\Data Protection\Data Protection Support.lnk
%Programs%\Data Protection\Data Protection.lnk
%Programs%\Data Protection\Scan.lnk
%Programs%\Data Protection\Settings.lnk
%Programs%\Data Protection\Update.lnk
%ProgramFiles%\Data Protection
%ProgramFiles%\Data Protection\about.ico
%ProgramFiles%\Data Protection\activate.ico
%ProgramFiles%\Data Protection\buy.ico
%ProgramFiles%\Data Protection\dat.db
%ProgramFiles%\Data Protection\datext.dll
%ProgramFiles%\Data Protection\dathook.dll
%ProgramFiles%\Data Protection\datprot.exe
%ProgramFiles%\Data Protection\help.ico
%ProgramFiles%\Data Protection\scan.ico
%ProgramFiles%\Data Protection\settings.ico
%ProgramFiles%\Data Protection\splash.mp3
%ProgramFiles%\Data Protection\Uninstall.exe
%ProgramFiles%\Data Protection\update.ico
%ProgramFiles%\Data Protection\virus.mp3
%Temp%\[random].mof
%Temp%\[random].tmp
%Temp%\[random].exe
%Temp%\[random]
%Temp%\[random].dat

Registry

Registry keys created

HKEY_LOCAL_MACHINE\SOFTWARE\Data Protection
HKEY_CURRENT_USER\Software\Microsoft\Multimedia\Video For Windows
HKEY_CURRENT_USER\Software\Microsoft\Multimedia\Video For Windows\MCIAVI
HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Data Protection

Registry values created

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- "DisableTaskMgr" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Data Protection
- Settings_0 = 0x00000001
- SecStatus_3 = 0x00000001
- SecStatus_4 = 0x00000001
- SecStatus_5 = 0x00000001
- FD = 0x00000000
- GUID = "840920988409073084089362"
- Data = ":1920:2160:2280:2640:2760:2880:3120:3240:3360:3480:3720:"
- swver = "3.0"
- dbver = "1.1"
- dbsigns = "62577"
- dbverf = "1.1"
- dbsignsf = "62577"
- InfectedFiles = "%System%\slbrccsp.dll,%System%\wavemsp.dll,%System%\wscsvc.dll,%System%\Drivers\usb8023.sys,"
- LastScan = 0x4BC29F83
- Infected = 0x00000004
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- Use FormSuggest = "Yes"
HKEY_CURRENT_USER\Software\Microsoft\Multimedia\Video For Windows\MCIAVI
- DefaultOptions = 0x00000000
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- WarnOnZoneCrossing = 0x00000000
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Data Protection = ""%ProgramFiles%\Data Protection\datprot.exe" -noscan"