Windows Vista Blog

Virus Protector is a malicious program that appears to be a legitimate security software application. It tries to trick users into paying for a license to its ‘full’ version. Virus Protector gets installed on user systems via Trojan viruses that get downloaded along with fake video codec packs. Once installed, it creates a large number of harmless files on the computer’s hard disk, and later identifies them as viruses in a number of fake security scans. It also displays fake warning pop-ups from the Windows taskbar. Meanwhile it constantly requests the user to upgrade to the ‘full’ version of Virus Protector by paying for a software license, claiming that the currently installed ‘trial’ version is incapable of properly removing the detected false ‘threats’. However, no user should allow themselves to be tricked into buying this software, as the ‘full’ version of Virus Protector is just as incapable of cleaning a computer system as the ‘trial’ version is. Check this site www.removevirus.org/remove-virus-protector.html to get more infos about this threat.

Virus Protector removal involves the stopping of processes, unregistering of DLLs, deletion of files and folders and removal of registry entries.

File Removal Procedures

The first step in Virus Protector removal is to stop the following process:

• [random characters].exe

Next, you must unregister the following DLL file:

• [random characters].dll

Finally, to complete file deletion, remove the following files and folders:

• c:\Documents and Settings\Bleeping\Application Data\[random characters].exe
• c:\Documents and Settings\Bleeping\Application Data\[random characters].dll
• c:\Documents and Settings\Bleeping\Local Settings\Temp\[random characters].exe
• c:\Documents and Settings\Bleeping\Local Settings\Temp\[random characters].dll
• c:\Program Files\Internet Explorer\[random characters].exe
• c:\Program Files\Internet Explorer\[random characters].dll
• c:\WINDOWS\[random characters].exe
• c:\WINDOWS\[random characters].dll
• c:\WINDOWS\system32\[random characters].exe
• c:\WINDOWS\system32\[random characters].dll
• c:\WINDOWS\system32\drivers\[random characters].exe
• c:\WINDOWS\system32\drivers\[random characters].dll

Now it is safe to say that your hard disk is devoid of anything to do with Virus Protector. In order to make sure that there are no traces of Virus Protector left behind as well as any other malware infections it is recommended to scan the entire PC using genuine antivirus such as Spyware Doctor with Antivirus.

Registry Removal Procedures

File removal alone is not sufficient to properly delete Virus Protector. It is required to remove the following registry entries as well in order to complete Virus Protector removal:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Virus Protector”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows “LoadAppInit_DLLs” = “1″
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows “AppInit_DLLs” = “[random characters].dll”

After this step has been completed, your computer is safe from Virus Protector.

Conclusion

Manual Virus Protector removal is not recommended for inexperienced users, as any mistake made during removal could cause damage to the operating system. Inexperienced users are advised to use a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus for safe and efficient Virus Protector removal.