1 reply to this topic

[Burak]

hxxp://xpprotector.com (77.244.220.134)

Antivirus Xp 2008
hxxp://av-xp2008.net (77.244.220.134)


Xp protector sysytems, Inc
Carol B. Yee
+1.6033917629 fax: +1.6033917629
1907 Grasselli Street
Manchester NH 03101
us

Administrative Contact:
Carol B. Yee
+1.6033917629 fax: +1.6033917629
1907 Grasselli Street
Manchester NH 03101
us

Technical Contact:
Carol B. Yee
+1.6033917629 fax: +1.6033917629
1907 Grasselli Street
Manchester NH 03101
us

Billing Contact:
Carol B. Yee
+1.6033917629 fax: +1.6033917629
1907 Grasselli Street
Manchester NH 03101
us

DNS:
ns1.xpprotector.com
ns3.xpprotector.com
ns4.xpprotector.com

Created: 2008-09-01
Expires: 2009-09-01




Some entries :

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\post platform]
"XPProtector09"="XPProtector09"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\thcp5aj0e3dr]
"DisplayName"="XPProtector09"

[HKEY_LOCAL_MACHINE\SOFTWARE\thcp5aj0e3dr]
"SoftID"="XPProtector09"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMthcp5aj0e3dr"="C:\\Program Files\\thcp5aj0e3dr\\thcp5aj0e3dr.exe"

C:\Program Files\thcp5aj0e3dr
C:\Program Files\thcp5aj0e3dr\thcp5aj0e3dr.exe

[Burak]

Sorry.
MBAM succesfully removing now this rogue program.