Solved! Use WINDOWSPROTECT.DLL (Trojan Agent) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

WINDOWSPROTECT.DLL – Trojan Agent removal

File MD5 Virus Alias
WINDOWSPROTECT.DLL 7a87ef9b0d0d1a0d439d1fb2410bd102 Trojan Agent
WINDOWSPROTECT.DLL 7a87ef9b0d0d1a0d439d1fb2410bd102 Trojan PcClient
WINDOWSPROTECT.DLL 7a87ef9b0d0d1a0d439d1fb2410bd102 Trojan Eldorado
WINDOWSPROTECT.DLL 7a87ef9b0d0d1a0d439d1fb2410bd102 Trojan Downloader
WINDOWSPROTECT.DLL 7a87ef9b0d0d1a0d439d1fb2410bd102 Backdoor PcClien
WINDOWSPROTECT.DLL 7a87ef9b0d0d1a0d439d1fb2410bd102 Trojan Delf

WINDOWSPROTECT.DLL size: 65024 bytes
WINDOWSPROTECT.DLL hash: 7A87EF9B0D0D1A0D439D1FB2410BD102

Created files:

%SysDir%\WindowsProtect.dll

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\WindowsProtect\Type: 10010000
HKLM\System\CurrentControlSet\Services\WindowsProtect\Start: 02000000
HKLM\System\CurrentControlSet\Services\WindowsProtect\DisplayName: WindowsProtect
HKLM\System\CurrentControlSet\Services\WindowsProtect\ImagePath: %WinDir%\System32\svchost.exe -k netsvcs
HKLM\System\CurrentControlSet\Services\WindowsProtect\Description: WindowsProtect???????????????????
HKLM\System\CurrentControlSet\Services\WindowsProtect\SBIE_Win32ExitCode: 02000000
HKLM\System\CurrentControlSet\Services\WindowsProtect\Parameters\ServiceDll: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C00570069006E0064006F0077007300500072006F0074006500630074002E0064006C006C000000

Detected by UnHackMe:

WINDOWSPROTECT.DLL
Default location: %SYSDIR%\WINDOWSPROTECT.DLL

Dropper information:
MD5: 5620f818f78d4fa34b71aff1a4127f43
File size: 82944 bytes

Leave a Reply