Rogue software details: Data Protection

Data Protection is a rogue security application. In order to remove it, find out what files and registry entries to look for below.

Known system changes:

Files
c:\Desktop\Data Protection.lnk
c:\Desktop\Data Protection Support.lnk
c:\Program Files\Data Protection\datprot.exe

Folders
c:\StartMenu\Data Protection
c:\ProgramFiles\Data Protection

Registry entries
Key: HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-
8D3B-444553540000}
Key: HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\
SimpleShlExt
Value: (Default)
Data: {5E2121EE-0300-11D4-8D3B-444553540000}
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Data Protection
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\Data Protection
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
Value: Data Protection
Data: “C:\Program Files\Data Protection\datprot.exe” -noscan
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
Value: napstatxt.exe
Data: C:\Temp\napstatxt.exe

Source: Lavasoft Malware Lab’s Rogue Gallery.