Protection Center is a rogue antispyware program from the same family of rogues as Data Protection, Digital Protection, Your Protection, User Protection, Dr. Guard, etc. Like other rogues Protection Center promoted and distributed through the use of trojans that come from various malicious websites. Once the trojan is started, it begins to show numerous fake security alerts from Windows task bar that stats your computer in danger and urgently needed to install an antivirus. The suggested “antivirus” is Protection Center. Even if you are ignoring all of these alerts, the trojan will download and install the rogue onto your computer, without your permission and knowledge.
Once started, Protection Center scans your computer for an already installed antispyware and antivirus programs (AVG, Avira, Malwarebytes’ Anti-Malware, McAfree, F-secure, Nod32, etc), and if they are found, will attempt to uninstall them under the pretext that they may conflict with it by showing the following alert:
Protection Center
Uncertified {antivirus name} antivirus software detected on your computer. You need to remove
{antivirus name} software for correct operation of the Protection Center.
Attention: If you don`t remove {antivirus name} software, the performance of your computer will
dramatically degrade.
Press “OK” to remove the {antivirus name}
Further, Protection Center configures itself to run automatically every time when Windows loads. Once installed, the program will perform a system scan and lists numerous infections (trojans, viruses, worms, etc) that will not be removed unless you first purchase so-called full version of the software. However, all of these reported infections, as well as self scanning, is nothing but a scam. In reality Protection Center cannot detect and remove any infections, as well as not be able to protect you from possible infections in the future. Thus, you can safely ignore all that the fake antispyware program will show you.
While Protection Center is running, it will display nag screens, fake security alerts and warnings from Windows task bar. A few examples:
Danger!
A security threat detected on your computer. This malicious
program may steal your private data. Click on the message to
ensure the protection of your computer.
Danger!
It is strongly recommended to protect your computer against
security threats. Click on the message to ensure the
protection of your computer.
Warning! Adware detected!
Adware module detected on your PC!
Warning! Keylogger detected!
Keylogger activity detected on your PC!
Of course, like false scan results above, all of these alerts and warnings are just a fake. This is a method of scare tactics to make you think your computer is infected with all sorts of malicious software. Like false scan results you can safely ignore them.
What is more, Protection Center can block the Windows Task Manager and the work of most legitimate Windows applications, so that they will not even start. If you try to run a program (that have “exe” extension), your computer will display a fake security warning that stats “Warning! Adware detected”. Click Ignore button to close the fake box.
Last but note least, the trojan which installs Protection Center will also install a variant of TDSS trojan. This trojan is very dangerous because it can block most antivirus and antispyware applications from running. But it’s not all, TDSS trojan can also redirect you from sites that you want to visit on a completely other.
As you can see, obviously, Protection Center is a scam, which has been created with one purpose to scare your into purchasing so-called “full” version of the program. Most importantly, do not purchase it! If you find that your computer is infected with the rogue, then be quick and take effort to remove it immediately. Follow the removal guidelines below to remove Protection Center and any associated malware from your computer for free.
More screen shoots of Protection Center
Symptoms in a HijackThis Log
O4 – HKCU\..\Run: [Protection Center] “C:\Program Files\Protection Center\cntprot.exe” -noscan
Use the following instructions to remove Protection Center (Uninstall instructions)
Step 1. Repair “running of .exe files”.
Click Start, Run. Type command and press Enter. Command console “black window” opens. Type notepad as shown below
Command console
Press Enter. Notepad opens. Copy all the text below into Notepad.
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
You will see window similar to the one below.
Notepad
Save this as fix.reg to your Desktop (remember to select Save as file type: All files in Notepad.) Double Click fix.reg and click YES for confirm.
Reboot your computer.
If you can`t create fix.reg, then download fix.zip from here, unzip it. Double Click fix.reg and click YES for confirm. Reboot your computer.
Step 2. Remove TDSS trojan-rootkit
You need remove TDSS trojan, after that, you will be able to remove Protection Center without any problem.
Download TDSSKiller from here and unzip to your desktop.
Open TDSSKiller folder. Right click to tdsskiller and select rename. Type a new name (123myapp, for example). Press Enter. Double click the TDSSKiller icon to start scanning Windows registry for TDSS trojan. If it is found, the you will see a screen similar to the one below.
TDSSKiller
When TDSSKiller will prompt you to press “Y”, type Y and press Enter. Your computer will be rebooted.
Step 3. Remove Protection Center and any associated malware.
Download MalwareBytes Anti-malware (MBAM). Once downloaded, close all programs and windows on your computer.
Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MalwareBytes Anti-malware onto your computer. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to “Update Malwarebytes’ Anti-Malware” and Launch “Malwarebytes’ Anti-Malware”. Then click Finish.
MalwareBytes Anti-malware will now automatically start and you will see a message stating that you should update the program before performing a scan. If an update is found, it will download and install the latest version.
As MalwareBytes Anti-malware will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main menu. You will see window similar to the one below.
Malwarebytes Anti-Malware Window
Make sure the “Perform quick scan” option is selected and then click on the Scan button to start scanning your computer for Protection Center infection. This procedure can take some time, so please be patient.
When the scan is finished a message box will appear that it has completed scanning successfully. Click OK. Now click “Show Results”. You will see a list of infected items similar as shown below.
Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure all entries have a checkmark at their far left and click “Remove Selected” button to remove Protection Center. MalwareBytes Anti-malware will now remove all of associated Protection Center files and registry keys and add them to the programs’ quarantine. When MalwareBytes Anti-malware has finished removing the infection, a log will open in Notepad and you may be prompted to Restart.
Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.
Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.
Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.
Protection Center creates the following files and folders
C:\Program Files\Protection Center
%UserProfile%\Start Menu\Programs\Protection Center
C:\Program Files\Protection Center\cnthook.dll
C:\Program Files\Protection Center\cntprot.exe
C:\Program Files\Protection Center\about.ico
C:\Program Files\Protection Center\activate.ico
C:\Program Files\Protection Center\buy.ico
C:\Program Files\Protection Center\help.ico
C:\Program Files\Protection Center\scan.ico
C:\Program Files\Protection Center\settings.ico
C:\Program Files\Protection Center\splash.mp3
C:\Program Files\Protection Center\uninstall.exe
C:\Program Files\Protection Center\update.ico
C:\Program Files\Protection Center\cnt.db
C:\Program Files\Protection Center\cntext.dll
C:\Program Files\Protection Center\virus.mp3
%UserProfile%\Start Menu\Programs\Protection Center\About.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Activate.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Buy.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Scan.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Settings.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Update.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Protection Center Support.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Protection Center.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Protection Center.lnk
%UserProfile%\Desktop\Protection Center Support.lnk
%UserProfile%\Desktop\Protection Center.lnk
Protection Center creates the following registry keys and values
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Protection Center
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Oh hai!
I have this horrible fake Protection Center -virus, but my problem is that I think it’s little bit different than others. Fake warnings are almost the same as this page but slightly different. TDSSKiller didn’t found any infected objects.
I have tried this Malwarebytes’ Anti-Malware, but that didn’t help either. Network has been shutted down and restore points are off when I have use this Anti-Malware -program.
Now I don’t know what to do. So can you tell me, how can I find out, what “version” virus I have.
Thank you very much!
Mupelo, please start a new topic in our Spyware removal forum. I will help you.
Hello,
I have problem at step 2. Running TDDSKiller showed folloing message:
– Start log failed!
– SetPrivileges failed!
– Driver load errors!
– Press any to continued…
then it disappears…
What should I do next?
Thanks in advanced for your kind help.
Onanong, you started it as Administrator ?
yes
It seems that after I run fix.reg. I cannot run .exe file anymore… keep saying application not found.. or something like that…
Onanong, try run fix.reg once again. Also you can try exeHelper. Download it from here.
Managed to get rid of the virus, but computer is acting extremely weird, games are all extremely laggy. Some apps no longer autostart, looks like i’ll have to reformat
Johnny, probably your computer is infected with a hidden trojan. Please open a new topic in our Spyware removal forum. I will check your PC.
I must have a modified version of this spyware… I can’t manage to even get the .exe files to repair.
Cannot thank you enough for these instructions…Perfectly got rid of the virus and now have the MalwareBytes program for future viruses…
FINALLY, after exhausting many suggestions, found your website with clear and specific instructions to remove the Protection Center virus/malware. It was successful and I’m back in business with no virus. Thank you!
Awesome step by step!! Worked perfect! Like above cannot thank enough!
Woohoo! Worked like a charm and saved us the $89 McAfee wanted to charge. Thanks a million for the clear, step-by-step instructions.
Hi, i had one of my clients infected with this virus. Now with this instruction i am ok and i can work perfectly. Thanks a lot to all
Thank You!!!!!!!
When I got it, it started displaying shortcuts to porn sites
Thank you SO MUCH!!!!!!!!!!!!! I followed the instructions and it worked! It’s great to have trusty websites like this one on the Internet.
Thanks again.
Appreciate your step by step support as specified above to get rid of Antimalware Doctor Protection Centre. It worked perfectly well to completely removed from my PC.
Strongly recommend any victim to take assistance of the above useful guideline to get out of the problem successfully without spending a dollar.
Thanks
I have followed ur step…but the TDSSKILLER will stuck when its scan on driver..the file name i am not clearly know it because the computer is from my school.(its is [nqw?????])
Is this nessasary to rename it?
Or the file .sys is the virus too?bcuz i can done the scanning on SAFE MODE but its found nothings.
lCn, try rename tdsskiller before running, and run it once again.
when i used the tsdd i renamed it i ran the scan and it said nothing was found. i still rebooted to see if maybe it was gone and after i came back to this site i started with step 3 to get the malware and then it started popping up again. i am no pro at all this and im sure i did everything right. i just dont get it and now i am sad 🙁 will i ever understand how to get rid of this and after i have this malware will it get rid of it and prevent all other viruses. i also have avg. thank you and i hope you can help.
i this i got a differnt malware too. this is my screen shot of mine. it looks nothing like your 🙁 can you please help me?? thank you
http://i833.photobucket.com/albums/zz251/tjmorris07/thisiswhatigot.jpg
tjmorris, please open a new topic in our Spyware removal forum. I will help you.
great site, completely got rid of my Malware ptotection center virus. i am so pleased with the free advice and software from this site I am going to buy the full version,partly as a thankyou for free help, and partly because my existing security still let the virus in!
is there an PC protact remolva tool present,,,,
if it is present how can i get that