Files

%Desktop%\Your Protection.lnk
%Desktop%\Your Protection Support.lnk
%Desktop%\nudetube.com.lnk
%Desktop%\pornotube.com.lnk
%Desktop%\youporn.com.lnk 

%Temp%\mplay32xe.exe

%ProgramFiles%\Your Protection\urpprot.exe

%ProgramFiles%\Your Protection\urpext.dll

%ProgramFiles%\Your Protection\urpext.dll

%ProgramFiles%\Your Protection\urphook.dll

%ProgramFiles%\Your Protection\urp.db

Folders

%ProgramFiles%\Your Protection
%StartMenu%\Programs\Your Protection

RegistryEntries

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B45FF030-4447-11D2-85DE-00C04FA35C89}
Key: HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your Protection
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Your Protection
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value: mplay32xe.exe
Data: C:\Temp\mplay32xe.exe
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value: Your Protection
Data: "C:\Program Files\Your Protection\urpprot.exe" -noscan
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
Value: DisableTaskMgr
Data: 01, 00, 00, 00
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Value: {5E2121EE-0300-11D4-8D3B-444553540000}
Data: Your Protection extension