Datprot.exe is the core component of rogue antispyware program called Data Protection. Datprot.exe infiltrate computers through the use of trojans. Once the trojan is installed and started, it will download datprot.exe and other components of Data Protection and save it to %ProgramFiles%\Data Protection folder (%ProgramFiles% is the C:\Program Files by defaults). After that, the same trojan will configure datprot.exe to run automatically when Windows loads.
When datprot.exe is started, it will imitate a system scan. Once finished, the malware will state that your computer is infected with trojans, adware or malware and that you should purchase the full version of the program to remove these infections. Important to know, the malicious program is unable to find the infections, as will not protect you from possible infection in the future. So, do not trust the scan results, simply ignore them.
While datprot.exe is running, it will flood your computer with nag screens, fake security alerts and notifications from your Windows taskbar. A few examples:
Warning! Adware detected!
Adware module detected on your PC!
Warning! Network attack detected!
Network intrusion detected!
Your computer is being attacked from a remote PC.
Warning! Keylogger detected!
Keylogger activity detected on your PC!
Danger!
It is strongly recommended to protect your computer against
security threats. Click on the message to ensure the
protection of your computer.
However, all of these alerts, warnings and notifications are fake and like false scan results supposed to scare you into purchasing so-called “full” version of the malicious program. You should ignore all of them!
Last but note least, the trojan which installs datprot.exe malware, will also download and install a variant of TDSS trojan. This trojan is very dangerous because it can block most antivirus and antispyware applications from running and redirect you from sites that you want to visit on a completely other.
As you can see datprot.exe is very dangerous and can lead to a complete paralysis of your computer, as well as leakage of your personal data in the hands of the authors of the malicious program. Need as quickly as possible to check your computer and remove all found components of this malware. Use the removal guide below to remove datprot.exe and any associated malware from your computer for free.
Symptoms in a HijackThis Log
O4 – HKCU\..\Run: [Data Protection] “C:\Program Files\Data Protection\datprot.exe” -noscan
Use the following instructions to remove datprot.exe malware
Step 1. Remove TDSS trojan-rootkit
First you need remove TDSS trojan, after that, you will be able to remove datprot.exe and any associated malware without any problems.
Download TDSSKiller from here and unzip to your desktop.
Open TDSSKiller folder. Right click to tdsskiller and select rename. Type a new name (123myapp, for example). Press Enter. Double click the TDSSKiller icon to start scanning Windows registry for TDSS trojan. If it is found, the you will see a screen similar to the one below.
TDSSKiller
Follow the prompts. When TDSSKiller will prompt you to press “Y”, type Y and press Enter. Your computer will be rebooted. Once computer loaded, please run TDSSKiller once again to ensure that TDSS trojan is removed (repeat the step if need).
Step 2. Remove datprot.exe infection and any associated malware.
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select Perform Quick Scan, then click Scan, it will start scanning your computer for datprot.exe infection. This procedure can take some time, so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected for start datprot.exe malware removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.
Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.
Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.
Datprot.exe malware creates the following files and folders
C:\Program Files\Data Protection
%UserProfile%\Start Menu\Programs\Data Protection
C:\Program Files\Data Protection\dathook.dll
C:\Program Files\Data Protection\datprot.exe
C:\Program Files\Data Protection\about.ico
C:\Program Files\Data Protection\activate.ico
C:\Program Files\Data Protection\buy.ico
C:\Program Files\Data Protection\help.ico
C:\Program Files\Data Protection\scan.ico
C:\Program Files\Data Protection\settings.ico
C:\Program Files\Data Protection\splash.mp3
C:\Program Files\Data Protection\uninstall.exe
C:\Program Files\Data Protection\update.ico
C:\Program Files\Data Protection\dat.db
C:\Program Files\Data Protection\datext.dll
C:\Program Files\Data Protection\virus.mp3
%UserProfile%\Start Menu\Programs\Data Protection\About.lnk
%UserProfile%\Start Menu\Programs\Data Protection\Activate.lnk
%UserProfile%\Start Menu\Programs\Data Protection\Buy.lnk
%UserProfile%\Start Menu\Programs\Data Protection\Scan.lnk
%UserProfile%\Start Menu\Programs\Data Protection\Settings.lnk
%UserProfile%\Start Menu\Programs\Data Protection\Update.lnk
%UserProfile%\Start Menu\Programs\Data Protection\Data Protection Support.lnk
%UserProfile%\Start Menu\Programs\Data Protection\Data Protection.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Data Protection.lnk
%UserProfile%\Desktop\Data Protection Support.lnk
%UserProfile%\Desktop\Data Protection.lnk
Datprot.exe malware creates the following registry keys and values
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\data protection
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
