It was not a question of if, but when. The Windows Phone 7 Series emulator ROM has been completely unlocked revealing more of the preproduction mobile operating system Microsoft didn’t want you to see.

Dan Ardelean who has been tinkering with the ROM for some time now has published a modified version of the “BIN” file which removes the locks Microsoft’s put in place to hide other components of the ROM.

Although there is definitely a lot to explore, to be devil’s advocate I must remind everyone that Windows Phone 7 Series and this ROM in particular is still a very early piece of work and the components in this emulator demo is not representative of what the final product will be. Play with it, have fun with it, but don’t build expectations on it.

User Protection is a fake anti-virus program from the same family as Dr. Guard and Paladin Antivirus. This fake program reports false threats on your computer and displays fake warnings to make you think that your computer is infected with worms, trojans, spyware, adware and etc. User Protection usually comes from fake online scanners, malicious sites (usually infected online video sites) or through the use of other malicious software.



The rogue program may be also distributed on popular social networks such as Facebook, MySpace or even Twitter. Very often, it comes bundled with rootkits (mainly TDSS rootkit) that's why you should run a full system scan with legitimate and powerful anti-malware program. It's possible to remove User Protection manually too, but manual removal is not recommended.

As a typical rogue anti-virus program, User Protection may block legitimate programs and especially antivirus and anti-malware applications. It also attempts to uninstall legitimate anti-virus software if it founds one on the compromised computer. It tries to uninstall MalwareBytes anti-malware, NOD32 Antivirus, AVG, Avast!, Avira and other better known security programs. The reason is obvious - to protect itself from being uninstalled.

It also uses browser hijacking and disables certain Windows system tools (usually task manager and registry editor). That's a usual behavior. UserProtection impersonates Windows Security Center and states that you should purchase the program in order to protect yourself. The most important thing to remember is that User Protection is a scam, absolutely needless program. It will prompt you to pay for a full version of the program numerous times. Don't buy it! If you have already purchased it, then you should contact your credit card company and dispute the charges while is not too late.

The most important question is of course how to get rid of this infection? Thankfully, there is a way to remove User Protection from a computer for free using legitimate anti-malware programs. Please follow the removal instructions below. If you have any questions, don't hesitate and ask or leave a comment. Good luck and be safe!

---

User Protection removal instructions:

1. Download the file TDSSKiller.zip and extract it into a folder
2. Execute the file TDSSKiller.exe (NOTE: you may have to rename TDSSKiller.exe to explorer.com yourself or download already renamed explorer.com file in order to run it)
3. Follow the prompts and wait for the scan and disinfection process to be over. Close all programs and press “Y” key to restart your computer.
More detail TDSSKiller tutorial: http://support.kaspersky.com/viruses/solutions?qid=208280684
4. Download one of the following anti-malware software and run a full system scan:

• SUPERAntispyware 
• Spybot S&D 
• MalwareBytes Anti-malware 
• Spyware Doctor (free version) 

5. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

---

User Protection associated files and registry values:

Files:

• C:\Documents and Settings\[User]\Start Menu\Programs\User Protection
• C:\Program Files\User Protection

Registry:

• HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt
• HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
• HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
• HKEY_LOCAL_MACHINE\SOFTWARE\User Protection
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\User Protection
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "User Protection"
• HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5E2121EE-0300-11D4-8D3B-444553540000}"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"

Please share this information with other people:

Security Guard is a fake antivirus program from the same family as CleanUP Antivirus. Basically, Security Guard is a rename of CleanUP Antivirus with several partial modifications. If you are reading this article then your computer is probably infected with Security Guard virus. Thankfully, you can use free anti-malware applications to remove this infection from your computer for free. Please note, this fake program may block anti-malware applications. That's why you may have to complete several additional steps before installing and running anti-malware software.



You probably already know what Security Guard and where it usually comes from? In short, it's fake antivirus program. Most of the time, it's promoted through the use of trojans or come bundled with other malicious software. Trojans enter a computer through software vulnerabilities without user's consent. That's why you may find comments from other people saying that this fake program just came up like from nowhere. Security Guard is also distributed via fake online scanners, malicious online video sites or even on Facebook, Twitter, MySpace and etc.

Once installed, the rogue program simulates a system scan and reports numerous false system security threats to make you think that your computer is infected when actually it's not. It also displays fake warnings about serious security and privacy problems. It may claim that your computer is under attack from a remote computer or that your data might be deleted. Furthermore, Security Guard hijacks Internet Explorer and displays fake warnings about insecure Internet connection. As you can see, it's nothing more but a scam. It goes without saying that you should remove Security Guard from your computer upon detection. Please follow the removal instructions bellow. If you have any questions just leave a comment. Good luck and be safe!

---

Security Guard removal instructions (method #1):

Download one of the following legitimate anti-malware applications and run a quick system scan. Don’t forget to update it first. All programs a free.

• MalwareBytes Anti-malware 
• SUPERAntispyware 
• Spybot S&D 
• Spyware Doctor (free version) 

NOTE1: if you can't run any of the above programs you must rename the installer of selected program before saving it on your PC. For example: if you choose MalwareBytes then you have to rename mbam-setup.exe to iexplore.exe, explorer.exe or any random name like test123.exe before saving it.

NOTE2: if you still can't run the renamed file then you need to change file extension too not only the name.
1. Go to "My Computer".
2. Select "Tools" from menu and click "Folder Options".
3. Select "View" tab and uncheck the checkbox labeled "Hide file extensions for known file types". Click OK.
4. Rename mbam-setup.exe to either test123.com or test123.pif
5. Double-click to run renamed file.

---

Removing Security Guard in Safe Mode with Networking (method #2):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm



NOTE: Login as the same user you were previously logged in with in the normal Windows mode.
If you can't reboot your PC in Safe Mode with Networking, download SafeBootKeyRepair and run it. If the rogue program blocks it then download and run this file RenamedSBKRepair. Follow the prompts. Then reboot your PC in Safe Mode with Networking.

2.Download one of the following legitimate anti-malware applications and run a quick system scan. Don’t forget to update it first. All programs a free.

• MalwareBytes Anti-malware 
• SUPERAntispyware 
• Spybot S&D 
• Spyware Doctor (free version) 

---

CleanUp Antivirus files and registry values:

Folders and files:

• C:\Documents and Settings\All Users\Application Data\345d567
• C:\Documents and Settings\All Users\Application Data\345d567\24.mof
• C:\Documents and Settings\All Users\Application Data\345d567\mozcrt19.dll
• C:\Documents and Settings\All Users\Application Data\345d567\SG345d.exe
• C:\Documents and Settings\All Users\Application Data\345d567\SGD.ico
• C:\Documents and Settings\All Users\Application Data\SGZIQYEXRD
• C:\Documents and Settings\All Users\Application Data\SGZIQYEXRD\SGWNLED.cfg
• %UserProfile%\Application Data\Security Guard
• C:\Program Files\Mozilla Firefox\searchplugins\search.xml

Registry values:

• HKEY_CURRENT_USER\Software\3
• HKEY_CLASSES_ROOT\SG345d.DocHostUIHandler
• HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=1002&q={searchTerms}"
• HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=1002&q={searchTerms}"
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" = "http://127.0.0.1:27777/?inj=%ORIGINAL%"
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "layout/2.01002"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Security Guard"
• HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=1002&q={searchTerms}"

Share this information with other people:

Contrary to the controversial report out of Microsoft MIX10 this week that Windows Phone 7 Series will not feature copy & paste functionality, a person close to the den explained that copy & paste is definitely a scenario and feature that the team is putting a lot of thought about and hope to bring to the platform soon after initial release.

Let’s not forget Microsoft already knows at least one way to do copy & paste from Windows Mobile, but this was one of many scenarios they want to refine to fit in the context of their new user experience which already has a lot of “smarts” for automatically connecting data between applications – for example, detecting and hotlinking addresses in emails to Bing Maps.

As it turns out, the development team actually knows exactly how they will be implementing copy & paste in WP7S but did not believe it could be implemented without affecting the release schedule they’ve committed to and therefore will be including it in an update down the road.

I’m sure they can deliver it sooner than Apple did it (2 years).

A number of concept screenshots of early Metro concepts for Windows Phone 7 Series was published in the slides of the “Windows Phone UI and Design Language” session at Microsoft MIX10 this week giving us a rare peek into what Metro could have been.

If one thing’s for sure, large fonts and a text-driven layout was a sure-thing since the beginning. It appears they experimented with a much larger time display and diagonal-placed controls which look kind of cool but one could imagine to be a usability nightmare. Take a look for yourself.

[See post to watch Flash video]

If a woman walking down a street didn’t do it for you, then a new Windows Phone 7 Series promotional video with a stronger emphasis on end-to-end scenarios was shown off at a Microsoft MIX10 session this week.

This Star Trek-inspired video takes you in to the lives of Anna and Miles, two made-up “life maximizer” personalities that the WP7S team uses to craft their product for. Scenarios demonstrated in the video includes taking and sharing a photo, playing games, messaging, social networking, searching and navigation. These guys obviously have a lot of free time.