Wednesday, July 8, 2009

WinPC Defender Removal GuideWinPC Defender Removal Guide

WinPC Defender Removal Guide
WinPC Defender is a rogue anti-spyware program. Once executed, WinPC Defender will generate false messages stating that your computer is infected with spyware. The makers of WinPC Defender seek to goad into purchasing their promoted full version of WinPC Defender. WinPC Defender is reported to be a clone of XP Police Antivirus, WinDefender 2009, Total Secure 2009, and IE-Security. WinPC Defender will also display notifications of imaginary security risks in its attempts to get the user to purchase the full version. WinPC Defender may be difficult to remove manually, and may continue to try to recreate itself.

Removal Tool: Remove Fake Antivirus. (Download it here.)

WinPC Defender Removal Guide
Kill Process
(How to kill a process effectively?)
defender.exe
pcdef[1].exe
%USERPROFILE%\AppData\Roaming\pcdefender.exe
pcdefender.exe
WinPC Defender.exe
Ta1HnnaIasEcfgF.exe
install[1].exe

Delete Registry
HKEY_CLASSES_ROOT\TypeLib\{A54DC52D-7AAD-4D40-A126-337211631EDC}
HKEY_CURRENT_USER\Control Panel\don't load "scui.cpl"
HKEY_CURRENT_USER\Control Panel\don't load "wscui.cpl"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "sysav"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "WinPC Defender"
HKEY_CURRENT_USER\Software\WinPC Defender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39fc2065-c9c7-49cd-8942-44cc2dedc844}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Content"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinPC Defender

Remove Folders and Files
%Program Files%\WinPC Defender
%USERPROFILE%\AppData\Roaming\pcdefender.exe
defender.exe
pcdef[1].exe
pcdefender.exe-removed_skip
pcdefender.exe
ieocx.dll

No comments:

Post a Comment