How to remove Windows PC Defender?
What is Windows PC Defender?
Windows PC Defender is a rogue anti-spyware program and a clone of Ultimate System Guard, Windows Guard Pro and some others. This parasite spreads by deceiving users into downloading the program. It also relies on misleading advertising to trick you into purchasing it’s so-called “licensed version”, which is just as fake as the “trial”.
When surfing the web, you may encounter popups, such as these:
“Warning! Your computer is infected
Warning! Trojan Found!
File name: crss.drv
Threat name: Trojan-Spy.HTML.Sunfraud.a”
and
“System alert
Suspicious software, which may be malicious, has been detected on your PC. Click here to remove this threat immediately with Windows PC Defender”
You have a choice what to click on these popups, but this is where choice ends, since regardless of what you click, the parasite will take you to an online-scanner. This scanner is fake, but will not appear to be so. It pretends to scan the system and afterwards claims that it is infected and in need of an anti-spyware program. You will then be prompted to download Windows PC Defender, which can supposedly dispose of the infection.
Once inside and active, Windows PC Defender creates harmless files and runs a scan, which marks these files as serious threats to the system. They cannot be removed, or so Windows PC Defender claims, without the “full version” of the remover, which costs quite a bit of money and is every bit as useless as the trial.
Windows PC Defender is a scam and should be treated as such: do NOT download or buy it and block these websites:
74.125.45.100 4-open-davinci.com
74.125.45.100 securitysoftwarepayments.com
74.125.45.100 privatesecuredpayments.com
74.125.45.100 secure.privatesecuredpayments.com
74.125.45.100 getantivirusplusnow.com
74.125.45.100 secure-plus-payments.com
74.125.45.100 www.getantivirusplusnow.com
74.125.45.100 www.secure-plus-payments.com
74.125.45.100 www.getavplusnow.com
74.125.45.100 www.securesoftwarebill.com
74.125.45.100 secure.paysecuresystem.com
74.125.45.100 paysoftbillsolution.com
Remove Windows PC Defender and all its files as soon as you detect this parasite in your PC!
Windows PC Defender is Extremely dangerous
Windows PC Defender is a corrupt Anti-Spyware program Windows PC Defender may spread via Trojans Windows PC Defender may display fake security messages Windows PC Defender may install additional spyware to your computer Windows PC Defender may repair its files, spread or update by itself Windows PC Defender violates your privacy and compromises your security
Windows PC Defender screenshots
Manual Windows PC Defender removal
Important Note: Although it is possible to manually remove Windows PC Defender, such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using automatic spyware removal applications found on 2-viruses.com.
Stop these Windows PC Defender processes:
Disable these Windows PC Defender DLL files::
Remove these Windows PC Defender Registry Entries:
Remove these Windows PC Defender files:
Windows PC Defender is classified as Rogue Anti-Spyware. After infecting a user’s system, it proceeds to scare its victim into buying the “product” by displaying fake security messages, stating that your computer is infected with spyware and only Windows PC Defender can help you to remove it after you download the trial version. As soon as the victim downloads Windows PC Defender trial version, it pretends to scan your computer and shows a grossly exaggerated amount of non-existent errors. Then, Windows PC Defender offers to buy the full version to fix these false errors. If the user agrees, Windows PC Defender does not only fix the errors, but it also takes the user’s money and may even install additional spyware into the victim’s computer.
Some Rogue Anti-Spyware, such as Windows PC Defender, may offer users to buy it after the victim clicks on a banner or a pop-up while surfing the internet. Usually, a Trojan is installed to a victim’s computer after clicking on the advertisement. It then proceeds to download or even install Windows PC Defender, which is another way for Rogue Anti-Spyware to spread itself.
Most of rogue Anti-Spyware, such as Windows PC Defender, is nearly impossible to remove manually.
This malware is not allowing me to use Spyware Doctor.
It even threatens when I try to download Spyware Doctor.
Mygame: Download to a flash drive or from alternate location.
I knew that PC defender was fishy. I could not delite it once I instald It and it wasnt on add remove list
I got it on a flash drive and installed it on the infected computer but it will not allow me to run it. HELP. Please
Try renaming it into something else, or try following trick :
Open a new document with notepad, write something but do not save. Then start shut down procedure, wait till it blocks and asks you what to do with document. Wait for a while, then cancel shutdown. Try launcing program then
1. Go to Windows Start button -> All Programs
2. Look for the icon Windows PC Defender and find out the location of its directory.
(I located mine at c:\programdata\7ccc47a)
FYI:
You won’t find this directory in Windows Explorer even if you set your Folder Options to Show hidden files and folders
3. Restart your computer in safe mode with command prompt.
4. In your command prompt type:
- cd\ (press enter key on your keyboard)
- cd programdata (press enter key on your keyboard)
- rd (type the folder location here) /s /q (press enter key on your keyboard)
- exit (press enter key on your keyboard)
5. Restart your computer.
** Also you can try using Malwarebyte software, its free.
helpful article, but it appears that pc defender (or some other program) has now allowed me to get into my task manager to shut down the programs. it also seems that malwarebytes cant remove it for some reason, even though it detects it.
Malwarebytes are often blocked by such rogues. Try downloading/redownloading Spyware Doctor – we got an updated version today.
@admin
what are we suppose to try and rename? I renamed pctsGui.exe to pctsGuitest.exe and it let the program open up, but it just sits there and will not let me start scan. The System Status just says Checking… and never changes.
kennywayne07 : Re-download Spyware Doctor, we got a new build (6.1) that should be better against newest trojans.
HELP!! Hier est survenu windows defender pc en cherchant un lien sur internet..
je lis vos reponses mais je ne comprends rien,je suis trop nul en informatique.. si qulqu’un a du temps à me consacrer svp!!! j’ai un netbook et je ne peux plus naviguer sur le net correctement..grrrr
Bullcrap we have the same problem !! pls help us
I was just checking out your system and it has blocked my whole computer. I can’t even get on line. Would PLEASE do what you can to clear this out of my computer using my e-mail address. Like I said–I can not open any windows because everything is block by you. Help!! Robert Parks
These bastards have made my life miserable all day. Can they be reported somewhere? I cannot get rid of their nasty asses. I am glad I wasn’t guillable enough to turn over a credit card number to them. Where can we go to get the real help that is needed?
i was idiotic enough to buy the 12month plan im wondering will it take all my money so i can cancel the credit card
It looks like I successfully downloaded Spy Doctor, however, the Windows PC Defender continues to keep popping up. Now what?
Contact PC Tools support – you got a new strain of trojans promoting it. Also, try updating definitions before scan.
Yesterday, Friday, October 9, 2009, Actually last Night, maybe even the early morning, Saturday, I got mauled by some malware. It was loading viruses, spam pull downs, adware, trojan horses, moles and who knows what else. Its first indication of being in my computer was a phoney danger alert that some assortment of virus, trojans, etc. were discovered (by this WINDOWS on-line antivirus software) on my computer. It said that it was “Windows P. C. Defender – on line” (not to be confused with “Windows Defender”) to be downloaded from (probably stolen, diverted or captured). I needed to download immediately to cleanse my computer before there was damage. The only damage was caused by this malware. It systematically started down loading the aforementioned malwares and started systematically searching memory and my hard drives for antivirus software and disabling it. I was fast losing control of my computer and had to shut it off and do a system restore to get my anti-virus protection back. I found chatter on the Internet about this thing and will try to remove it. My current anti-virus software, NOD32, SPYBOT, ADAWARE, etc. were helpless. I think, somehow, this was a driveby, although, I went to a lot of sports and football sites yesterday, one of them could, knowingly or not, be infected, it may even have been in a “cookie”.
her’s an additipn:
p.s.: I found a suspicious “cookie”, “owner@mariaclara.txt.
How to remove Windows PC Defender?
pls help me??
A couple of days ago I got a flag from NOD32 (about one of the cookie’s files) that I submitted (see 10-10-09). They found another “cookie” and a nest of files and malware that they have since quarantined that I will probably have to have removed when I get time to review them. Looks like the boys and girls at ESET (NOD32) are getting up to speed on this beastie.