Prozac Online Buy Antabuse Cipro Online Buy Cymbalta Toprol XL Online Buy Cipro Elimite Online Buy Neurontin Nexium Online Buy Seroquel

PC Defender is the latest descendant from the creators of many other fake applications being pushed into the market. PC Defender presents itself as a legit malware detection and removal tool. When it installs into a system, PC Defender makes some changes to some system files and registry entries to ensure that it runs with every Windows start up. Additionally, PC Defender is able to modify your web browser settings to redirect you to a malicious third-party website.

Fake system scans, constant malware alerts and bothersome pop-ups are all part of PC Defender strategy to get gullible users to purchase it. We recommend that you install a recognized anti-spyware program and remove PC Defender from your computer at your earliest convenience.

Automated Detection for PC Defender

PC Defender Manual Removal Instructions

Stop PC Defender system processes:

E99A03E2B966DDBBBF0A73.exe
96222EB958BE7AE1F3D10F.exe
proccheck.exe
Antispyware.exe

Remove PC Defender files:

E99A03E2B966DDBBBF0A73.exe
96222EB958BE7AE1F3D10F.exe
proccheck.exe
Antispyware.exe

Remove PC Defender registry values:

HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache\\C:\\Program Files\\Def Group\\PC Defender\\"proccheck.exe" = "proccheck"
HKEY_USERS\\S-1-5-18\\Software\\Microsoft\\Internet Explorer\\Extensions\\CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" = "0x00002001"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache\\C:\\Program Files\\Def Group\\PC Defender\\"Antispyware.exe" = "PC Defender application main executable"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache\\C:\\WINDOWS\\system32\\"REG.exe" = "Registry Console Tool"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache\\C:\\INF\\"922EE651620485838F50FE09DF119674.exe" = "922EE651620485838F50FE09DF119674"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\Bags\\16\\Shell\\"Col" = "0xFFFFFFFF"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\Bags\\16\\Shell\\"SortDir" = "1"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\Bags\\16\\Shell\\"Sort" = "0"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\Bags\\16\\Shell\\"ScrollPos1280x1024(1).y" = "0"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\Bags\\16\\Shell\\"ScrollPos1280x1024(1).x" = "0"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\ShellNoRoam\\Bags\\16\\Shell\\"Mode" = "4"
HKEY_USERS\\S-1-5-21-1172441840-534431857-1906119351-500\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{75048700-EF1F-11D0-9888-006097DEACF9}\\Count\\HRZR_EHACNGU:P:\\VAS\\"922RR651620485838S50SR09QS119674.rkr" = "1B 00 00 00 06 00 00 00 10 8D 5A 77 91 B0 CA 01"
HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache\\C:\\Program Files\\Def Group\\PC Defender\\"proccheck.exe" = "proccheck"
HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\Extensions\\CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" "0x00002001"
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Folders\\C:\\WINDOWS\\Installer\\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\\"" = ""
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Folders\\C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\PC Defender\\"" = ""
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Folders\\C:\\Program Files\\Def Group\\"" = ""
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Folders\\C:\\Program Files\\Def Group\\PC Defender\\"" = ""
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\"Userinit" = "C:\\WINDOWS\\system32\\userinit.exe,"C:\\Program Files\\Def Group\\PC Defender\\Antispyware.exe""
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\"Userinit" = "C:\\WINDOWS\\system32\\userinit.exe,"

Important Disclaimer

PC Defender is related to:

  » PC Defender 2010

This entry was posted on Saturday, February 20th, 2010 at 6:27 am and is filed under Rogue Anti-Spyware Program. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.