Monday, April 27, 2009

How to remove WinPC Defender

WinPC Defender Description

WinPC Defender is a fake antispyware application. WinPC Defender is promoted as an anti-virus / online scanner and firewall, but it does not perform any of these tasks. WinPC Defender just imitates the look and feel of a real security application while in fact it is a byproduct of a serious infection:


WinPC Defender is another clone of XP Police Antivirus rogue anti-spyware. It displays fake or exaggerated list of spyware threats and tries to frighten the user into purchasing of the "full" version of that rogue software.

Computers infected with WinPC Defender may have their search results misdirected / redirected to bogus sites, and existing antivirus software may become disabled.

WinPC Defender displays annoying warning messages from the Windows taskbar informing about detected threats. If the user chooses the option to remove detected "threat", he/she will be asked to buy the full version of WinPC Defender.

WinPC Defender automatic detection

Suggested WinPC Defender Removal Tool

How to remove WinPC Defender manually

First thing you want to do is to bookmark this page because you will need to refer to it several times duting manual removal (click here to bookmark this page).
You must perform the following tasks to remove WinPC Defender malware manually: stop all malicious processes, unregister malicious DLL files, delete all files and registry keys installed by WinPC Defender files and block WinPC Defender redistribution websites.

During installation WinPC Defender registers itself in the list of installed applications. You can try to remove WinPC Defender using "Control Panel" -> "Add or Remove Programs" utility, however some hidden files may be left behind on the system.

WinPC Defender manual removal instructions

Stop all WinPC Defender malicious processes:
  • 1234.exe
  • 7339880.exe
  • install.exe
  • pcdefender.exe
  • WinPC Defender.exe

Unregister WinPC Defender malicious DLLs:
  • ieocx.dll

Delete all files installed by WinPC Defender:
  • 1234.exe
  • 7339880.exe
  • %Application Data%\pcdefender.exe
  • %Documents and Settings%\%User%\Desktop\winpc defender.lnk
  • ieocx.dll
  • install.exe
  • %Start Menu%\winpc defender.lnk
  • WinPC Defender.exe

Delete all registry keys installed by WinPC Defender:
  • %HKCU%\software\microsoft\windows\currentversion\ext\stats\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}
  • %HKCU%\software\winpc defender
  • %HKLM%\software\classes\clsid\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}\programmable
  • %HKLM%\software\classes\typelib\{a54dc52d-7aad-4d40-a126-337211631edc}
  • %HKLM%\software\classes\typelib\{a54dc52d-7aad-4d40-a126-337211631edc}\1.0\0
  • %HKLM%\software\microsoft\windows\currentversion\explorer\browser helper objects\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}

Block WinPC Defender redistribution websites:
  • win-pc-defender.com
  • xp-police-09.com
  • xp-police-2009.com
  • xp-police-antivirus.com
  • xp-police-av.com
  • xp-police-engine.com
  • xp-police.com
  • viewworldmy1.com

Once you complete the above manual removal steps, download this scanner to scan your computer for any WinPC Defender leftovers.

Similar Malware Threats

  • WinPC Antivirus
  • Xp-police-engine.com
  • Xp-police-antivirus.com
  • Xp-police-av.com
  • Xp-police-2009.com
  • XP Police Antivirus

No comments: