PC Defender Description

PC Defender is a fake anti-spyware application that uses several misleading methods to tempt purchase of a full version of the PC Defender program. PCDefender has been known to display several false parasite alerts in the form of an annoying popup alert. In addition, PC Defender will conduct system scans that return several bogus parasite results. PC Defender does not have the ability to detect or remove legitimate parasites. It is suggested that users avoid use of PC Defender as it can cause damage to system registry entries.

Type: Rogue AntiSpyware Programs

How Can You Detect PC Defender?

PC Defender Technical Report

As new PC Defender details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following PC Defender files with its MD5s were created in the system:

PC Defender Removal Details

PC Defender has typically the following processes in memory:

• 96222EB958BE7AE1F3D10F.exe
• proccheck.exe
• Antispyware.exe
• E99A03E2B966DDBBBF0A73.exe

PC Defender created the following directories, files, paths:

• %WinDir%\Installer\FC2ABC8E-3715-4A32-B8B5-559380F45282
• %ProgramFiles%\Def Group\PC Defender

PC Defender creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Def Group\PC Defender\”" = “”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\WINDOWS\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\”" = “”
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\VAS\”922RR651620485838S50SR09QS119674.rkr” = “1B 00 00 00 06 00 00 00 10 8D 5A 77 91 B0 CA 01″
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\”ScrollPos1280×1024(1).y” = “0″
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\”Col” = “0xFFFFFFFF”
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Def Group\PC Defender\”Antispyware.exe” = “PC Defender application main executable”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\”Userinit” = “C:\WINDOWS\system32\userinit.exe,”C:\Program Files\Def Group\PC Defender\Antispyware.exe”"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Documents and Settings\All Users\Start Menu\Programs\PC Defender\”" = “”
• HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Def Group\PC Defender\”proccheck.exe” = “proccheck”
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\”ScrollPos1280×1024(1).x” = “0″
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\”SortDir” = “1″
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\”REG.exe” = “Registry Console Tool”
• HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Def Group\PC Defender\”proccheck.exe” = “proccheck”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\”Userinit” = “C:\WINDOWS\system32\userinit.exe,”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Def Group\”" = “”
• HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\”{92780B25-18CC-41C8-B9BE-3C9C571A8263}” “0×00002001″
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\”Mode” = “4″
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\”Sort” = “0″
• HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\INF\”922EE651620485838F50FE09DF119674.exe” = “922EE651620485838F50FE09DF119674″
• HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\”{92780B25-18CC-41C8-B9BE-3C9C571A8263}” = “0×00002001″

Important Article Disclaimer