Windows PC Defender Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCartCartCartCart

Windows PC Defender is a rogue anti-spyware program that comes from the same family of fake security applications as OmegaAntivir and Windows Additional Guard. Windows PC Defender, through the use of deceptive notifications and system scans, is able to trick computer users into believing that their computer is infected with parasites. Windows PC Defender is offered as a solution to the computer infections but is unable to detect or remove them.

Type: Rogue AntiSpyware Programs

How Can You Detect Windows PC Defender?

Windows PC Defender Technical Report

As new Windows PC Defender details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Windows PC Defender files with its MD5s were created in the system:

Windows PC Defender has typically the following processes in memory:

• ppal.exe
• ddv.dll
• tempdoc.dll
• fix.exe
• cid.dll
• sqlite3.dll
• eb.exe
• WP345d.exe
• mozcrt19.dll

Windows PC Defender created the following directories, files, paths:

• %AppData%\Windows PC Defender
• %AllUsersProfile%\Application Data\WPCDSys

Windows PC Defender creates the following registry entries:

• HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes “URL” => “http://search-gala.com/?&uid=201&q={searchTerms}”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “89770891803″
• HKEY_CLASSES_ROOT\WP345d.DocHostUIHandler
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “UID” = “201″
• HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer “PRS” = “http://127.0.0.1:27777/?inj=%ORIGINAL%”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Windows PC Defender”

Important Article Disclaimer