WinPC Defender Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCartCartCart

WinPC Defender, or WinPCDefender, is a rogue anti-spyware program. WinPC Defender is usually installed in the user’s computer system with the help of Trojan Zlob or the user may have downloaded it from a malicious website. Once installed, the user may receive annoying popup notifications of imaginary spyware infections. These fake notifications redirect the user to fraudulent websites that sell WinPC Defender as a legitimate software. WinPC Defender is not able to detect nor remove any spyware infections. WinPC Defender is an infection itself.

In addition, WinPC Defender is able to emulate a computer system scan and trick users into believing their computer systems are flooded with spyware. The result of this scan is entirely bogus and is only meant to push users into purchasing the “full” version of a rogue software. WinPC Defender may also hijack the user’s Internet browser and display a fake popup notification stating that the browser has been blocked due to the presence of malware.

WinPC Defender may cause system errors and freezes. WinPC Defender is a clone XP Police Antivirus.

Type: Rogue AntiSpyware Programs

Automatic Detection of WinPC Defender

WinPC Defender Technical Report

As new WinPC Defender details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following WinPC Defender files with its MD5s were created in the system:

WinPC Defender has typically the following processes in memory:

• %USERPROFILE%\AppData\Roaming\pcdefender.exe
• pcdefender.exe
• defender.exe
• WinPC Defender.exe
• pcdef[1].exe

WinPC Defender creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinPC Defender
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WinPC Defender”
• HKEY_CURRENT_USER\Software\WinPC Defender
• WinPC Defender

Important Article Disclaimer