PC Defender Removal Guide

PC Defender Description

PC Defender is a fake spyware removal program that usually tempts computer users into purchasing a full version of the PC Defender application. PC Defender is very misleading in the way that it displays system alerts and warning notifications of parasites found on the computer that it is installed on. These threats that PC Defender supposedly detects are not present on the system. PC Defender will also conduct a system scan that falsely identifies parasites. PC Defender cannot be trusted and it is recommended that users avoid use of PCDefender at all costs.

PC Defender or PCDefender Automatic Detection (Recommended)

Is your PC infected with PC Defender? To safely & quickly detect PC Defender, we highly recommend you...

Download SpyHunter's* Malware Scanner.

PC Defender Manual Removal Instructions

Backup Reminder: Always be sure to back up your PC before making any changes.

Step 1 : Use Windows File Search Tool to Find PC Defender Path

"PC Defender" files can be found in the directory path(s):

Read more on How to Find PC Defender with File Search Tool

Step 2 : Use Windows Task Manager to Remove PC Defender Processes

Remove the "PC Defender" processes files:

Read more on How to kill PC Defender Processes

Step 3 : Use Registry Editor to Remove PC Defender Registry Values

Locate and delete "PC Defender" registry entries:

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Def Group\PC Defender\"proccheck.exe" = "proccheck"
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" = "0x00002001"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Def Group\PC Defender\"Antispyware.exe" = "PC Defender application main executable"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\"REG.exe" = "Registry Console Tool"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\INF\"922EE651620485838F50FE09DF119674.exe" = "922EE651620485838F50FE09DF119674"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\"Col" = "0xFFFFFFFF"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\"SortDir" = "1"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\"Sort" = "0"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\"ScrollPos1280x1024(1).y" = "0"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\"ScrollPos1280x1024(1).x" = "0"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\Bags\16\Shell\"Mode" = "4"
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\VAS\"922RR651620485838S50SR09QS119674.rkr" = "1B 00 00 00 06 00 00 00 10 8D 5A 77 91 B0 CA 01"
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Def Group\PC Defender\"proccheck.exe" = "proccheck"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" "0x00002001"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\WINDOWS\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\"" = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Documents and Settings\All Users\Start Menu\Programs\PC Defender\"" = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Def Group\"" = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Def Group\PC Defender\"" = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Userinit" = "C:\WINDOWS\system32\userinit.exe,"C:\Program Files\Def Group\PC Defender\Antispyware.exe""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Userinit" = "C:\WINDOWS\system32\userinit.exe,"

Step 4 : Detect and Delete Other PC Defender Files

Remove the "PC Defender" processes files:

Read more on How to Delete Harmful Files

Step 5 : View the PC Defender Components with its MD5s

Remove the "PC Defender" components:

File Name	File Size	MD5
proccheck.exe	58880	47bc3a198e6ba69d058381e9cfc21db2
_C507892FD1860AF6477A61.exe	21630	b84df77564555c63c899fce0fcec7edb
Antispyware.exe	1165312	7d744b20ec17d42f55f5d61a29f56fd3
_BF2DDB0AC7FD40D5AAEDAF.exe	21630	b84df77564555c63c899fce0fcec7edb
movie_1029644.avi[1].exe	898276	56464d15f4ca0ab818fc873e0d2ae3d2
hook.dll	42496	ac37c81015f9d495442f8a8bc5299ea2

Site Disclaimer

Publication Date: Fri Feb 19 2010 13:52:24 EST

User Comments

There are no comments posted for this page.

RECOMMENDED

Top Parasite Threats

Recent Parasite Threats

Resources and Tools

Recent Articles

Subscribe To