Windows PC Defender. How to remove? (Uninstall guide)

removal by Ugnius Kiguolis - -   Also known as WindowsPCDefender, WindowsPC Defender, Windows PCDefender | Type: Rogue Antispyware
12

Windows PC Defender is a misleading security application that reports false system security threats and displays fake security alerts or notifications to make you think your computer is infected. The program is from the same family as OmegaAntivir, Windows Additional Guard, Windows Guard Pro, Ultimate System Guard. Once installed, the rogue application will display non-existing infections or PC threats and prompt you to pay for a full version of the program to remove those infections. Do not purchase WindowsPC Defender. Uninstall Windows PC Defender from your computer as soon as possible. Otherwise it may cause even more damage to the system.

Windows PC Defender is promoted mainly through the use of fake online anti-spyware scanners. It can be also pushed using Trojan viruses, browser hijackers and other malicious software. Fake online scanner will display numerous infections on your computer and recommend you to use WindowsPCDefender to remove found infections and to ensure full PC protection. However, do not install this parasite and leave a misleading website immediately. Fake security alerts reads:

“Warning! Your computer is infected
Warning! Trojan Found!
File name: crss.drv
Threat name: Trojan-Spy.HTML.Sunfraud.a”

“System alert
Suspicious software, which may be malicious, has been detected on your PC. Click here to remove this threat immediately with Windows PC Defender”

When running, Windows PC Defender will flood your computer with fake system security alerts claiming that your PC is not protected and that your anti-virus software is disabled. The parasite will impersonate Windows Security Center and display bogus notifications from Windows task bar. Furthermore, Windows PCDefender will block antivirus software and security related websites to protect itself from being deleted. The rogue program will likely slow down your computer and block task manager, registry editor and other tools. If you find that your PC is infected with this misleading application, please use the removal guide below to remove Windows PC Defender from the system manually for free.

do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Windows PC Defender you agree to our privacy policy and agreement of use.
Reimage is recommended to uninstall Windows PC Defender. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.
Alternate Software
Plumbytes Anti-Malware
We have tested Plumbytes Anti-Malware's efficiency in removing Windows PC Defender (2012-01-14)
Malwarebytes Anti Malware
We have tested Malwarebytes Anti Malware's efficiency in removing Windows PC Defender (2012-01-14)
Hitman Pro
We have tested Hitman Pro's efficiency in removing Windows PC Defender (2012-01-14)
Webroot SecureAnywhere AntiVirus
We have tested Webroot SecureAnywhere AntiVirus's efficiency in removing Windows PC Defender (2012-01-14)
Windows PC Defender snapshot
Windows PC Defender

Windows PC Defender manual removal:

Kill processes:
WP345d.exe

eb.exe

fix.exe

ppal.exe

Delete registry values:
HKEY_CLASSES_ROOTCLSID{3F2BBC05-40DF-11D2-9455-00104BC936FF}

HKEY_CLASSES_ROOTWP345d.DocHostUIHandler

HKEY_USERS.DEFAULTSoftwareMicrosoftInternet ExplorerSearchScopes "URL" => "http://search-gala.com/?&uid=201&q={searchTerms}"

HKEY_CURRENT_USERSoftwareMicrosoftInternet Explorer "PRS" = "http://127.0.0.1:27777/?inj=%ORIGINAL%"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "UID" = "201"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings5.0User AgentPost Platform "89770891803"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "Windows PC Defender"



Unregister DLLs:
mozcrt19.dll

sqlite3.dll

cid.dll

ddv.dll

tempdoc.dll

Delete files:
8424.mof

mozcrt19.dll

sqlite3.dll

WP345d.exe

WPCD.ico

vd952342.bd

wpcd.cfg

Windows PC Defender.lnk

cookies.sqlite

Instructions.ini

cid.dll

CLSV.tmp

ddv.dll

eb.exe

eb.sys

energy.sys

exec.tmp

fix.exe

FS.drv

kernel32.drv

PE.drv

PE.tmp

ppal.exe

runddlkey.drv

tempdoc.dll

search.xml

Delete directories:
C:Documents and SettingsAll UsersApplication Data3ad5ffe

c:Documents and SettingsAll UsersApplication Data345d567

c:Documents and SettingsAll UsersApplication Data345d567WPCDSys

c:Documents and SettingsAll UsersApplication DataWPCDSys

%UserProfile%Application DataWindows PC Defender

About the author

Ugnius Kiguolis
Ugnius Kiguolis - The mastermind

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

More information about the author


  • Guest

    All you really need to do to delete it is to restore your computer to an earlier date (a time before you downloaded it accidently). It'll restart your computer, then voila, Windows PC Defender gone. (:

  • Guest

    How do i get rid of this if i cannot get online. This junk has messed up my security settings and won't let me get on line due to a firewall. Even if i turn the firewall off i still can't connect.

  • Guest

    THANK YOU SOOOO MUCH! Really, the restart operation worked and now I could finally open my programs to check everything and if all things were operational! Now I could remove the damn rogue!

  • Girish

    Very Well Explained…. For the new users it is very useful

  • Eliud

    Señores gracias por el trabajo que ustedes hacen de verdad que es muy importante su labor gracias por caolaborar , en hacer mas segura la navegacion por el cyber expacio