Saturday 16 January 2010

Remove DefendAPc virus (Uninstall instructions)

DefendAPc is a fake anti-spyware application that is promoted through the use of fake online scanners and misleading websites. One way or another, this malicious software has to be manually installed. The rogue program can be also installed from its home page defendapc.com (don't visit this website; otherwise you will infect your PC with Trojan.FakeAlert.AB virus). Once installed, DefendAPc displays fake security alerts and tries to scare you into thinking that your computer is infected. It even imitates a system scan and reports false scan results. As you know, this program is a scareware, so the scan results are obviously fabricated.



Moreover, DefendAPc hijacks Internet Explorer and displays fake notifications about "Insecure Interner Activity. Threat of virus attack". This virus also hijacks search engine results (usually Google, but may hijack other web search engines too). DefendAPc redirects users to various bogus websites that either promote other fake software or display false information. What is more, this malware constantly displays fake security alerts. One of those alerts states:

"Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of BlockProtector and remove spyware threats from your PC."


Ok, now let's talk about the most important part: how to remove DefendAPc? This can be done either manually or with an anti-spyware application. Please note that manual removal can be a bit complicated as the rogue program creates randomly named files and there is also a chance that it installs additional malware once active. In order to remove this malware completely you should use one of the following programs:

Manual removal guide:

DefendAPc directories:
  • C:\Program Files\DefendAPc Software\ (delete all files in this folder)
Defend APc files:
  • DefendAPc.exe
  • uninstall.exe
  • %Temp%\[random].exe 
  • C:\WINDOWS\system32\[random].exe 
DefendAPc registry values:
  • HKEY_CURRENT_USER\Software\DefendAPc
  • HKEY_LOCAL_MACHINE\SOFTWARE\DefendAPc
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefendAPc
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "DefendAPc" 
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random].exe" 
NOTE: if you can't remove the above files or use an anti-spyware application in "Normal Mode" then do that ir "Safe Mode with Networking". Good luck!

Last update: 01/16/2010

No comments:

Post a Comment