DIY Remove PC Defender Plus / Rogue Antivirus

What is PC Defender Plus?

PC Defender Plus is one of the more deceptive malware programs floating around; it looks like a legitimate program at first glance and can easily be mistaken for a non-threatening download. PC Defender Plus delivers pop-up message incessantly when a user attempts to access the Internet. If you get a pop up message from PC Defender Plus alerting you to supposed threats currently attacking your machine – don’t click anything. While this malware presents itself as a virus removal program, it is in fact a virus itself. If you have already clicked on a PC Defender Plus window and supplied payment information, you should dispute the charges to get a refund.

How to I remove PC Defender Plus

This particular virus may block you from opening Internet programs, which makes it difficult to remove. It can also impede a legitimate virus scan program from successfully opening and running a scan on your computer. As a result, PC Defender Plus should be removed while your computer is in safe mode. When in this mode, the virus is disabled enough that you can gain access to the Internet or your virus scanner and begin the removal process. Follow the tips below to get rid of PC Defender Plus on your computer.

 

Option 1: Run a Virus Scan from Safe Mode

 

 

    1. Save any work you currently have in progress on your computer. Remove any discs you currently have inserted into your computer then initiate a restart.

picture1

    1. When your computer begins to reboot, hit the F8 button on your computer. This button is typically along the top of your keyboard. An advanced boot menu will appear on your screen.
    2. Choose “Safe Mode with Networking” from the menu. You can navigate to this option using the arrow keys on your keyboard, and then press “Enter” to select it.

picture1

Download AVG here [wpdm_file id=4]

OR

    1. Once your Windows desktop has opened up, go to the Windows start menu and type the word Run into the search box and hit “Enter.” The run dialogue box will open as a small pop up box.
    2. Enter http://free.avg.com/ in the Run box and hit the “Enter” key to get to the AVG Free download. AVG Free is a legitimate antivirus program that can locate and remove the PC Defender Plus virus.

picture6

    1. Click the “Download” button and follow the prompts to download AVG Free.

picture4

    1. Click “Scan options” and then “Whole computer scan” to run a complete computer scan. This lets the program check your entire computer for viruses, not just one isolated drive. When prompted, request that AVG Free quarantine and remove PC Defender Plus and any other threats that are found.

picture5

  1. Reboot your computer and attempt to use the Internet. This will prompt another PC Defender Plus alert within a few minutes if the virus has not been successfully removed. If you still see the virus on your computer, proceed to manually removing the virus without the aid of a virus scanner.

Option 2: Manually Delete the Virus

Before you attempt to manually remove the PC Defender Plus program and its associated files from your computer, be advised that this process can cause permanent damage to your hard drive if you don’t know what you’re doing. This process should only be undertaken if you are familiar with your computer registry and can avoid the pitfalls of removing essential files or registry entries by mistake. Also create a backup of your registry.

    1. Restart your computer and hit “F8” to bring up the advanced boot menu. Choose “Safe Mode with Networking” from the menu and hit “Enter” to complete the boot.
    2. Hit “Control,” “Alt” and “Delete” at the same time to bring up the Task Manager. If you have a newer version of Windows, you will be prompted to select the Task Manager from a menu. Go to the Processes tab on the Task Manager.

picture6

    1. Uncheck the box next to “Use a proxy server for your LAN” and click OK twice to get out of the Internet Options window. You should now be able to use your online connection to run a virus scan on your device and locate the virus for removal.
    2. End the following processes if they are currently running on your computer:%AppData%\NPSWF32.dll
      %AppData%\Protector
      %AppData%\result.dbAlso stop anything that is labeled as PC Defender Plus.
    3. Go to the Windows start menu and type Run into the search box. Type regedit into the Run box and hit “Enter” to bring up the Registry Editor.
    4. Click on the “File” tab in the toolbar and choose “Export” from the menu. This will create a backup of your registry in its current state, just in case you need it later because you accidentally remove something that you shouldn’t. Choose a location to save the registry backup, create a name for it, and click “Save.”

picture7

 

picture8

  1. Go back to the Registry Editor and remove registry entries that reference PC Defender Plus. The virus may also have registry entries that are not explicitly labeled as belonging to PC Defender Plus, including the following:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Win 8 2013 Antivirus” HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Windows PC Defender” HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} HKEY_CLASSES_ROOT\WP345d.DocHostUIHandler HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes “URL” => http://search-gala.com/?&uid=201&q={searchTerms} HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer “PRS” = http://127.0.0.1:27777/?inj=%ORIGINAL%
  2. Exit the Registry Editor and reboot your computer in regular mode.

only at http://HacksRepair.com