The Emsi Software malware research team has discoverd a new outbreak for the Windows PC Defender adware. a-squared Anti-Malware detect this malware as Adware.Win32.WindowsPCDefender.

Windows PC Defender is rogue security software that show false warning messages and show misleading scan results. The advertisement will state that you are infected and then prompt you to download Windows PC Defender to your computer. If you download and install Windows PC Defender, it will start automatically when your computer starts. The installer will also create numerous harmless files on your computer, usually at Recent folder, that are used to impersonate malware files. Once the program is running it will scan your computer and then display these files as infections, but will not allow you to remove them until you purchase the program.

The main program will extract several files to (the name of the files and directory for this rogue are random):

• %CommonAppData%\b0cf5\WPba6.exe
• %CommonAppData%\WPCDSys\wpcd.cfg
• %AppData%\Microsoft\Internet Explorer\Quick Launch\Windows PC Defender.lnk
• %AppData%\Windows PC Defender\Instructions.ini
• %UserProfile%\Cookies\index.dat
• %UserProfile%\Cookies\virus demo@support.zonedialog[1].txt
• %UserProfile%\Desktop\1587.mof
• %UserProfile%\Desktop\Windows PC Defender.lnk
• %UserProfile%\Desktop\WPCD.ico
• %UserProfile%\Desktop\BackUp\HyperSnap-DX.lnk
• %UserProfile%\Desktop\WPCDSys\vd952342.bd
• %UserProfile%\Recent\ANTIGEN.tmp
• %UserProfile%\Recent\cb.dll
• %UserProfile%\Recent\cid.exe
• %UserProfile%\Recent\cid.sys
• %UserProfile%\Recent\CLSV.drv
• %UserProfile%\Recent\exec.drv
• %UserProfile%\Recent\fix.sys
• %UserProfile%\Recent\grid.tmp
• %UserProfile%\Recent\kernel32.tmp
• %UserProfile%\Recent\PE.sys
• %UserProfile%\Recent\PE.tmp
• %UserProfile%\Recent\ppal.drv
• %UserProfile%\Recent\SM.tmp
• %UserProfile%\Recent\tjd.sys
• %UserProfile%\Recent\tjd.tmp
• %UserProfile%\Start Menu\Windows PC Defender.lnk
• %UserProfile%\Start Menu\Programs\Windows PC Defender.lnk

And create new registry entry:

• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Run\Windows PC Defender

This rogue also try to modify hosts file:

• 74.125.45.100 4-open-davinci.com
• 74.125.45.100 securitysoftwarepayments.com
• 74.125.45.100 privatesecuredpayments.com
• 74.125.45.100 secure.privatesecuredpayments.com
• 74.125.45.100 getantivirusplusnow.com
• 74.125.45.100 secure-plus-payments.com
• 74.125.45.100 www.getantivirusplusnow.com
• 74.125.45.100 www.secure-plus-payments.com
• 74.125.45.100 www.getavplusnow.com
• 74.125.45.100 www.securesoftwarebill.com
• 74.125.45.100 secure.paysecuresystem.com
• 74.125.45.100 paysoftbillsolution.com
• 206.53.61.77 google.ae
• 206.53.61.77 google.as
• 206.53.61.77 google.at
• 206.53.61.77 google.az
• 206.53.61.77 google.ba
• 206.53.61.77 google.be
• 206.53.61.77 google.bg
• 206.53.61.77 google.bs
• 206.53.61.77 google.ca
• 206.53.61.77 google.cd
• 206.53.61.77 google.com.gh
• 206.53.61.77 google.com.hk
• 206.53.61.77 google.com.jm
• 206.53.61.77 google.com.mx
• 206.53.61.77 google.com.my
• 206.53.61.77 google.com.na
• 206.53.61.77 google.com.nf
• 206.53.61.77 google.com.ng
• 206.53.61.77 google.ch
• 206.53.61.77 google.com.np
• 206.53.61.77 google.com.pr
• 206.53.61.77 google.com.qa
• 206.53.61.77 google.com.sg
• 206.53.61.77 google.com.tj
• 206.53.61.77 google.com.tw
• 206.53.61.77 google.dj
• 206.53.61.77 google.de
• 206.53.61.77 google.dk
• 206.53.61.77 google.dm
• 206.53.61.77 google.ee
• 206.53.61.77 google.fi
• 206.53.61.77 google.fm
• 206.53.61.77 google.fr
• 206.53.61.77 google.ge
• 206.53.61.77 google.gg
• 206.53.61.77 google.gm
• 206.53.61.77 google.gr
• 206.53.61.77 google.ht
• 206.53.61.77 google.ie
• 206.53.61.77 google.im
• 206.53.61.77 google.in
• 206.53.61.77 google.it
• 206.53.61.77 google.ki
• 206.53.61.77 google.la
• 206.53.61.77 google.li
• 206.53.61.77 google.lv
• 206.53.61.77 google.ma
• 206.53.61.77 google.ms
• 206.53.61.77 google.mu
• 206.53.61.77 google.mw
• 206.53.61.77 google.nl
• 206.53.61.77 google.no
• 206.53.61.77 google.nr
• 206.53.61.77 google.nu
• 206.53.61.77 google.pl
• 206.53.61.77 google.pn
• 206.53.61.77 google.pt
• 206.53.61.77 google.ro
• 206.53.61.77 google.ru
• 206.53.61.77 google.rw
• 206.53.61.77 google.sc
• 206.53.61.77 google.se
• 206.53.61.77 google.sh
• 206.53.61.77 google.si
• 206.53.61.77 google.sm
• 206.53.61.77 google.sn
• 206.53.61.77 google.st
• 206.53.61.77 google.tl
• 206.53.61.77 google.tm
• 206.53.61.77 google.tt
• 206.53.61.77 google.us
• 206.53.61.77 google.vu
• 206.53.61.77 google.ws
• 206.53.61.77 google.co.ck
• 206.53.61.77 google.co.id
• 206.53.61.77 google.co.il
• 206.53.61.77 google.co.in
• 206.53.61.77 google.co.jp
• 206.53.61.77 google.co.kr
• 206.53.61.77 google.co.ls
• 206.53.61.77 google.co.ma
• 206.53.61.77 google.co.nz
• 206.53.61.77 google.co.tz
• 206.53.61.77 google.co.ug
• 206.53.61.77 google.co.uk
• 206.53.61.77 google.co.za
• 206.53.61.77 google.co.zm
• 206.53.61.77 google.com
• 206.53.61.77 google.com.af
• 206.53.61.77 google.com.ag
• 206.53.61.77 google.com.ar
• 206.53.61.77 google.com.au
• 206.53.61.77 google.com.bn
• 206.53.61.77 google.com.br
• 206.53.61.77 google.com.by
• 206.53.61.77 google.com.bz
• 206.53.61.77 google.com.cu
• 206.53.61.77 google.com.ec
• 206.53.61.77 google.com.fj
• 206.53.61.77 www.google.ae
• 206.53.61.77 www.google.as
• 206.53.61.77 www.google.at
• 206.53.61.77 www.google.az
• 206.53.61.77 www.google.ba
• 206.53.61.77 www.google.be
• 206.53.61.77 www.google.bg
• 206.53.61.77 www.google.bs
• 206.53.61.77 www.google.ca
• 206.53.61.77 www.google.cd
• 206.53.61.77 www.google.com.gh
• 206.53.61.77 www.google.com.hk
• 206.53.61.77 www.google.com.jm
• 206.53.61.77 www.google.com.mx
• 206.53.61.77 www.google.com.my
• 206.53.61.77 www.google.com.na
• 206.53.61.77 www.google.com.nf
• 206.53.61.77 www.google.com.ng
• 206.53.61.77 www.google.ch
• 206.53.61.77 www.google.com.np
• 206.53.61.77 www.google.com.pr
• 206.53.61.77 www.google.com.qa
• 206.53.61.77 www.google.com.sg
• 206.53.61.77 www.google.com.tj
• 206.53.61.77 www.google.com.tw
• 206.53.61.77 www.google.dj
• 206.53.61.77 www.google.de
• 206.53.61.77 www.google.dk
• 206.53.61.77 www.google.dm
• 206.53.61.77 www.google.ee
• 206.53.61.77 www.google.fi
• 206.53.61.77 www.google.fm
• 206.53.61.77 www.google.fr
• 206.53.61.77 www.google.ge
• 206.53.61.77 www.google.gg
• 206.53.61.77 www.google.gm
• 206.53.61.77 www.google.gr
• 206.53.61.77 www.google.ht
• 206.53.61.77 www.google.ie
• 206.53.61.77 www.google.im
• 206.53.61.77 www.google.in
• 206.53.61.77 www.google.it
• 206.53.61.77 www.google.ki
• 206.53.61.77 www.google.la
• 206.53.61.77 www.google.li
• 206.53.61.77 www.google.lv
• 206.53.61.77 www.google.ma
• 206.53.61.77 www.google.ms
• 206.53.61.77 www.google.mu
• 206.53.61.77 www.google.mw
• 206.53.61.77 www.google.nl
• 206.53.61.77 www.google.no
• 206.53.61.77 www.google.nr
• 206.53.61.77 www.google.nu
• 206.53.61.77 www.google.pl
• 206.53.61.77 www.google.pn
• 206.53.61.77 www.google.pt
• 206.53.61.77 www.google.ro
• 206.53.61.77 www.google.ru
• 206.53.61.77 www.google.rw
• 206.53.61.77 www.google.sc
• 206.53.61.77 www.google.se
• 206.53.61.77 www.google.sh
• 206.53.61.77 www.google.si
• 206.53.61.77 www.google.sm
• 206.53.61.77 www.google.sn
• 206.53.61.77 www.google.st
• 206.53.61.77 www.google.tl
• 206.53.61.77 www.google.tm
• 206.53.61.77 www.google.tt
• 206.53.61.77 www.google.us
• 206.53.61.77 www.google.vu
• 206.53.61.77 www.google.ws
• 206.53.61.77 www.google.co.ck
• 206.53.61.77 www.google.co.id
• 206.53.61.77 www.google.co.il
• 206.53.61.77 www.google.co.in
• 206.53.61.77 www.google.co.jp
• 206.53.61.77 www.google.co.kr
• 206.53.61.77 www.google.co.ls
• 206.53.61.77 www.google.co.ma
• 206.53.61.77 www.google.co.nz
• 206.53.61.77 www.google.co.tz
• 206.53.61.77 www.google.co.ug
• 206.53.61.77 www.google.co.uk
• 206.53.61.77 www.google.co.za
• 206.53.61.77 www.google.co.zm
• 206.53.61.77 www.google.com
• 206.53.61.77 www.google.com.af
• 206.53.61.77 www.google.com.ag
• 206.53.61.77 www.google.com.ar
• 206.53.61.77 www.google.com.au
• 206.53.61.77 www.google.com.bn
• 206.53.61.77 www.google.com.br
• 206.53.61.77 www.google.com.by
• 206.53.61.77 www.google.com.bz
• 206.53.61.77 www.google.com.cu
• 206.53.61.77 www.google.com.ec
• 206.53.61.77 www.google.com.fj
• 206.53.61.77 google.com
• 206.53.61.77 www.google.com
• 206.53.61.77 bing.com
• 206.53.61.77 www.bing.com
• 206.53.61.77 search.yahoo.com
• 206.53.61.77 www.search.yahoo.com
• 206.53.61.77 search.live.com
• 206.53.61.77 search.msn.com

Malware screenshots:

How to remove the infection of Adware.Win32.WindowsPCDefender?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine

The Emsi Software malware research team has discoverd a new outbreak for the Adware.Win32.WindowsPolicePro.

WindowsPolicePro is a rogue security program that:

• Show False warning messages.
• Show Misleading scan results.
• Show fake Windows Security Center.
• Show fake error svchost.exe.
• And it’s Browser Helper Objects

The main installer of this malware seem like packed with EXECryptor, and it extract several files to:

• %ProgramFiles%\Windows Police Pro\msvcm80.dll
• %ProgramFiles%\Windows Police Pro\msvcp80.dll
• %ProgramFiles%\Windows Police Pro\msvcr80.dll
• %ProgramFiles%\Windows Police Pro\windows Police Pro.exe
• %ProgramFiles%\Windows Police Pro\tmp\dbsinit.exe
• %ProgramFiles%\Windows Police Pro\tmp\wispex.html
• %ProgramFiles%\Windows Police Pro\tmp\images\i1.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\i2.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\i3.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\j1.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\j2.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\j3.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\jj1.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\jj2.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\jj3.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\l1.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\l2.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\l3.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\pix.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\t1.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\t2.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\up1.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\up2.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\w1.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\w11.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\w2.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\w3.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\w3.jpg
• %ProgramFiles%\Windows Police Pro\tmp\images\wt1.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\wt2.gif
• %ProgramFiles%\Windows Police Pro\tmp\images\wt3.gif
• %SystemRoot%\ppp3.dat
• %SystemRoot%\ppp4.dat
• %SystemRoot%\svchasts.exe
• %SystemRoot%\system32\bennuar.old
• %SystemRoot%\system32\dddesot.dll
• %SystemRoot%\system32\desote.exe
• %SystemRoot%\system32\sysnet.dat
• %UserProfile%\Desktop\PC_protect.exe
• %UserProfile%\Desktop\Windows Police Pro.lnk
• %UserProfile%\Start Menu\Programs\Windows Police Pro\Windows Police Pro.lnk

And create new registry entries:

• HKEY_CURRENT_USER\software\Windows Police Pro
• HKEY_CURRENT_USER\software\Windows Police Pro\windows Police Pro
• HKEY_CURRENT_USER\software\Windows Police Pro\windows Police Pro\Registration
• HKEY_CURRENT_USER\software\Windows Police Pro\windows Police Pro\setdata
• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Uninstall\Win Police Pro
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AntipPro2009_100
• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76DC0B63-1533-4ba9-8BE8-D59EB676FA02}

This malware also try to connect to core2634.newdomainagain.com.

How to remove the infection of Adware.Win32.WindowsPolicePro?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine