print version

Win PC Antivirus

Win PC Antivirus

When you see pop-ups and warning messages, it is important to scrutinize them.  Where are they coming from?  Who is sending them?  Are you getting an influx all of a sudden?  Taking a moment to think about these questions before clicking on any part of the ad will save you much aggravation, and it may even save you some money.

What is Win PC Antivirus?

Win PC Antivirus is a rogue antivirus program, very similar to the host of others that seek to persuade people to purchase their software.  To do this effectively, Win PC Antivirus must first convince computer users that there is a problem.  This is where the pop-ups and false warning messages come into play.  You may notice flashing icons, new desktop shortcuts, or scan result windows.  These warn you that malware files have been detected and that your computer is not adequately protected.  But remember, Win PC Antivirus's "free version" is an ad.  There is no scan taking place, nor is there any malware in your system.  The whole purpose behind this is to validate the claims of this rogue program.  However, if users should purchase the full version, they see no change.  The warning messages and pop-ups do not disappear.  You are left in the same position as before.   

This program is known as WinPCAntivirus or Win PCAntivirus, and is a clone of WinPC Defender, WinPCDefender, and Win PCDefender.

How Win PC Antivirus Enters Your System

The "full version" of Win PC Antivirus is installed by the computer user.  After seeing ads or banners and feeling the need to bolster security, many people opt to do this.  Protecting your computer and personal and financial information is of the utmost concern to every computer owner.  Win PC Antivirus knows this, and uses it to its own advantage.  The ads are convincing, and there really does seem to be a problem in your computer.  It is natural that people want to resolve it as quickly as possible, and Win PC Antivirus is right there waiting.  Unfortunately, this is a rogue program that cannot scan, protect, or remove threats. 

If you have the "trial version" of Win PC Antivirus, you may be wondering how it entered your computer at all.  It is done through trojans.  Like the Greeks hid in the Trojan Horse, malware hides in trojans and enters your computer.  Where do you pick up the trojans though?  Trojans reside in a variety of places, including:  spam emails, freeware, shareware, file sharing programs, websites with adult, gaming, or pirated content, and some social networking applications.  Here is an example of how a trojan may enter your computer:  you see an email in your box from an unfamiliar sender.  Thinking it could be a new friend or contact, you open it.  Realizing that it is spam, you quickly close it.  In this way a trojan like Vundo can enter your system. It is not even necessary to open the attachment; simply clicking opening the email may be enough.  Once inside, Vundo or the other trojans can install malware, including Win PC Antivirus. 

Is Win PC Antivirus In My System?

If you installed the full version of Win PC Antivirus, you are very aware that it is in your system, but if it got in through a trojan, you need to know the signs so you can take steps to remove it immediately.  The following are indicators that this program has been downloaded:

Slow Computer Functioning.  When Win PC Antivirus first enters your computer, it appears to be dormant.  In fact, you will not notice anything amiss for some time.  During this period, though, it is modifying your settings.  It will configure itself to run automatically whenever you turn on your computer and to run continually in the background.  As a result, you may notice a slowdown in performance.  Starting your computer, opening programs, loading web pages, switching windows all take longer.  This is because Win PC Antivirus uses so much of your system resources for itself.  Slow function can be due to a number of factors, so it is important to look at it in the larger context of what is happening with your computer.

Pop-ups.  These are very noticeable, and if you look closely, you can determine the cause.  Unlike slow performance, these pop-ups tell you where they are coming from.  The false scan results look very similar to those of legitimate programs.  Written at the top is "Win PC Antivirus:  designed to protect."  In the corner is a shield that employs the same design and colors as reputable programs.  Glancing quickly, these can look like they come from your program.  A list of supposed malware files in presented, along with the message:

Warning: Your PC may be at risk. Activate the software to protect it.  Get full time protection now.

This implies that you have no protection, which is most likely false.  No matter which option you click on, even to close it, you will be directed to a Win PC Antivirus site and urged to buy the full version.  Another pop-up advises:

Update available. WinPC Antivirus has detected that new threat database is available. Would you like to download and install update now? Installation is recommended

Another pop-up appears as a firewall warning:

FIREWALL  WARNING

Hidden file transfer to remote host was detected

WinPC Anrivirus has detected that somebody is trying to transfer your private data via Internet. We strongly recommend you to block the attack immediately.

Details of the attack

Remote host transfer IP: 97.216.34.74

Remote user computer name: FORENSICS

User E-mail:

IP-adress:

Blocking is recommended

Block Attack                            Allow

Notice your two options: block attack or allow.  No one wants to allow an attack.  It is language like this that makes these ads so convincing.

Removing Win PC Antivirus

If you notice signs of Win PC Antivirus in your system, it is important to remove it as soon as you can.  If left, this rogue program can cause greater instability and signal to other trojans to enter.  Using your delete option or running your current virus scan program may remove surface traces of Win PC Antivirus, but for maximum safety and performance, the entire program needs to be removed.  To do this, there are two options:

Automatic Removal.  When done with a reputable and effective program like ParetoLogic's XoftSpySE , automatic removal is the best option.  It is perfect for anyone with Win PC Antivirus in their system, particularly those without the technical experience, time, or patience needed to manually remove it.  Installing and running this software is easy, and it will allow you to resume your normal activities with the reassurance that your system is clean and safe. 

Manual Removal.  This can also be very effective but should only be attempted by trained experts or those with a lot of technical expertise.  Removing Win PC Antivirus completely requires that you delete each file, process, registry entry, and DLL library associated with the program.  After a short time, these can all start to look the same. It is possible to overlook files or accidentally delete ones you actually need.  If you have experience in your system registry, do the following with caution:

Block WinPC Antivirus Sites:

winpc-antivirus.com
winpc-antivirus2009.com
win-pc-antivirus2009.com
winpc-antivirus09.com
winpcantivirus2010.com

Remove WinPC Antivirus Processes:

Ta1HnnaIasEcfgF.exe
pcantivirus.exe
winav.exe

Delete Registry Entries:

HKEY_CURRENT_USERSoftwareWinPC Antivirus
HKEY_CLASSES_ROOTCLSID{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}
HKEY_CLASSES_ROOTIEocxApp.IEocx
HKEY_CLASSES_ROOTIEocxApp.IEocx.1
HKEY_CLASSES_ROOTInterface{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}
HKEY_CLASSES_ROOTInterface{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}
HKEY_CLASSES_ROOTTypeLib{A54DC52D-7AAD-4D40-A126-337211631EDC}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}
HKEY_CURRENT_USERControl Paneldon't load "scui.cpl"
HKEY_CURRENT_USERControl Paneldon't load "wscui.cpl"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "sysav"
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun "Content"

Remove DLL Library:

ieocx.dll

Delete Other Win PC Antivirus Files:

%UserProfile%Application Datapcantivirus.exe
%UserProfile%DesktopWinPC Antivirus.LNK
%UserProfile%Start MenuWinPC Antivirus.LNK
C:Documents and SettingsAll UsersTa1HnnaIasEcfgF.exe
c:WINDOWSieocx.dll
winav.exe

 to top