Introduction

There is another tricky rogue anti-spyware which has great potential in destroying your PC system: Windows Defending Center. This fake anti-spyware is not related at all to Windows and all its products, especially its security program.

Like other rogue anti-spyware you can find on the internet, this fake anti-spyware infiltrate your computer by ‘persuading’ you to purchase its full version through creating false reports about infections and system errors in your computer. You should not follow their instructions to purchase the full license; alternatively you should remove the whole program from your computer. The followings are manual guide for you in removing the program manually.

 

Manual removal process

  1. Right click on the taskbar and left click the “Start Task Manager” option.
  2. After a new window opened, find this process:

[random symbols].exe

  1. Click on the above process and move your cursor to the lower right section of the window. Find the “End Process” button and click on it.
  2. A new window will be opened. Click on the “End Process” button to terminate the process.
  3. Close the “Task Manager” window.
  4. Left click on the “Start” menu and choose “Run” option.
  5. Type “regedit” at the empty space to open “Registry Editor” window.
  6. After the “Registry Editor” window opened, press Ctrl + F to find these files:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorAdmin” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “ConsentPromptBehaviorUser” = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “EnableLUA” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-3-22_1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “okanrqfdwk”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atro55en.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[4].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssmmc32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrscan.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utpost.exe

  1. For each registry file, right click on the file and select “Delete” for the file removal.
    1. Close the “Registry Editor” window after you removed all the registry files.

 

Unregister dll files

  1. Left click on the “Start” button and choose the “Run” option.
  2. Type “cmd” at the empty space to open the “Command Prompt” window.
  3. Type this when the window opened:

Regsvr32 /u NPSWF32.dll

 

Note: NPSWF32.dll is the dll file you should remove.

  1. Type “exit” at the window to close the “Command Prompt” window.

 

Delete files or directories

  1. Right click on the “Start” button and select “Open Windows Explorer” option.
  2. Go to the directory where you store all files and folders from Windows Defending Center. If you chose to store the data at default location when you installed the program, the location should be C:\Program Files\Windows Defending Center
  3. Find these files/folders and remove them:

%AppData%\NPSWF32.dll
%AppData%\Protector-[random symbols].exe
%AppData%\result.db
%CommonStartMenu%\Programs\Windows AntiHazard Center.lnk
%Desktop%\Windows AntiHazard Center.lnk

  1. Close the “Windows Explorer” window.
  2. Re-start your system.
HOW TO REMOVE WINDOWS DEFENDING CENTER?

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>