Total PC Defender

28 December 2009 Rogue 1 Comment

Total PC Defender is another fake anti-spyware and security tool that exhibits annoying false security warnings. It attempts to convince user that computer is under attack and a purchase of the registered version is necessary to protect the system. Aside from that, Total PC Defender virus will also run its own scanner and implausibly detect threats that are not present on system. This to tactic aims to deceive users. With the presence of this potentially unwanted program, infected PC may experience sudden reduce in system performance when pointless application keeps on processing in the background. Total PC Defender will modify system registry to add its own entry that ensures self-execution each time Windows starts.

Total PC Defender usually infects a user who visits malicious security web sites. When installed, this fake program will begin to announce certain infection, virus attack and malfunction on the machine. It literally posts an alert about “Warning! System under attack.”

Associated Trojan will disable legitimate antivirus programs and several Windows functionalities to prevent removal of Total PC Defender. Only way to eliminate this is to use a powerful and legit anti-malware product. Download update and scan your system completely to remove all the infections brought in by the bogus software.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)
Total PC Defender is a fraud security application. Dropping the malware on computers without user’s awareness is certainly achievable with the use of Trojan. Both rogue program and Trojan do not replicate. It will not infect neighboring computers as well. The only payload of these threats is to induce victims into purchasing the paid version of the product. Therefore, infection will occur as a profit-making online activity that undertakes misleading method.

Malware Behavior
Total PC Defender will repeatedly display fake alert messages as a scare tactics. Authors of this rogue security application present this misleading notification to delude users on the actual status of the computer. There are quite a few of fake warnings that will emerge from desktop and system tray, one of such may contain messages similar to this:

Warning! System under attack
Threat detected: Worm
File name: notepad.exe
Threat name: Generic Pup.z!7ec2eb2a

Added Registry Entries:

HKEY_LOCAL_MACHINE\Software\MicrosoftWindows\CurrentVersion\Run\Total PC Defender
HKEY_CURRENT_USER\SOFTWARE\MicrosoftWindows\Current Version\Policies\System\DisableTaskMgr
HKEY_LOCAL_MACHINESOFTWARE\MicrosoftWindows\Current Version\Policies\System\DisableTaskMgr

Associated Files and Folders:

C:\Program Files\Total PC Defender
%UserProfile%\Start Menu\Total PC Defender
%UserProfile%\Application Data\MicrosoftInternet Explorer\Quick Launch
%UserProfile%\Desktop\

1. Kill any running process that belongs to Total PC Defender.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for the following files and click End Task.
Total PC Defender.exe

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit. This will open registry editor.
- Find and delete the following:
HKEY_LOCAL_MACHINE\Software\MicrosoftWindows\CurrentVersion\Run\Total PC Defender
- Close registry editor. Changes made will be save automatically.

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please Update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by Total PC Defender.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Associated Files and Folders.'

Automatic Removal of Total PC Defender

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.