WinPC Defender

April 26th, 2009 @ 12:55 am by Mrs. Bee

We received emails from a few users that their computers were infected with WinPC Defender, a fake anti-spyware application. WinPC Defender claims to be an anti-spyware program, but it actually isn’t. It displays pop-up ads encouraging you to buy the “licensed” version of WinPC Defender software to “remove” it, which itself is a fraud.

We’ve done a security audit of our site and our advertisers, and there’s no trace of WinPC Defender. We’re investigating what could’ve caused this - but in the meantime, I did a ton of research on the program, and thought I’d share what we’ve found.

This isn’t a subtle program: if you’ve been infected, it will probably be obvious. Infected users will see regular ads for a licensed version of WinPC Defender. If you think your computer may be infected with WinPC Defender, a number of sites (like here) recommend you install Malwarebytes Anti-Malware software to remove it.

I found an Editor’s review by CNET that gave them a great review: “Malwarebytes Anti-Malware is a surprisingly effective freeware antimalware tool. It’s a relatively speedy malware remover, with the quick scan taking about 8 minutes even with other high-resource programs running.”

Malwarebytes Anti-Malware is a free program: if you’ve been infected, you can install the program using the link here (there are great reviews by users as well as a video by the CNET editors). I also installed the program myself, just to test it out - it took about 8 minutes to run a scan, just like CNET said. Here’s the link to download the program:

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

In terms of protecting yourself in general:

If you use a secure browser, you are generally much safer while browsing the Internet. Google Chrome is probably the most secure, followed by Firefox. I would not recommend that you use Internet Explorer; if you absolutely have to, make sure it’s a recent version of IE (IE 7 or 8, not IE 6 or earlier).
This is a PC based program, so Mac users should be safe.

An up-to-date version of good anti-virus/anti-spyware program should also help protect you in general. I use AvG Free for anti-virus, but I’ve heard McAfee is also good.

Tags: announcements |

| Share this post: WinPC Defender

Latest Gallery Pics

Grandma's Rosary Wrapped Around My Bouquet

49 Responses to “WinPC Defender”

Bee

Mrs. Champagne (message) 1,068 posts, Bumble bee

i think my computer at work is being cleaned out because of this:(

4/26/09 @ 1:52 am (reply)

Member

Ms. Sapphire (message) 231 posts, Helper bee

My laptop went crazy and stopped working properly one day to the point where I had to buy a new laptop. Well, I stumbled across malwarebytes anti-malware and decided to try it out on my old laptop and boom~ it was as good as new again. So now have 2 laptops. haha. But seriously, it’s the best program out there. I HIGHLY recommend it.

4/26/09 @ 2:01 am (reply)

Member

mash8 (message) 9 posts, Newbee

This happened to me Thursday when I came to the site on my work computer. Luckily we have an IT team for problems like this and it was fixed immediately. It hasn’t done anything to my personal computer and that’s probably because I have alot of security installed on it. Thanks for actively working on this.

4/26/09 @ 3:38 am (reply)

Guest

eileen

Um yeah, this happened to my sister @ work-She’s a 911 dispatcher! They had to replace the hard drive on her computer! (She was voting for my Polyvore board!)

4/26/09 @ 6:47 am (reply)

Guest

Jennifer

This happened to me as well (twice!) while visiting Weddingbee. I am so glad that you addressed it. Malwarebytes is amazing and took WinPC Defender off my computer both times. I absolutely agree with your browser suggestions. I used Internet Explorer and believe that this was part of the issue — I am now switching to Firefox!

4/26/09 @ 7:40 am (reply)

Guest

Lovesthebear

This happened to me TWICE at work. The IT department used Malwarebytes to remove it both times. Thanks for looking into this!

4/26/09 @ 8:29 am (reply)

Hostess

august15bride (message) 1,378 posts, Bumble bee

This is exactly what happened to me! Thanks for looking into it.

4/26/09 @ 8:37 am (reply)

Guest

Leslie

I just got my computer back from this virus. We had to completely wipe it though

4/26/09 @ 8:54 am (reply)

Guest

Livvy

This happened to me too a couple of weeks ago after visting Weddingbee– my home computer became completely unusable and infected. Eep.

4/26/09 @ 9:16 am (reply)

10.

Member

Golden139 (message) 340 posts, Helper bee

This is exactly what has happened to me with my work laptop Thank you for addressing the cause of why some of our computers are now infected…

4/26/09 @ 9:21 am (reply)

11.

Guest

ColorCoated

Hey Hive - I’ve had this happen to my computer a little while ago and it can be tricky to get ride of - but it’s totally possible. My fiance and i are both computer people so that helped a bit.

I also have McAfee on my computer, but this is one of the very few things that can slip past it.

The virus that this is is “Vundo” and can take a few forms so you have to fight it more than one way. What makes it tricky is that once you have it, it will start starting up with your computer so you have to nip it before.

Here’s how to clean things up!.
Malware Bytes Anti Malware is really good, like Mr.Bee said, but you need to do a little more than that. Do a full scan with AntiMalware and remove the problems it shows. Chances are you’ll have to restart your computer, do that.

Also download Lavasoft Ad-Aware (http://download.cnet.com/Ad-Aware-Anniversary-Edition/3000-8022_4-10045910.html?part=dl-ad-aware&subj=dl&tag=top5) and Spybot Search and destroy (http://www.safer-networking.org/en/download/index.html - scroll down and see the download link). Both of these are very good programs, that cover a wider range of things than AntiMalware so the make sure you’re double covered.

After you’ve downloaded and installed Spybot and AdAware, restart your computer in safe mode. To do this, you’ll usually have to hit F8 or F12 while restarting. You’ll computer will look like its running in DOS, but use there arrow keys to highlight “safe mode” and hit enter. Your computer will restart, but have limited abilities and no internet access. Run Spybot and then AdAware (one after the other, not at the same time). These should clean up anything left over. One of these may say that it needs to finish the clean up after the restart of your computer, this may take a little time but it will work.

Good luck!

4/26/09 @ 9:34 am (reply)

12.

Guest

Michelle

So happy to know where I got this from! Thank you for solving the mystery and posting how to clean it.

4/26/09 @ 9:41 am (reply)

13.

Bee

Miss Quiche (message) 2,186 posts, Buzzing bee

This happened to my laptop as well. Darn PC. Our iMac has been perfectly fine.

Thanks for the link! We manually cleaned everything out… but it doesn’t hurt to run this program again.

4/26/09 @ 9:46 am (reply)

14.

Hostess

tessabella76 (message) 2,698 posts, Sugar bee

Happened to my laptop too. My FI used the Malewarebytes to clean it last weekend. Thanks!

4/26/09 @ 10:23 am (reply)

15.

Guest

miko

this happened to my work computer this past thursday after clicking on a link on weddingbee. IT had to replace my harddrive. all work and files are fine, but i lost 3 years of personal fiancial history that i had saved up on quicken =( scared me off of weddingbee for a couple days!

4/26/09 @ 11:11 am (reply)

16.

Guest

theredpen

This also happened to me a while back. FYI, though, I had to rename the file to run Malwarebytes because the virus recognized it and blocked it.

4/26/09 @ 11:24 am (reply)

17.

Member

Miss Chocolate Chip (message) 195 posts, Blushing bee

Yup - Got it from here too I hope I didn’t lose all my wedding stuff!! Oh NO!

4/26/09 @ 11:34 am (reply)

18.

Guest

Had to call IT about this on a work computer– I’ve stopped visiting all wedding blogs at work because I wasn’t sure which one gave it to me.

4/26/09 @ 11:35 am (reply)

19.

Hostess

KateMW (message) 2,714 posts, Sugar bee

I am sooo glad that we have two Macs. I’m safe!!

4/26/09 @ 11:36 am (reply)

20.

Member

soontobemrsc (message) 74 posts, Worker bee

This happened to me twice at work too, only when I visited this site. Luckily we have an awesome anti-virus/anti-spyware program on every computer and it was stopped quarantined and deleted before it could instal itself. Unfortunately I won’t be looking at weddingbee from my work computer anymore because I just can’t risk it.

4/26/09 @ 11:56 am (reply)

21.

Member

prettylittlemess (message) 6 posts, Newbee

My work computer was infected last Wednesday. Let me just say, I’ve never been so embarrassed! It was when I clicked over from Google Reader to read the comments of a post on the main site.

Just a note, my IT person said that this particular virus (WinPC) cannot be completely controlled with Malwarebytes Anti-Malware. He explained that it is an aggressive virus. Basically, my work computer needs to be overhauled.

Malwarebytes Anti-Malware is a great program that all PCs should install regardless.

4/26/09 @ 12:35 pm (reply)

22.

Hostess

Lillindy (message) 4,275 posts, Honey bee

Never heard of Google Chrome, but now I’m intrigued and off to check it out!

4/26/09 @ 12:35 pm (reply)

23.

Member

Sparkles (message) 706 posts, Busy bee

God bless my lil MacBook! No Problems here!

4/26/09 @ 1:12 pm (reply)

24.

Bee

Miss Labrador (message) 1,325 posts, Bumble bee

I’m with you Sparkles! I’ve had two laptops before and constantly had virus problems. But none to be found with my MacBook Pro! *knocks on wood*

4/26/09 @ 2:41 pm (reply)

25.

Member

lolamd (message) 39 posts, Newbee

This happened to my pc twice when visiting this site…

4/26/09 @ 3:50 pm (reply)

26.

Guest

Becky

My desktop did the same. I had opened a few sites so wasnt sure which one did it for me. Thanks for reviewing this though and trying to figure out how to fix it! I thought my current antivirus wasnt working so I went and bought something new (needed something to keep the future step son from surfing places he shouldnt the internet anyways)…

4/26/09 @ 4:04 pm (reply)

27.

Member

ali-o (message) 72 posts, Worker bee

My (fiance’s work) laptop that I borrowed for the evening got it too… Yikes.

4/26/09 @ 6:06 pm (reply)

28.

Member

sunflwra (message) 153 posts, Blushing bee

Same here– I have the Malware and I couldn’t even get it to run after this thing took hold. They had to totally reimage my hard drive- no fun. I’ve been told this thing can be very hidden- so even when you think you’ve gotten rid of it- it’s still hiding. My IT group said it was easier to reimage my hard drive than search further (after 2 hours). Not fun. I was hoping it didn’t come from this site- but this is the site I went to and then everything immediately popped up. UGhh!!

4/26/09 @ 10:38 pm (reply)

29.

Member

USFcupcake12 (message) 32 posts, Newbee

It got me too…I didn’t even think it came from here. Trying to take care of it now…please keep us updated!

4/26/09 @ 10:52 pm (reply)

30.

Guest

KTRollin

I got it too last week when I clicked on a link to a video on Weddingbee. All of a sudden it started downloading something all by itself and now I constantly have windows popping up, saying I have 24 possible viruses. I tried to do some research on how to get rid of WinPC, but I wasn’t sure what to believe, so I appreciate you letting us know what is legit to fix the problem. I’ll give it a try tonight.

4/27/09 @ 9:51 am (reply)

31.

Member

mrskellytobe (message) 9 posts, Newbee

Eek! This happened to my fiance’s laptop and it has not worked ever since. How did all of you reimage your hardrive? Did any of you have trouble getting on the internet with your infected computer? We can’t get on the internet to download an antispyware program. Any help that any of you can give me would be great because I feel terrible that this happened to his computer even though he is being sweet about it

4/27/09 @ 10:09 am (reply)

32.

Bee

Mr. Bee (message) 1,573 posts, Bumble bee

@mrskellytobe: This video has instructions on how to temporarily disable WinPC until you have a chance to run Malwarebytes:
http://www.youtube.com/watch?v=PRyLwgpxpcU

Here are the written instructions:

1. Press CTRL + ALT + DELETE, a window should pop up.
2. Click “Task Manager”
3. On Task Manager, find a tab named “Processes”
4. Find a process named “WnPC Defender.exe” or something like that.
5. Click End Process.

If you have a flash drive, you could maybe try downloading the program to the flash drive on another pc… and then copying it over to your laptop to install?

4/27/09 @ 10:31 am (reply)

33.

Member

LoriLori (message) 237 posts, Helper bee

I wondered how I got this on my work laptop AND after I had to leave my laptop with my IT people I got it on my home desktop. My tech recommended malwarebites as well for my home computer after he fixed my laptop. I used Firefox in the meantime, for me it wad only associated with Internet Explorer.

4/27/09 @ 10:50 am (reply)

34.

Member

yogigal (message) 394 posts, Helper bee

Ok. Now I know why my Laptop went crazy. Thank you for this post.

4/27/09 @ 11:15 am (reply)

35.

Guest

kara

Also got infected… also ran Malwarebytes, so far so good. Are there any steps in place now that will prevent this from happening again? I don’t want to give up Weddingbee!

4/27/09 @ 11:21 am (reply)

36.

Bee

Mr. Bee (message) 1,573 posts, Bumble bee

@kara: If you use the Mozilla Firefox or Google Chrome browsers, you should be much safer when browsing the internet in general!

Older versions of Internet Explorer are unfortunately vulnerable to all sorts of malware and viruses…

4/27/09 @ 11:40 am (reply)

37.

Bee

Mrs. Emerald (message) 901 posts, Busy bee

ohmygosh, I’m so glad I switched over to google chrome recently!

4/27/09 @ 12:21 pm (reply)

38.

Bee

Miss French Bulldog (message) 6,077 posts, Bee Keeper

@Lillindy: I use Google Chrome and LOVE it!

4/27/09 @ 12:26 pm (reply)

39.

Member

kayakgirl73 (message) 361 posts, Helper bee

I had this problem last week at work also. Luckily I don’t think it’s gotten my laptop at home. It spent hours on my work computer and had to re-image it. They’ve seen this virus before.

4/27/09 @ 1:33 pm (reply)

40.

Member

Soon2BeeMrsLewis (message) 507 posts, Busy bee

yup, my work got it too.

4/27/09 @ 5:19 pm (reply)

41.

Guest

Andrea

It completely destroyed my work computer. I couldn’t access the internet or anything. So downloading malwarebytes to fix the problem wouldn’t even work. My IT dept wasn’t happy with me when they had to spend a few hours fixing my computer. And today is the first day I have visited weddingbee since this happened.

The virus also destroyed my brand new home computer because I was stupid and went on weddingbee at home after it already infected my work computer. Luckily, my home computer was brand new and still within the 14 day return period. So I just returned it for a new one. But it sure was annoying. The computer that I got to replace the first one wasn’t working right either - it kept making a loud clicking noise. So I had to return that one over this past weekend.

One broken work computer, and 3 laptop exchanges! All because of this virus on your site!

4/27/09 @ 8:54 pm (reply)

42.

Member

MissDogger (message) 12 posts, Newbee

Yep…I got it too and I am reformatting my computer right now. It’s been a great big pain to figure out and as much as I tried to clean it off…nothing worked. aaargh.

4/27/09 @ 9:26 pm (reply)

43.

Guest

Scrapodoodle

Oh this has not been good for me!!! My work computer has been down for 3 days, today the IT guys had to take it away. Very frustrating, not sure if I will continue on this site : ( My IT group says its a very bad. Wedding Bee how did this get by you? How are you going to prevent your site from doing this again?

4/28/09 @ 2:18 am (reply)

44.

Member

Kara321 (message) 240 posts, Helper bee

I got this (well, actually WinPC Antivirus, but I understand they’re the same) at work and on my home computer. I was using IE at work, and luckily our IT guy was able to fix it, but it took about 24 hours to fix the problem totally (with scan time and all that).

At home, I was using Google Chrome, so beware–you still have to be careful! I was able to manually remove (most of–I think) it with some tips from our IT guy.

My internet at home is totally out now, though… has anyone else experienced this problem? I know it’s not a problem with my wireless because my FI’s Mac has no trouble hooking up to our wireless, and I can’t even get connected to the internet when I use a cable! I would sincerely appreciate any tips!

4/28/09 @ 2:01 pm (reply)

45.

Guest

Scrapodoodle

This is my second post on this subject….

Finally after 2 days of the IT guys working on it…they basically had to dump by whole hard drive and start new : ( They are running the final scans tonight and we’re hoping they can recover all my files. It’s been really frustrating, I think if it wasn’t my work computer, there is no way I would have been able to fix it. It did kill all my communication with the internet. They suggested if it was my home computer, I’d be better off just buying a new one…….This virsus that went thru Wedding Bee was/is really bad. I can’t believe I’m on this site at home, but I wanted to read if anyone else was having these problems. PLEASE WEDDING BEE RESPOND WITH NEW INFO……….I feel like I’m taking my chances of being on here again………

4/28/09 @ 9:47 pm (reply)

46.

Guest

Scrapodoodle

Wedding Bee………..

I read your first post that stated no trace on Wedding Bee. It absolutely came from your site without a doubt. Now I’m not trying to put the blame that you were un-aware and did nothing about it, I’m sure as soon as you realized it came from your site, you acted on it……..

4/28/09 @ 9:53 pm (reply)

47.

Bee

Mr. Bee (message) 1,573 posts, Bumble bee

@Scrapodoodle: Sorry for the confusion: what Bee meant is that her engineers did a complete security audit of the Weddingbee site and advertisers, and there is no trace of WinPC Defender at this time.

I posted some instructions earlier on how to temporarily disable WinPC. This may help restore internet access, if it’s been disabled:
http://www.weddingbee.com/2009/04/26/winpc-defender/#comment-659493

Your browsing experience on Weddingbee (and on the internet at large) will be much safer if you’re using the latest version of Firefox. I can’t guarantee that Firefox will keep you completely safe across the entire web, but I can say that I’ve been using Firefox for several years and have never had any problems with virus/spyware/malware.

4/29/09 @ 1:40 am (reply)

48.

Guest

KTRollin

Has anyone tried downloading the Malwarebytes program to a flash drive and then installing it on your infected computer? I haven’t had internet on my laptop for a week, even with a ethernet cord plugged in! We had a comcast guy spend over an hour trying to fix the “internet problem”, but since my fiance’s laptop works perfectly fine, it’s definiately my computer. I followed the instructions to temporarily disable WinPC, but I still can’t get an internet connection. Please help… This is driving me crazy!

4/29/09 @ 12:49 pm (reply)

49.

Bee

Mr. Bee (message) 1,573 posts, Bumble bee

Someone asked how to remove WinPC Defender without the internet here:
http://answers.yahoo.com/question/index?qid=20090422142951AAyhr5o

And the Best Answer was to print the manual remove instructions from here:
http://www.spywarevoid.com/remove-winpc-defender-win-pc-defender-removal.html

I can’t vouch for spywarevoid.com personally since I haven’t used it myself, but the comments on the post sound pretty positive.

The other option would be to download Malwarebytes to a flash drive, and then install it on the infected computer. If that doesn’t work, maybe you could try the manual remove process above?

4/29/09 @ 4:18 pm (reply)