We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Win32/FakeCog
Aliases: CoreGuard Antivirus 2009 (other) Dr.Guard (other) Digital Protection (other) Your Protection (other) Protection Center (other) Defense Center (other) Anvi Antivirus (other) Data Protection (other) AntiMalware (other) Malware Defense (other) Paladin Antivirus (other) User Protection (other) Protection Center (other) AntiVirus (other)
Summary
Windows Defender detects and removes this threat.
This family of rogue security programs pretend to scan your PC for malware, and often report lots of infections. The program will say you have to pay for it before it can fully clean your PC.
However, the program hasn't really detected any malware at all and isn't really an antivirus or antimalware scanner. It just looks like one so you'll send money to the people who made the program. Some of these programs use product names or logos that unlawfully impersonate Microsoft products.
Even if you do pay to "unlock" the app, it won't do anything because your PC isn't actually infected with all that malware it "found".
Different brands of the rogues may modify various settings on your computer, end or close programs or system services, or block access to websites.
The following free Microsoft software detects and removes this threat:
- Microsoft Defender Antivirus for Windows 10 and Windows 8.1, or Microsoft Security Essentials for Windows 7 and Windows Vista
- Microsoft Safety Scanner
- Microsoft Windows Malicious Software Removal Tool
Even if we've already detected and removed this particular threat, running a full scan might find other malware that is hiding on your PC.
Get more help
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
If you’re using Windows XP, see our Windows XP end of support page.
