Microsoft security software detects and removes this threat. 

This threat claims to scan your PC for malware and then shows you fake warnings. They try to convince you to pay to register the software to remove the non-existent threats.

See the Win32/FakeCog description for more information.

Find out ways that malware can get on your PC.

What to do now

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find other, hidden malware.

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

See the Win32/FakeCog description for more information.


See the Win32/FakeCog description for more information.


Alert level: Severe
First detected by definition: 1.57.1182.0
Latest detected by definition: 1.209.1499.0 and higher
First detected on: May 12, 2009
This entry was first published on: Sep 15, 2010
This entry was updated on: Oct 28, 2015

This threat is also detected as:
  • Win32/Adware.CoreguardAntivirus (ESET)
  • not-a-virus:FraudTool.Win32.CoreGuard2009 (Kaspersky)
  • FakeAlert-FQ (McAfee)
  • W32/Renos.FIP (Norman)
  • Mal/TDSSPack-L (Sophos)
  • CoreGuardAntivirus2009 (Symantec)
  • Fraudtool.CoreGuard2009.A (VirusBuster)
  • CoreGuard Antivirus 2009 (other)
  • Dr.Guard (other)
  • Digital Protection (other)
  • Your Protection (other)
  • Protection Center (other)
  • Defense Center (other)
  • Trojan:Win32/FakeCog (Microsoft)
  • Anvi Antivirus (other)
  • Data Protection (other)