Your computer is infected with malicious software? Do you have pop-ups on your PC?
If so, search this blog for removal instructions or browse computer threats by category.

Friday, January 25, 2013

How to Remove Security Defender (Uninstall Guide)

Tell your friends:
Security Defender is a rogue anti-spyware program that uses deceptive tactics to drive up sales from confused or inexperienced computer users. This fake security product pretends to find malicious software on your computer. It also pretends to protect your PC against misleading pop-ups and security threats caused by spyware, adware, Trojans and other viruses. What is more, Security Defender impersonates Windows Defender which is a perfectly legitimate anti-spyware product from Microsoft. I have to admit that this time scam artists made a quite legitimate looking rogue application which may actually mislead many computer users into paying for the fake removal of malware. Security Defender may be downloaded silently by Trojan horses or installed when the fake alert is clicked. Hopefully, you can use real anti-malware applications to remove Security Defender malware from your computer. To remove this fake security program and any related malware for free, please follow the steps in the removal guide below.

New GUI of Security Defender malware:


Old GUI which is probably not used anymore.


Due to the fact that Security Defender was made to scare you into thinking your computer has many critical security problems it displays numerous fake firewall alerts and notifications from the Windows taskbar.
Security Defender Firewall Alert
Harmful software detected
Security Defender has detected malicious software that may cause crash of your computer.
Security Defender
Viruses have been found in your system.
We highly recommend you to get license for


Security Defender may also hijack Internet Explorer and block other programs on your computer. If you somehow ended up with this rogue program, please follow the removal instructions below to remove Security Defender and related malware. If you need help removing this little bugger from your computer, please leave a comment. Good luck and be safe online!

Guide update:
01/25/13 - Updated removal instructions, new activation key, GUI.


Quick removal guide:

1. Open Security Defender. Click the "Activate" button and select Manual Activation. Enter one of these debugged registration key to register this rogue application. Don't worry, this is completely legal.

xOxZxLxWxIxTxFxQxCxNxYxKxVxHxSxE (new code)

D13F-3B7D-B3C5-BD84 (old code, may still work with some variants)

Once this is done, you are free to install anti-malware software and remove the rogue anti-virus program from your computer properly.

2. Download recommended anti-malware software and run a full system scan to remove this virus from your computer.







Security Defender removal instructions (Safe Mode):

Download recommended recommended anti-malware software (direct download) to remove this virus from your computer.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

If you can't download it, please reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Open Internet Explorer and download Spyware Doctor. Once finished, run setup. That's It!


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.


Alternate Security Defender removal instructions:

1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it.

2. Search for such entry in the scan results:
O4 - HKCU\..\Run: [pcdfsvc] C:\ProgramData\pcdfdata\[random_characters].exe /min

Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.
    3. Download recommended recommended anti-malware software to remove this virus from your computer.





    NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.


    Associated Security Defender files and registry values:

    Files:
    • C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS]_.mkv
    • C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].avi
    • C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].ico
    • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\[SET OF RANDOM CHARACTERS].lnk
    • C:\Program Files\Security Defender
    • C:\Program Files\Security Defender\Security Defender.dll
    • %Temp%\[SET OF RANDOM CHARACTERS].dll
    %Temp% refers to:
    C:\Documents and Settings\[UserName]\Local Settings\Temp (in Windows 2000/XP)
    C:\Users\[UserName]\AppData\Local\Temp (in Windows Vista & Windows 7)

    Registry values:
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
    Share the knowledge:

    14 comments:

    Anonymous said...

    Thanks it works.

    Anonymous said...

    Thanks so much

    Anonymous said...

    Thanks. It mostly worked. When I came out of safe mode, the icon for Security Defender was still there, and started reinstalling again. I downloaded another spyware program, rescanned and found more viruses. Internet Explorer still would not work, and looks like the proxy server was also on on IE, so I had to turn that off too.

    Anonymous said...

    thank you so much. it worked!!!
    God Bless You!!!

    Anonymous said...

    Thank you. I was about to toss my pc out the door until I found STOPzilla

    Anonymous said...

    if you have windows 7 download the Microsoft security essentials program and do a full scan. this removes this virus easy...the program is free from Microsoft

    Anonymous said...

    security defender was a pain in the ass thanks for the instructions although it was long ... it finally worked

    Anonymous said...

    Microsoft security essentials worked for me.

    Anuj said...

    Microsoft security essentials worked for me.

    I was not able to run task manager or any browser. Downloaded the toll from another laptop and transferred the setup file here. I was not able to run the file by double click and the trojan stopped it too.The right-click and "run as administrator" worked for me. It is giving notification that cleaning took place and for some clean it is recommending to restart the system.

    I checked that I am able to run iexplorer to quickly posting the Thanks to my Anonymous friends.

    Anonymous said...

    Thanks it works.....

    Anonymous said...

    thanks a lot it worked....

    Anonymous said...

    Ah, thanks. That's brilliant; just go ahead and "activate" the product so I can continue with the malware cleanup.

    Anonymous said...

    I've tried everything for four days and can't get rid of it. I've tried all the suggestions everywhere I've found over the last four days. I've booted into safe mode to try run malwarebytes, combofix, and many others, but pc shuts down soon after it starts the scan. I was told to rename the executable of the file I'm running, i.e. mbam.exe, to something like iexplore.exe or winlogon.exe, but then it eventually shuts down the pc again. I have a geek squad disk, its legit, it ran for over 24 hours scanning, and found a bunch of other stuff, but did nothing to help this problem. I've tried LOTS other stuff as well, but nothing works, and I'm at wits end! Any suggestions would be greatly appreciated.

    Anonymous said...

    great! it worked