Your computer is infected with malicious software? Do you have popups on your PC?
If so, search this blog for removal instructions or find computer threats by category.

Tuesday, June 14, 2011

How to Remove "Security Protection" (Uninstall Guide)

Tell your friends:
Security Protection is a fake antivirus program that pretends to scan your computer for security problems. This malware, often called scareware, fabricates a list of security threats it has found on your machine. It also generates false or misleading security alerts to make you think that your computer is infected with malicious software. To remove the non-existent infections and protect your self from malware, you will be prompted to buy the "full-version" of Security Protection designed to protect. That's one of the most common ways for cybercriminals to steal money from people. It's very important to remember that by purchasing such rogue security software you are submitting your credit card details and personal information to cyber-crooks. As a result, you may become a victim of credit card scam or even identity theft. So, if you thought that Security Protection was a legitimate software and have already purchased it, please contact your credit card company and dispute the charges. To remove Security Protection from your computer, please follow the removal instructions below.



Security Protection is distributed though the use of fake online scanners; that's probably the most popular malware distribution mechanism. For example, if you search for something on Google and then click on a search result or image you are taken to a webpage which serves up a fake online scanner. It claims to detect a large number of nonexistent threats and urges you to install malware removal tool or anti-virus software. Once downloaded to your computer, Security Protection runs a fake system scan. It displays fake security alerts, pop-up windows and notifications like very one or two minutes saying that your computer is infected.

Fake Security Protection alerts:







What is more, Security Protection blocks other programs on your computer, including your web browser and takes you to a web page where you can purchase it. It displays fake notification saying that Internet Explorer or any other program is infected with W32/Blaster.worm.
iexplore.exe can not start
File iexplore.exe is infected by W32/Blaster.worm
Please activate Malware Protection to protect your computer.


The good news is that your computer is not infected with W32/Blaster worm and other viruses as this rogue programs claims. However, you should remove Security Protection from your computer as soon as possible. Just restart your computer in Safe Mode with Networking, download anti-malware software and run a full system scan.

OPTIONAL: In case you can't boot your PC in Safe Mode with Networking or you can't delete the malicious files manually, you can use this code SL55J-T54YHJ61-YHG88 and any email to register the rogue application in order to stop the fake security alerts.



Once this is done, you are free to install recommended anti-malware software (direct download) to remove the rogue anti-virus program from your computer properly. If you need help in removing Security Protection from your computer, please leave a comment below. Additional information about this malware and comments are welcome too. Good luck and be safe online.

Related malware:

Security Protection removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Download recommended anti-malware software (direct download) and run a full system scan to remove this rogue anti-virus program from your computer.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.


Security Protection associated files and registry values:

Files:

Windows XP:
  • C:\Documents and Settings\All Users\Application Data\defender.exe
Windows Vista/7:
  • C:\ProgramData\defender.exe
Registry values:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Security Protection"
Share this information with other people:

84 comments:

Anonymous said...

Thanks for the post. My wife's infected laptop didn't start the needed drivers for the network in Safe Mode, but your registration trick worked great. Aren't you going to get in trouble pirating their activation keys? ;)

Jared said...

actication key did not work for me today.

ad504 said...

How do you uninstall it after completing registry

Anonymous said...

Thanks a lot, option safe mode with networking and malwarebytes worked for me.

Nilo said...

Thanks, this information was very helpful and after renaming the MalwareBytes executable I was able to install it. I did have to reboot to complete the installation however after the reboot the "Security Protection" blocked the MalwareBytes program when I tried to launch it. So I rebooted a third time and launched it quickly and then I was able to run it and remove malicious file. Your post was very very useful for me. Thanks!!!

Anonymous said...

Thankssssssssssssssssss!!!! Really works!!!! EXCELENT POST!!!!

Anonymous said...

Espectacular post, loco si me entendes un poco quiero decirte q sos UN GROSSSSO DE VERDAD!!!

Anonymous said...

how do i remove the program from my computer after i put in the activation code? it doesnt show up when i go to "change/remove programs" from "my computer". help please!!!!!!

Siva said...

Thanks a lot for above guidance/suggestion..I have used the above registration key ,followed the procees & finally done full system scan using Quick Heal..But I have a Small query ,do we need to manually delete the malware protection/security protection program from our system or will it manually gets deleted.

Anonymous said...

Here's how I did it for XP:

I entered safe mode w/ networking as administrator. I launched Malwarebyte from a thumb drive and it found and deleted the bugger w/in 20-30 minute. Before that I wasted hours trying to locate and manually delete this POS. This f'ing virus is a time vampire and the bastards who wrote it should be kicked in the nuts repeatedly and then the blow torch and pliers!!

Anonymous said...

Thank you for the very informative and useful information. IT WORKED - thanks again.

Jenn Webb said...

This is so useful

Anonymous said...

I have spybot and am scanning now. Is MalwareBytes better? This is the 3rd time this has happened to me with a different name of maleware each time. How do I prevent this from happening? 1st time browser page wouldn't leave window that said recommend virus program or continue with problem. Wouldn't leave that screen no matter what & I thought it would direct me to antivirus web site. Not! 2nd time I choose no. Still downloaded. I updated browser and had no problems for a while. This time there was no prompt of anty kind it nor did I see any ad of this nature. Itjust popped up starting scan on my pc. This is so frustrating and as said in previous comment TIME consuming.

Anonymous said...

Malwarebytes' Anti-Malware worked a treat for me! Thanks a lot for this great post!

Mittal Thakkar said...

Thankssssssssssss a lottttt..... :) very useful info...... :D

Anonymous said...

Thanks a lot ...It worked

VeryYang said...

Thanks SO much!! MalwareBytes also worked for me (I chose it because other commenters said it worked for them). Ran the scan for 30 minutes, they found 6 files and removed them. Still see a shortcut to Security Protection on my desktop but I think I can remove that manually. Many thanks again!!!

Anonymous said...

i was scared of sounds that it makes.thanks.nice post.u r great man..

Anonymous said...

Thank you so much, this worked very well and saved me a lot of time. I really appreciate your post!! Very useful and right on. (I used Malwarebytes and it went very smooth)

cjuana said...

how do you remove the program after you put the activation code in?

Anonymous said...

The activation code wouldn't work for me either. And my computer is an XP and I can't for the life of me get it to run in safe mode...

Anonymous said...

Malware bytes didnt get rid of it properly for me. I used the registry code. How do I get rid of the program after I have done that?

I see a lot of people have that same problem, could we get an answer please...

Anonymous said...

Thank you for the help. I used the key code and then installed and ran MalwareBytes Anti-malware, is that all I have to do to remove the virus. My computer appears to be back to normal but I want to make sure it is fixed. Thank you for the help

Anonymous said...

im sorry but hes restarting me help please help me

Anonymous said...

If you are on a Windows 7 machine, the culprit program named defender.exe may be found in C:\Users\\AppData\Roaming folder. Find it and delete it along the registry entry identified here. I used Malwarebytes and CCleaner to get rid of the infection and startup registry entry respectively.

Anonymous said...

I ran MalwareBytes and it seems to have found 11 infected objects, which I removed, but when I rebooted my computer (as it asked me to), it froze after starting up. I've done this 3 times and it freezes each time, to the point where I can't even shut it down unless I physically unplug it. NOW WHAT? Would love some help if anyone is reading - I need this computer to work today.

clonicke said...

After registry how do you manually remove it?

Anonymous said...

GREAT post. Thanks. After seeing so many comments recommending MalwareBytes I decided to give it a try. I followed the instructions in this post and removed the malware in about 3 minutes. (Even the shareware/trial version will work!)

Call me paranoid but I thought MalwareBytes could have been malware itself but after doing some research on Wikipedia, I was satisfied that they were legitimate company.

Finally, remember, antivirus software does NOTHING to prevent malware installation (I had up-to-date AV and the malware just blasted through it). So you might want to invest in a copy of MalwareBytes for peace of mind.

Thanks again for a great post.

Anonymous said...

Couldnt even get into safe mode from my advanced boot options when i hit f8 in windows 7 (64bit) so what i did was as soon as windows started i quick went into msconfig, i then clicked the boot tab and clicked "safe boot" and then "minimal" or "network" (network for internet). I had to do this as soon as windows loaded and before the virus completely loaded. I clicked the two buttons and clicked restart now before the program could shut it down and i am not booting into safe mode...

Just remember if you need to go back to normal boot, click "normal boot" in the general tab

de044a8c-c954-11e0-bcee-000bcdcb471e said...

The virus came back the second that I disabled it...and then my computer kept freezing...and now I have a NEW virus...

Anonymous said...

Thank you, it did work going in Safe mode and installing Malwarebytes, removed "security protection" in 3 min. My verizon anti-virus did not even detect it.

Anonymous said...

this POS it my computer today as wife was using it. what i wanna know is how in the hell they can get a verisign SSL insignia on their site and pages? these people ( and all the A@#holes like them) need to be prosecuted to the full extent of the law

Anonymous said...

OMG THANK YOU SO MUCH.

Julia said...

Hello!
My computer has this infection. TDSS killer could not detect it, but then I used Malwarebytes and for five minutes I could access the Internet and open files again. But the Security Protection icon was still there. The next time I turned on the computer the problem was back, although the pop-up was gone. Now I can´t reach my files. When I click on something the screen gets a white filter over it and I can´t access the Internet even from a fail-safe mode. Some of the Open Office and Wordfiles I can reach from the fail-safe mode, others not. What do I do? The whole sci-fictionbook I have written is at stake here!

Valerie Leaver said...

The fake code worked! But I can't figure out how to uninstall it. Help please!

Anonymous said...

OMG thankzz alot...

Anonymous said...

Thank you so much!!! I downloaded and scanned Malwarebytes while on Safemode. Everything seems to be fine now after restart. I think I'll re-scan and maybe download another anti-malware you suggested just to calm down a bit more. THANKS AGAIN!

Anonymous said...

Thanks a Lot. The fake code worked (!) & I could access my system ; downloaded Malwarebytes - ran a full scan & was able to remove 3 (!) malwares from the system.

Anonymous said...

i have dont it as directed but i can't still remove the software from my PC

Anonymous said...

i did it. thanks very much

Anonymous said...

This worked! Thank you so much! You are like a god to me now.

Anonymous said...

glorious! You just saved my ass.

StevenG said...

You are the best!!! I've had grief over this fake security protection issue all week. I followed your instructions exactly, used one of the programs that you suggested malwarebytes.org and my computer is all fixed
Thank you!!!!!!!!

Anonymous said...

Thanks a lot..!

Ash said...

This software says its going to expire in 1 day! Will the security protection appear again in my system if antimalware expires?

Anonymous said...

Thanks your great, this one had me worried. My "defender.exe" was found c:\User\Toni\AppData\Roaming\defender.exe. I stopped it from running while in safe mode (no internet) with auslogic boost just to make sure. It was under Security Protection.

Jimbo said...

I'm not sure how Security Protection thing got on my computer, cause I'm not dumb enough to actually download something like this as "protection", but it got on my computer nonetheless, and certainly is persistent. Viruses/Malware like this are why you should always keep Malwarebytes installed for emergencies (I keep it as a secondary option, with MSE as my primary "active" protection). However, even Malwarebytes alone might not be enough. I would scan in Safe Mode, get 3 infected items, do some registry cleaning with CCleaner, and then Security Protection show up again shortly after a restart. If that's the case for anyone else here, I'd take a look at http://www.bleepingcomputer.com/virus-removal/remove-security-protection

It'll give you some extra tools to utilize in order to end some of the processes associated with SP so that you can remove the whole thing and keep it from coming back again. After ending the extra processes that were running, Malwarebytes found 11 total infected files, as opposed to the 3 it found before, and now it's gone for good. Once the extra processes are gone, removal's pretty easy.

Anonymous said...

Hey, the activation key worked, thank you so much for providing it!!!.. but I'm unsure now as to how to remove the Security Protection program itself...please help! :)

KRiSTEN =) said...

I used alwarebytes to "successfully" remove both the registry and the defender file yet they both keep returning and i find other files infected when i rerun malwarebytes multiple times. Is it possible that some of my files are permanently infected?

KRiSTEN =) said...

i probably should have read the 2nd to last comment. thank you anyway though!

liz said...

i still cant remove it from my computer, it wont remove and im really scared that it might ruin my computer.. PLEASE HELPP!!!

Anonymous said...

OH MUH GUSH THANKS SO MUCH!!!!!!!!!!!!!!!!!!! IT WORKED!!!!!! :D

Anonymous said...

I could not get anything to work and finally got into safe mode and restored my computer a few days earlier and security protection is not messing it up anymore. Now I can not find the files to delete and also can't find the registry entry to delete either. Does that mean it is gone? Thank you, I am saving the code and rest of the directions. This is the second time this has happened to me. Last was months ago. Did it wait all that time and replicate itself or did I just do something stupid and get the virus again? Thank you

Anonymous said...

I followed the steps and it cleaned. Next day this came back. Any help is greatly appreciated.

Acheera said...

Thank you very much!

Anonymous said...

Hi This is Pravin...Thanks a lot for your suggestion .. deleting reg entries and defender.exe file helped me to get rid of this stupid virus... thanks for your help

Anonymous said...

Brilliant! I actually cheered at my screen when that fake auth key worked. Tricked you back, malware! =P

Thanks a million, saved me before my project was due!

Chinmay said...

thanks, this post help me lot
thanks again

Anonymous said...

I NEED HELP HOW CAN I UNINSTALL IT??

Anonymous said...

Thankyou this fixed mine with malwarebyte..
Cheers!!""

Anonymous said...

Thank you very much, it worked well is it common that it might occur again?

Anonymous said...

1st post might be a hacker...you wont get in trouble for "pirating" their activation keys. The POSs that put out the virus/malware program are criminals you idiot.

Manoj Jain, Brij Info Sol.,Delhi said...

Thanx...!!!!!! I downloaded SUPERAntispyware and followed instructions to clean my PC from "Security Protection". It worked parfectly. Good Job...... Thanks again.

Anonymous said...

Thank you very much. I still have the security protection icon on my desk top though once the scan was complete. However I now know how to deal with the problem thanks to your article

Anonymous said...

Thank you so much!!!!

Anonymous said...

ayyyeee!!!!

Anonymous said...

I downloaded Malwarebytes to a thumb drive on a different computer, started infected computer in Safe w/Networking mode and installed the Mawarebytes from the thumbdrive, update the program and ran it. Malwarebytes found the issue and deleted it except for the Desktop shortcut which was pointing to:

"C:\Documents and Settings\All Users\Application Data\privacy.exe"

Everything seems to be back to normal now!

Anonymous said...

thank a bunch, My laptop got rebirth, with your tips. salute!

Anonymous said...

Thank you so much!!! Good Karma for you

Anonymous said...

THANK YOU! I thought I was going to have to 'wipe' my son's computer...AGAIN! I also downloaded it to a flash drive and then followed the Safe w/Networking instructions. DS is especially happy because he gets to keep his computer! Thanks again!

Anonymous said...

The aforementioned program now stops you from entering safe mode and my fix of having Trend Micro scan the Malware infected disc in a USB docking port has failed. I am going to try the on-line scanners and see if I have any luck there.

Anonymous said...

This is such a great page! Perfect directions! thank you soooooo much! I really appreciate it.

P.S. if you have vista and you want to run as administrator...right click on the icon to run as administrator.

Anonymous said...

I used your Safe Mode -> Malwarebyte AntiVirus to remove 13 harmful objects. When I rebooted, it worked fine! Thank you VERY MUCH! You deserve a cookie!

ladywhy said...

THANK YOU! whoever wrote this: YOU ARE AWESOME. i bought a mini dell for my sister and it was just not working. long story short, my dad was willing to spend $150 to "fix it." but thank you! AWESOME instructions!

THANK YOU!

Jonathan Frodsham said...

Thank you so much for that, I was up all night with it, I do not know how I got infected, there are some very nasty people in this world, who do such things. Thanks again you are a legend.I will buy you a beer when I see you.

Anonymous said...

Thank you so much!!! You're an angel sent from up above!

Anonymous said...

Absolutely fantastic! I had previously attempted numerous methods to remove this virus with no luck. Thanks heaps and f@#k the scum bags who created that virus.
Appreciate it :)

Gospodja said...

Perfect - it worked! Thank you

Anonymous said...

I got just an hour ago and while i was waiting for the scanners to complete, i found this site and i basically did everything that was recommended. Lost an hour of work time this morning, but fortunately i wasnt too busy...

Anonymous said...

The writer is not pirating any activations you dumb fuck. The scammers who wrote this have breached software laws and denying use of the computer. Their activation keys are not keys to legitimate software. Read before you post you dumb POS

Anonymous said...

Thank u!! I so happy that my computer it is working fine again ;)

Anonymous said...

nao consegui "wrong activation code ! please check and retry

Anonymous said...

It worked..........thanks heaps for the post.

Anonymous said...

Thank you so much! I thought I would have to take my laptop to a professional, but this quickly took care of tbe problem!