How to Remove Security Defender (Uninstall Guide)

Don't Copy From This Blog...

Security Defender is a rogue anti-spyware program that uses deceptive tactics to drive up sales from confused or inexperienced computer users. This fake security product pretends to find malicious software on your computer. It also pretends to protect your PC against misleading pop-ups and security threats caused by spyware, adware, Trojans and other viruses. What is more, Security Defender impersonates Windows Defender which is a perfectly legitimate anti-spyware product from Microsoft. I have to admit that this time scam artists made a quite legitimate looking rogue application which may actually mislead many computer users into paying for the fake removal of malware. Security Defender may be downloaded silently by Trojan horses or installed when the fake alert is clicked. Hopefully, you can use real anti-malware applications to remove Security Defender malware from your computer. To remove this fake security program and any related malware for free, please follow the steps in the removal guide below.

New GUI of Security Defender malware:

Old GUI which is probably not used anymore.

Due to the fact that Security Defender was made to scare you into thinking your computer has many critical security problems it displays numerous fake firewall alerts and notifications from the Windows taskbar.

Security Defender Firewall Alert
Harmful software detected
Security Defender has detected malicious software that may cause crash of your computer.

Security Defender
Viruses have been found in your system.
We highly recommend you to get license for

Security Defender may also hijack Internet Explorer and block other programs on your computer. If you somehow ended up with this rogue program, please follow the removal instructions below to remove Security Defender and related malware. If you need help removing this little bugger from your computer, please leave a comment. Good luck and be safe online!

Guide update:
01/25/13 - Updated removal instructions, new activation key, GUI.

Quick removal guide:

1. Open Security Defender. Click the "Activate" button and select Manual Activation. Enter one of these debugged registration key to register this rogue application. Don't worry, this is completely legal.

xOxZxLxWxIxTxFxQxCxNxYxKxVxHxSxE (new code)

D13F-3B7D-B3C5-BD84 (old code, may still work with some variants)

Once this is done, you are free to install anti-malware software and remove the rogue anti-virus program from your computer properly.

2. Download recommended anti-malware software and run a full system scan to remove this virus from your computer.

Security Defender removal instructions (Safe Mode):

Download recommended recommended anti-malware software (direct download) to remove this virus from your computer.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

If you can't download it, please reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Open Internet Explorer and download Spyware Doctor. Once finished, run setup. That's It!

NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

Alternate Security Defender removal instructions:

1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it.

2. Search for such entry in the scan results:
O4 - HKCU\..\Run: [pcdfsvc] C:\ProgramData\pcdfdata\[random_characters].exe /min

Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

3. Download recommended recommended anti-malware software to remove this virus from your computer.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

Associated Security Defender files and registry values:

Files:

C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS]_.mkv
C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].avi
C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].ico
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\[SET OF RANDOM CHARACTERS].lnk
C:\Program Files\Security Defender
C:\Program Files\Security Defender\Security Defender.dll
%Temp%\[SET OF RANDOM CHARACTERS].dll

%Temp% refers to:
C:\Documents and Settings\[UserName]\Local Settings\Temp (in Windows 2000/XP)
C:\Users\[UserName]\AppData\Local\Temp (in Windows Vista & Windows 7)

Registry values:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"

Share the knowledge: