Windows Active Defender seems to be a powerful system protection tool but infact it is a fake program. If your computer is infected with it, you must get rid of it as soon as possible because it is a harmful threat. Let me explain what “Windows Active Defender” is and how dose it work.
It is a piece of software created by hackers and distributed as an anti-spyware software. Windows Active Defender`s goal is to earn some money for malware creators. It makes money for them from innocent internet users by asking them to pay virus removal fee. This virus will enter into a coputer with the help of Trojan, then it will act like if it is a Microsoft certified program designed for windows users to defend against viruses, it will also tell the infected user that Windows Active Defender has scanned your computer and it has detected numerous dangerous virus threats in your PC. All this tricky game is played to convince people that they need to purchase the Windows Active Defender`s full version so it could make their PC clean and virus free. And now, if unfortunately you make a mistake and buy this software, it will ruin your PC will put your money and time in vain because this program is not a legitimate defending tool to remove malwares but it will bring more scamware products to your computer trying to trick you pay for them too.
Please keep in mind that Windows Active Defender displays fake virus alerts and warnings. You have to ignore all its alerts and promotions. This virus can disable your access to windows task manager and regedit. It can also disable your current anti-virus program installed and may disallow your browser to open any security website. It is recommended to immediately remove Windows Active Defender malware from infected system.
How to remove Windows Active Defender virus manually:
To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.
To prform manual removal steps, you may need to learn,
How to stop a process
How to delete registry entries
Stop Windows Active Defender processes:
Protector.exe
Remove Windows Active Defender Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ERROR_PAGE_BYPASS_ZONE_CHECK_FOR_HTTPS_KB954312
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegedit” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableRegistryTools” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “ID” = 0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “net” = “2012-2-17_2″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings “UID” = “rudbxijemb”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe
Delete Windows Active Defender files:
%AppData%\Protector.exe
Auto Removal
To remove this virus Automatically, We suggest following tools:
Malware Bytes Anti-Malware (Download)
HitMan Pro Anti-Malware (Download)
