XP Smart Defender removal tool

XP Smart Defender is a brand new malware that has been released by cyber hackers recently. It attacks computers with Windows XP as the main operating system running. While attacking the computer, this scam comes into the PC unexpectedly, without user’s approval. During this process the scam makes amendments into your system that make it possible for the hoax to be self-started automatically each time you turn the computer on. The program runs the fake scan and reports many unreal threats to scare you into buying its so-called activation key or license, which are altogether good for nothing. XP Smart Defender will never protect your system as it should based on its name.

The infiltration of XP Smart Defender rogue into your system takes place when users download allegedly some codecs that are necessary for video retrieval. In fact, upon execution of them, the virus is actually implanted into the system.

XP Smart Defender runs the imitated scanning of your system and subsequently reports the wide number of threats, that aren’t real, of course. The purpose of them all is to make users think something horrible is going on with their computers. The primary plot of this scam is to convince you to buy its license, sooner or later this hoax will bring you to this point. However, be smart not to fall into this trick! Please ignore all scary warnings, alerts and notifications of such a deceitful program. Do not buy it, and if you have already done so by mistake please immediately dispute the charges via your good bank. Finally, to remove this malware, you may follow the guide provided below.


Examples of fake and scary alerts associated with XP Smart Defender scam:

XP Smart Defender Firewall Alert
Iexplore.exe is infected with Trojan.JS.Fraud.ba. Private data can be stolen by third parties, including credit card details and passwords.
Windows recommends activate XP Smart Defender

System Security Alert!
Vulnerabilities found
Background scan for security breaches has been finished. Serious problems have been detected. Safeguard your system against exploits, malware and viruses right now by activating Proactive Defence.

System Security Alert!
Unknown program is scanning your system registry right now! Identify the theft detected!

XP Smart similar removal video at YouTube:

Removal sequence of steps:

  1. Download the installer of GridinSoft Trojan Killer from the direct link http://trojan-killer.net/download.php from some different clean (uninfected computer), for example, available at your work or with your friends or relatives
  2. Copy the installer of GridinSoft Trojan Killer onto your USB/Flash drive
  3. Transfer the USB/Flash drive to the PC infected with XP Smart Defender
  4. Copy the installer of GridinSoft Trojan Killer to the desktop of the infected PC
  5. Run the installer of GridinSoft Trojan Killer as Administrator (right-click the installer with your mouse and select the respective option)For XP users: Right-click the installer of GridinSoft Trojan Killer with your mouse and click “Run as…”. Uncheck the box “Protect my computer and data from unauthorized program activity” and click OK.
  6. Install GridinSoft Trojan Killer, make sure to uncheck the box “Start Trojan Killer” at the end of installation process
  7. Run GridinSoft Trojan Killer as Administrator (right-click the desktop icon of GridinSoft Trojan Killer with your mouse and select the respective option)
  8. Update GridinSoft Trojan Killer, run the scan and remove all infected items found during the scan with Trojan Killer
    XP Smart Defender remoavl tool
    Trojan Killer – removal of XP Smart Defender
  9. Restart your computer to apply the changes after malware removal
  10. Additionally, make sure to scan your system with Kaspersky’s TDSS Killer downloadable here.

Associated files:


%commonappdata%\pcdfdata\[rnd].exe
%commonappdata%\pcdfdata\app.ico
%commonappdata%\pcdfdata\config.bin
%commonappdata%\pcdfdata\defs.bin
%commonappdata%\pcdfdata\support.ico
%commonappdata%\pcdfdata\uninst.ico
%commonappdata%\pcdfdata\vl.bin
%commondesktopdir%\XP Smart Defender.lnk
%commonprograms%\XP Smart Defender\XP Smart Defender.lnk
%commonprograms%\XP Smart Defender\XP Smart Defender Help and Support.lnk
%commonprograms%\XP Smart Defender\XP Smart Defender.lnk

Associated registry entries:


HKCU\Software\Microsoft\Windows\CurrentVersion\Run\pcdfsvc %commonappdata%\pcdfdata\[rnd].exe /min
HKCU\Software\Classes\.exe
HKCU\Software\Classes\.exe\ [rnd_2]
HKCU\Software\Classes\.exe\Content Type application/x-m
HKCU\Software\Classes\.exe\DefaultIcon
HKCU\Software\Classes\.exe\DefaultIcon\ %1
HKCU\Software\Classes\.exe\shell
HKCU\Software\Classes\.exe\shell\open
HKCU\Software\Classes\.exe\shell\open\command
HKCU\Software\Classes\.exe\shell\open\command\ "%commonappdata%\pcdfdata\[rnd].exe" /ex "%1" %*
HKCU\Software\Classes\.exe\shell\open\command\IsolatedCommand "%1" %*
HKCU\Software\Classes\.exe\shell\runas
HKCU\Software\Classes\.exe\shell\runas\command
HKCU\Software\Classes\.exe\shell\runas\command\ "%1" %*
HKCU\Software\Classes\.exe\shell\runas\command\IsolatedCommand "%1" %*

Leave a Comment


*