Win7 Defender: how to remove this virus fake AV [SOLVED]

Win 7 Defender fake AV description

Win 7 Defender is not a real defender. Instead of actually protecting your PC it only imitates the traits of some security program for your computer. In Windows XP operating system it appears as ‘XP Defender

XP Defender fake AV screenshots

win_7_defender

system_security_alert

computer_security_at_risk

attention_danger

Win 7 Defender fake AV removal

Please follow the steps of this removal guide to remove the Win 7 Defender virus:

http://trojan-killer.net/pc-defender-virus-remove-effectively/

Win 7 Defender fake AV Manual Clean-up

%commonappdata%\pcdfdata\[rnd].exe
%commonappdata%\pcdfdata\app.ico
%commonappdata%\pcdfdata\config.bin
%commonappdata%\pcdfdata\defs.bin
%commonappdata%\pcdfdata\support.ico
%commonappdata%\pcdfdata\uninst.ico
%commonappdata%\pcdfdata\vl.bin
%commondesktopdir%\Win 7 Defender.lnk
%commonprograms%\Win 7 Defender\Remove Win 7 Defender.lnk
%commonprograms%\Win 7 Defender\Win 7 Defender Help and Support.lnk
%commonprograms%\Win 7 Defender\Win 7 Defender.lnk

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\pcdfsvc %commonappdata%\pcdfdata\[rnd].exe /min

HKCU\Software\Classes\.exe
HKCU\Software\Classes\.exe\ [rnd_2]
HKCU\Software\Classes\.exe\Content Type application/x-m
HKCU\Software\Classes\.exe\DefaultIcon
HKCU\Software\Classes\.exe\DefaultIcon\ %1
HKCU\Software\Classes\.exe\shell
HKCU\Software\Classes\.exe\shell\open
HKCU\Software\Classes\.exe\shell\open\command
HKCU\Software\Classes\.exe\shell\open\command\ “%commonappdata%\pcdfdata\[rnd].exe” /ex “%1” %*
HKCU\Software\Classes\.exe\shell\open\command\IsolatedCommand “%1” %*
HKCU\Software\Classes\.exe\shell\runas
HKCU\Software\Classes\.exe\shell\runas\command
HKCU\Software\Classes\.exe\shell\runas\command\ “%1” %*
HKCU\Software\Classes\.exe\shell\runas\command\IsolatedCommand “%1” %*

Leave a Comment

*