A recent malware removal session gave a very frustrating error in trying to boot into safe mode. I was unable to boot into safe mode, safe mode with networking or even safe mode with the command prompt. The Stop Error was a Stop 0×0000007B Error. The instructions on the screen talk about running chkdsk on the drive (which I did.) There were a few things found and corrected, but the problem was still there. On investigation I went into the registry editor (regedit) and found that the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot registry key had been emasculated. There were two subkeys for minimal and network profiles…. So… I found a way to rebuild them.

Didier Stevens has spent a lot of time on this and has developed a registry patch file. There are patches for Xp sp2 and sp3 as well as 2003 server and Windows 2000 SP4 in his download zip.

There is an https and an http download link for safeboot. The registry patches worked and allowed safe mode to work. I did further scans on the system and ultimately all is clean.

Live Enterprise Suite is yet another rogue security application. This is a successor to the frustrating Internet Antivirus Pro and Ghost Antivirus rogues. Like many of these security rogues they are pushed through malware and aggressive advertising. This may be a website that when visited a screen pops up that appears to be doing a scan on your computer. However, everyone sees the same video when they visit the site, so you may see the same message whether you’re browsing with windows, apple mac or linux. Unfortunately, this trick is effective and many will click on the link they provide which installs the software on the local machine. Read on for how to remove live enterprise suite.

Among the other usual nuisances of these pests, this one also installs the TDL3 rootkit and disables task manager. It also deactivates security software that it is able to find and get rid of. This can be a very challenging infection to clean up and you may need to resort to a livecd and deleting some of the files to regain control over the system. You may use either the recovery console or a bartpe/ultimate boot cd disk or even a linux boot disk to remove the files.

There are a number of other things you may try to remove this rogue. First you may want to visit the control panel and add/remove programs and attempt to uninstall live enterprise suite. It probably won’t work, but is worth a try. If it DOES work, then you should scan your system with a malware removal tool such as superantispyware or malwarebytes antimalware (or both) and a reputable antivirus before considering it clean.

To remove live enterprise suite you will want to use an automated tool if at all possible such as superantispywares portable scanner or malwarebytes antimalware (both can be found on the virus removal tools page.) The portable scanner from superantispyware is easier and has some advantages. 1) it is randomly named each download so, is not likely to be noticed and terminated by the rogue. 2) It is updated daily, so you don’t need to check for updates if you’ve downloaded the portable scanner fresh today. That much said, you may not be able to download anything on the affected machine, so make use of a usb flash drive for this and a clean computer.

If you have trouble running either superantispyware’s portable scanner or the malwarebytes antimalware installer you may try the following and then re-attempt to run your chosen cleaner. 1) rename the program to something that will be more likely allowed to run (explorer.exe iexplore.exe firefox.exe are good candidates.) 2) reboot into safe mode with networking and try running again. Malwarebytes will need safe mode with networking to perform an update to make certain that you have the latest definition updates.

Remove anything that is found and scan again. I usually keep scanning and alternate malware removal/antivirus tools until the system is clean. If you have trouble logging in to windows after cleaning, then read this for suggestions on what to do.

The files associated with live enterprise suite are listed below. You will need to delete this files if you have to do a manual removal of live enterprise suite. You may make use of the recovery console or a windows live cd such as bartpe, ultimate bootcd or a linux boot cd to be able to remove the files listed. Unfortunately some of the files are randomly named and so will be different from one install to another. For this reason, you need to be careful in determining which files to delete. Use the locations seen here, the files you see on your system and your best judgment to decide. (When in doubt make a folder to quarantine to and MOVE the files there.)

%user%\Application Data\Live Enterprise Suite
%user%\Application Data\Live Enterprise Suite\settings.ini
%user%\Application Data\Live Enterprise Suite\uill.ini
%user%\Application Data\Live Enterprise Suite\unins000.exe
%user%\Application Data\Live Enterprise Suite\updateloadlist.ini
%user%\Application Data\Live Enterprise Suite\db
%user%\Application Data\Live Enterprise Suite\db\config.cfg
%user%\Application Data\Live Enterprise Suite\db\Timeout.inf
%user%\Application Data\Live Enterprise Suite\db\Urls.inf
%user%\Application Data\Microsoft\Windows\winlogon.exe
%user%\Local Settings\Application Data\Microsoft\Windows\log.txt
%user%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
%user%\Local Settings\Application Data\Microsoft\Windows\services.exe
%user%\My Documents\My Pictures\atbyin.exe
%progfiles%\Common Files\RANDOMchar.exe
%progfiles%\Common Files\RANDOMcalc.exe
%progfiles%\Live Enterprise Suite
%progfiles%\Live Enterprise Suite\activate.ico
%progfiles%\Live Enterprise Suite\Explorer.ico
%progfiles%\Live Enterprise Suite\Live Enterprise Suite.exe
%progfiles%\Live Enterprise Suite\unins000.dat
%progfiles%\Live Enterprise Suite\uninstall.ico
%progfiles%\Live Enterprise Suite\working.log
%win%\system32\RANDOM.dll
%win%\system32\RANDOM.dll

I’m still working to confirm/complete the list of files above. Even after a full manual removal of live enterprise suite you should follow up with scans using a trusted malware removal tool such as superantispyware or malwarebytes antimalware. Also, scan with a reputable antivirus application. Reputable doesn’t have to mean a paid antivirus, free is okay, an online scanner can be all right, just make sure that it is a more trusted name such as AVG/avira/trendmicro/norton/mcafee/etc.

This article may come in handy if you are out there battling the latest rogue du jour. Occasionally I have been through a cleaning process for these rogues and got to a point where the scanner had run and cleaned things out (whether it was malwarebytes antimalware or superantispyware.) It was time to reboot and the system reboots, starts to load the desktop wallpaper and then…. You see the windows login screen and the words “saving settings” under the username followed by the words “logging out”. You may try again, but it doesn’t even load the desktop icons it just boots you back out to the login screen. If you try safe mode you may get the same behavior (it was in my case), administrator or the typical system user didn’t seem to make a difference. I couldn’t even get to safe mode with the command prompt. No choice but to reinstall right? Wrong….

For this you will need to get access to the registry. Obviously given that this system is problematic we have limited options. If you have been able to access the registry remotely over the network that may work for you, but in my case I have an Ultimate boot CD which includes a Windows live cd environment. One catch with windows live boot cds though is that they need to be made from a working windows system. So, if you don’t already have one in your toolkit, you will need to scrounge your way to a working windows xp system with your windows disk, internet connection and then get your boot cd setup.

You may be able to use a linux boot cd to edit the registry (using wine perhaps as this article suggests.) Although that’s a path I haven’t gone down before… Other than that though I don’t know another way to edit the registry from linux.

Here’s what you will need to check in the registry.

HKeyLocalMachine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

You are looking for the userinit value which should be c:\windows\system32\userinit.exe and shell should be explorer.exe

In my case userinit was set to c:\windows\system32\winlogon32.exe or some such nonsense. Fixing this restored the ability to login.

However, if it appears set correctly it may be that your copy of userinit.exe is corrupted and you may need to extract it from the windows install disk in recovery console mode…

expand d:\i386\userinit.ex_ c:\windows\system32\userinit.exe

So, if you’re stuck in a windows login logout loop that you just cannot login to windows it automatically logs you back out before you see the desktop the above may solve the problem for you.

APCSafe is another of the recent variations on the Wini family of rogue antivirus applications. Like all the others it is pushed by trojan activity… this is typically a video site that claims to have a sought after video, but alas…. the video cannot be viewed unless you install a flashplayer update that they have on the site, or a video codec. These of course, aren’t really what they are, they are the payload of this rogue antivirus. Once it is installed it will run at boot, scan files and complain of many viruses on your system as well as security problems with your computer. None of these can be fixed without paying for the software, so it claims. This is a scam, so please read on for how to remove apcsafe.

Among the easiest ways to get rid of any software that you don’t work is to go to the control panel and use the add/remove programs applet to uninstall apcsafe or whichever other software you are trying to get rid of. This may not work for rogue antivirus software because typically these programs don’t want to be uninstalled. If it does work for some reason, then you should still follow it up with a scan from a reputable malware removal tool and then a reputable antivirus application.

Your next best option for removing a pest such as apcsafe is to use a tool such as the portable scanner from superantispyware. There is a link on my virus removal toolkit page. It is updated daily and so you shouldn’t need to update it once it downloads. It will use a random filename each time it is downloaded so you should take care to make a note of the filename as it downloads so you can find it when the download is completed. If for some reason it doesn’t run when it’s downloaded you may try the following tricks to run it. 1) rename it to either explorer.exe iexplore.exe or firefox.exe and then retry running it. 2) reboot into safe mode and retry running it. When it does run, remove all the infections found and then run it again, and again until things come clear.

If you wish to perform a manual removal of apcsafe you will need to refer to the list of filenames below of those files associated with apcsafe.

%user%\Local Settings\temp\00002e99
%docs%\All Users\Desktop\APcSafe.lnk
%docs%\All Users\Start Menu\Programs\APcSafe\1 APcSafe.lnk
%docs%\All Users\Start Menu\Programs\APcSafe\2 Homepage.lnk
%docs%\All Users\Start Menu\Programs\APcSafe\3 Uninstall.lnk
%progfiles%\APcSafe Software\APcSafe\APcSafe.exe
%progfiles%\APcSafe Software\APcSafe\uninstall.exe
%win%\system32\RANDOM.exe
%win%\system32\spool\prtprocs\w32×86\00003e8f.tmp

After you have removed the files above or using a tool such as superantispyware then you should follow up with further malware removal scans and antivirus applications. I typically will scan until things come clean. You should make sure that you use only reputable products for these scans. Free is okay, an online scanner is okay, just make sure they have a good reputation.

If you are administrator of a computer network you may wish to block traffic to apcsafe.com

PCSecure is a recent rogue antivirus from the notorious and prolific wini family of rogue security software. It is typically promoted via trojan downloaders. Usually these will be on a website with a video that may be highly sought after. In order to see the video though you are told that you need to download a codec update or flash player update. This is where you get the infection that starts the nightmare of popups complaining of viruses on your system and multiple security problems on your pc. The real kicker is that they claim that the problems cannot be fixed unless you purchase their software. This is a scam and should be avoided. Read on for how to remove PCSecure.

This and other recent versions of the wini rogues may also bundle a rootkit that has been called the TDL3 rootkit. You may need further cleanup on this machine than the relatively simple rogue security software removal. Among the warnings you may see on your system will be the following:

German Alert:
Spzprogramm Warnzeichen!
Ihr Computer ist mit Spionprogramm infektioniert. Das kann Ihren Dateien und die im Internet zugänglich machen. Klicken bitte hier, um Ihre Kopie von PcsSecure zu registrieren und Ihr PC von Spyprogramm frei zu machen.

English Alert:
Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of PcsSecure and remove spyware threats from your PC.

French Alert:
Spyware Alerte!
Votre ordinateur est infecté de spyware. Il pourrait endommager vos fichiers critiques ou exposer vos données prives sur ‘Internet. Cliquez ici pour enregistrer votre copie de PcsSecure et enléver des menaces spyware de votre OP.

Italian Alert:
Spyware miniaccia!
Il suo computer è infetto di spyware. Puo dannegiare i suoi files criticali rivelare i suoi dati personali nell’Internet. Clicca qui per registrare la sua coppia di PcsSecure e rimouvere le minacce di spyware dal suo computer.

The first and easiest way to attempt removal of pcsecure or other rogues may or may not work. This is going to the control panel and the add/remove programs area and then uninstall pcsecure. As I said, this may work, but it may not. Even if it does, you should follow this with a scan of your computer using a malware removal tool that is reputable such as superantispyware or malwarebytes antimalware. You also should scan the system with a reputable antivirus such as AVG/Avira/Trendmicros online housecall, etc.

If you were unable to remove this pest by using the control panel, I think the next easiest way should be the portable scanner from superantispyware. You can find a link to it on my virus removal toolkit page. Basically, it is rebuilt each day so you shouldn’t have to worry about updating it before scanning and it is given a random name each time it is downloaded so the rogues shouldn’t be able to kill it off thinking it is security software. That much said, if you have a hard time running your download of the portable scanner you may try the following: 1) rename the download to something like explorer.exe or iexplore.exe or firefox.exe – these are usually process names that the rogues will leave alone (especially explorer.exe). 2) reboot into safe mode and attempt torun the scanner there. Make sure to note the filename when you download since it is almost always a different filename.

If you would like to try to attempt a manual removal of pcsecure then you will need to know the filenames listed below.

%docs%\All Users\Desktop\PcsSecure.lnk
%docs%\All Users\Start Menu\Programs\PcsSecure
%docs%\All Users\Start Menu\Programs\PcsSecure\1 PcsSecure.lnk
%docs%\All Users\Start Menu\Programs\PcsSecure\2 Homepage.lnk
%docs%\All Users\Start Menu\Programs\PcsSecure\3 Uninstall.lnk
%progfiles%\PcsSecure Software
%progfiles%\PcsSecure Software\PcsSecure
%progfiles%\PcsSecure Software\PcsSecure\PcsSecure.exe
%progfiles%\PcsSecure Software\PcsSecure\uninstall.exe
%win%\10548h5c9tool4z5.exe
%win%\105z5troj199.cpl
%win%\11359not-z-9irus405.bin
%win%\system32\48fcthizf1950.cpl
%win%\system32\4943h9ckto5lz78.ocx
%win%\system32\49705hi9f896z.bin
%win%\system32\RANDOM.exe

After the above files have been removed you should still scan your system with a reputable malware removal tool and reputable antivirus to make sure that your system is clean. I will typically run scans until the scans start coming up with nothing found to make certain that everything related to the rogues have been eliminated.

Desktop Security 2010 is a rogue antivirus application. It is a successor to Total PC Defender and installs on your pc without permission through the use of malware. Once on your system it will create numerous files that it then finds during scheduled scans and it claims these files are virus infected. It will scan at windows startup and claim these files and some legitimate files are infected with viruses and the only way it can clean them is if you purchase the software. If the files listed are removed it can damage your system. Obviously, this is a scam just to get your money, read on for how to remove desktop security 2010.

You will see many pop up warnings and errors from this rogue including the following:

Warning! Running trial version!
Your computer has been compromised! Now running trial version of the software! Click here to purchase the full version of the software and get full protection for your PC!

Security Center Alert
To help protect your computer, Desktop Security 2010 has blocked some features of this program.
Name Sft.dez.Wien
Risk High
Description Sft.dez.Wien is a virus attempts to spread itself by attaching to a host program, and can damage hardware, software or data in the process. This worm can be blocked from firewall and antivirus software.

Spyware Warning
Your online guard helps to stop unauthorized changes to your computer
Details: Spyware detected on your computer

Your computer might be at risk
Antivirus detects viruses, worms, and Trojan horses. They can (and do) destroy data, format your hard disk or can destroy the BIOS. By destroying the BIOS many times you end up buying a new motherboard or if the bios chip is removable then that chip would need replacing.
Click this balloon to fix this problem.

No firewall is turned on
Automatic Updates is turned off
Antivirus software might not be activated
Click this balloon to fix this problem.

All of these errors should be disregarded as you work to remove desktop security 2010. Your first stop for this removal should be the control panel and then the add/remove programs applet. From there you should try to uninstall desktop security 2010. This may or may not be successful. If it is, congratulations…. follow that uninstall up with a scan using malwarebytes antimalware or superantispyware. Then follow THAT up with a scan using a reputable antivirus application.

If the uninstall approach didn’t work, you can next try to remove desktop security 2010 using the portable scanner from superantispyware. There is a download link on my virus removal toolkit page. When it downloads it will be given a random name, so make note of the name as it downloads so you can find it later. Also, it is rebuilt daily so it should have the latest definition updates so you should not need to run an update before scanning.

Run a scan with the portable scanner and clean out everything that it finds. Then scan again and again until the system comes clean. If you are interested in performing a manual removal of desktop security 2010 you should make note of the following files and folders to delete:

%docs%\All Users\Start Menu\Programs\Desktop Security 2010
%docs%\All Users\Start Menu\Programs\Desktop Security 2010.lnk
%docs%\All Users\Start Menu\Programs\Desktop Security 2010\Activate Desktop Security 2010.lnk
%docs%\All Users\Start Menu\Programs\Desktop Security 2010\Desktop Security 2010.lnk
%docs%\All Users\Start Menu\Programs\Desktop Security 2010\Help Desktop Security 2010.lnk
%docs%\All Users\Start Menu\Programs\Desktop Security 2010\How to Activate Desktop Security 2010.lnk
%user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Desktop Security 2010.lnk
%user%\Local Settings\Temp\gedx_ae09.exe
%user%\Local Settings\Temp\jkfuckjs.exe
%user%\Local Settings\Temp\kgn.exe
%user%\Local Settings\Temp\kilslmd.exex
%user%\Local Settings\Temp\kn.a.exe
%progfiles%\Desktop Security 2010
%progfiles%\Desktop Security 2010\daily.cvd
%progfiles%\Desktop Security 2010\Desktop Security 2010.exe
c:\Program Files%progfiles%%progfiles%\Desktop Security 2010\hjengine.dll
%progfiles%\Desktop Security 2010\mfc71.dll
%progfiles%\Desktop Security 2010\MFC71ENU.DLL
%progfiles%\Desktop Security 2010\msvcp71.dll
%progfiles%\Desktop Security 2010\msvcr71.dll
%progfiles%\Desktop Security 2010\pthreadVC2.dll
%progfiles%\Desktop Security 2010\securitycenter.exe
%progfiles%\Desktop Security 2010\taskmgr.dll
%progfiles%\Desktop Security 2010\uninstall.exe
%win%\system32\RANDOM.exe

Follow up any removal of desktop security 2010 with a scan from a trusted, reputable malware removal tool such as superantispyware or malwarebytes antimalware. Then you should follow up with a scan from a trusted antivirus application. Make certain that you are using reputable tools. Free is fine, an online scanner is okay, just make sure that they are reputable.

APCSecure is yet another rogue antivirus application from the prolific and annoying wini family of rogues. This particular variant also comes with a rootkit called TDL3. Trojans are used to promote this rogue antivirus and you will likely find that it will create multiple empty files on your computer that it will then find during scans and claim that they are all virus infected files. Like most all rogues it will also claim that your only hope to fix the security problems on your pc is to purchase their software. This is a scam, do not let them separate you from your hard earned money. Read on for how to remove apcsecure.

You will see the following alerts along with a spoofed version of the windows security center when your pc is infected with this rogue antivirus application:

German Alert:
Spzprogramm Warnzeichen!
Ihr Computer ist mit Spionprogramm infektioniert. Das kann Ihren Dateien und die im Internet zugänglich machen. Klicken bitte hier, um Ihre Kopie von APcSecure zu registrieren und Ihr PC von Spyprogramm frei zu machen.

English Alert:
Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of APcSecure and remove spyware threats from your PC.

French Alert:
Spyware Alerte!
Votre ordinateur est infecté de spyware. Il pourrait endommager vos fichiers critiques ou exposer vos données prives sur ‘Internet. Cliquez ici pour enregistrer votre copie de APcSecure et enléver des menaces spyware de votre OP.

Italian Alert:
Spyware miniaccia!
Il suo computer è infetto di spyware. Puo dannegiare i suoi files criticali rivelare i suoi dati personali nell’Internet. Clicca qui per registrare la sua coppia di APcSecure e rimouvere le minacce di spyware dal suo computer.

Disregard this and any other warnings that this rogue gives as you proceed to eliminate apcsecure from your machine. You may first wish to visit the control panel, add/remove programs and see if it is possible to uninstall apcsecure. If this works, things will be quite easy. Follow that up with a scan from a malware removal tool such as malwarebytes antimalware or superantispyware and then follow THAT up with a scan from a reputable antivirus application.

If the uninstall route fails, the next thing to try is a scan of your machine with the portable scanner from superantispyware. You can find a link to download it on my virus removal toolkit page. It will have a different filename each time it’s downloaded and is rebuilt daily with the latest definitions, so…. make sure to take note of the filename as it downloads and don’t worry about updating it before a scan if you’re downloading it fresh for the removal of apcsecure. Scan and use it to remove anything detected as a rogue.

If you wish to try for a more manual removal of apcsecure you should know that the files listed below have been reported associated with this rogue antivirus application.

%docs%\All Users\Desktop\APcSecure.lnk
%docs%\All Users\Start Menu\Programs\APcSecure
%docs%\All Users\Start Menu\Programs\APcSecure\1 APcSecure.lnk
%docs%\All Users\Start Menu\Programs\APcSecure\2 Homepage.lnk
%docs%\All Users\Start Menu\Programs\APcSecure\3 Uninstall.lnk
%progfiles%\APcSecure Software
%progfiles%\APcSecure Software\APcSecure
%progfiles%\APcSecure Software\APcSecure\APcSecure.exe
%progfiles%\APcSecure Software\APcSecure\main_config.xml
%progfiles%\APcSecure Software\APcSecure\uninstall.exe

Even after a complete manual removal of apcsecure (or automated removal of apcsecure ) you should follow up with several more malware removal and antivirus scans until they come up clean. Make sure that for each you are making use of reputable applications for the scans.

ProtectSoldier followed right on the heels of ProtectDefender as another entry of rogue antivirus software in the notorious and prolific wini family of rogues. Like all of them it is installed via trojan horses and pushed via flash player updates and video codec downloads. Once installed on a system it will create numerous files to scan and then later claim are virus infected. Further it will run each startup and scan your computer claiming multiple security problems with your pc. It is at this point that it will tell you that in order to fix all the problems on your computer you must purchase this software. This is a scam…. read on for how to remove protectsoldier.

Among the alerts that this rogue pops up are:

Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of ProtectSoldier and remove spyware threats from your PC.

The first step you should take to remove protectsoldier or any other unwanted piece of software is to go to the control panel, add/remove programs and attempt to uninstall protectsoldier there. It may not be possible to do this, but is always worth a try with these rogues. Even if it works, continue to scan with a malware removal tool such as superantispyware or malwarebytes antimalware to clean the leftovers from your system. Next you should finish up with a scan from a trusted antivirus application and at this point you should have successfully removed protectsoldier.

If the above doesn’t work, your next best bet is to use the portable scanner from superantispyware to get rid of protectsoldier. You can find a download link for the portable scanner on my virus removal toolkit page. Once that is downloaded run a full scan and remove all the problem files that it finds. It will have a unique filename each time it’s downloaded so make sure to take note of the filename that is downloading.

If you need to make a manual removal of protectsoldier then you will need the following listing of filenames associated with protectsoldier:

%user%\Desktop\ProtectSoldier.lnk
%user%\Start Menu\Programs\ProtectSoldier.lnk
%progfiles%\ProtectSoldier Software
%progfiles%\ProtectSoldier Software\ProtectSoldier
%progfiles%\ProtectSoldier Software\ProtectSoldier\ProtectSoldier.exe
%progfiles%\ProtectSoldier Software\ProtectSoldier\Uninstall.exe

After any protectsoldier removal you should follow up with further malware removal scans and antivirus scans. Make sure that you make use of trusted tools such as malwarebytes or superantispyware for malware removal and trusted antivirus such as avg, avira, avast, etc. Free scanners and online scanners are okay, just make sure they have a good reputation.

ProtectDefender is yet another recent rogue antivirus application from the wini family. As with many of the other entrants from this family, it is installed through the use of bogus flash updates and purported video codec downloads. Typically a computer user will run across a site that claims to host a well sought after video and when they arrive at the page there is a claim that an extra video codec or flash player update in order to view the video. Once installed on the system it will create numerous files in c:\Windows and c:\windows\system32. These files are harmless, but it will later claim that these files are infected with viruses and other malware. It will also run at windows startup and claim that the only way to fix the problems on your system is to purchase the software. This is essentially a scam…. read on for how to remove protectdefender.

Among the alerts you will see on your system associated with protectdefender is the following:

Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of ProtectDefender and remove spyware threats from your PC.

If possible, the easiest way to remove this rogue is to go to the control panel and use the add/remove programs applet to uninstall protectdefender. If it works, congratulations – follow up this wonderful progress with a scan from a malware removal tool such as superantispyware or malwarebytes antimalware. Then follow THAT up with a trusted antivirus scan such as AVG/Avira/Trendmicro/etc.

If the uninstall didn’t work, that is not uncommon for these rogues, continue with the following to get rid of protectdefender: The easiest approach is likely now the portable scanner from superantispyware. There is a link to download it from the virus removal toolkit page. Once you have downloaded the portable scanner all you should need to do is run it. One of the advantages of the portable scanner for this purpose is that each download is given a different filename so make sure to note the name of the file as it downloads so you can find it after it downloads to run it.

If you need to perform a more manual removal of protectdefender you should note the following filenames associated with protectdefender:

%user%\Desktop\ProtectDefender.lnk
%user%\Start Menu\Programs\ProtectDefender.lnk
%progfiles%\ProtectDefender Software
%progfiles%\\ProtectDefender Software\ProtectDefender
%progfiles%\\ProtectDefender Software\ProtectDefender\ProtectDefender.exe
%progfiles%\\ProtectDefender Software\ProtectDefender\Uninstall.exe
%win%\10492zacktool650.dll
%win%\1059zwo5m236.ocx
%win%\10980haczt9ol3e5.bin
%win%\system32\3328downlo5dez11979.bin
%win%\system32\339zbackdoor1975.bin
%win%\system32\3499zir5s6ef.ocx

After all the above files are gone, you should follow up with another scan from a malware removal tool (malwarebytes antimalware and superantispyware are two good choices.) Also scan the system with a reputable antivirus. (AVG/Norton/Avira/Avast/McAfee/TrendMicro are among the names I would suggest to be used. This isn’t an exclusive list, but given the prevalence of rogues… you should be cautious and look for antivirus with a good reputation.)

Armor Defender is the latest rogue antivirus from the wini family of rogues. It takes a bit of a departure from the recent look of their rogues. However, like all of it’s other cousins in the fact that it is promoted by trojan, malware and they masquerade as flash updates that would be required to view a popular online video, but the payload is not a flash update, instead it’s the beginning of quite a bit of frustration as the computer starts to show many popups complaining of viruses on the machine, popups complaining of security deficiencies with the system and as if we couldn’t guess….. it can’t be fixed unless you purchase. Read on for how to remove Armor Defender.

There are a number of ways you may attempt to remove this rogue antivirus application from your computer. The first and easiest is to go to the control panel and then add/remove programs and uninstall armor defender. If you are able to uninstall from here, then you should also follow up with a scan from a trusted malware removal tool such as superantispyware or malwarebytes and then follow THAT up with a scan from a trusted antivirus application. Trendmicros online housecall would be suitable or a free antivirus such as AVG, Avira, avast are possibilities as well.

The next way you may seek to remove armor defender is to go to my virus removal toolkit page and from there download either malwarebytes antimalware or the portable version of superantispyware. If you download the portable version of superantispyware it will save to a new random file name, make sure to take note of the name. You should be able to use either of these to clean up. Malwarebytes may take a bit more work to get installed. If you are unable to install malwarebytes antimalware you may try the following: 1) rename the installer mbam-setup.exe to something else (firefox.exe). 2) reboot into safe mode with networking and then retry the install. 3) follow the next step which is killing off the running processes associated with armor defender and then retry the install of malwarebytes.

The following running processes should be killed off using task manager. If task manager is unable to launch then try the following. 1) copy and paste task manager to the desktop (taskmgr.exe) and then rename it to something like iexplore.exe. 2) reboot into safe mode and check to see if the programs listed are running – if not go ahead with your cleanup in safe mode. 3) use process explorer (on the same virus removal toolkit page) instead of task manager to kill off the following:

Uninstall.exe
armordefender.exe
RANDOM.exe (consult listing of file locations below and compare with what is on your system)

Some of the files reported to be associated with armor defender are listed below. Some may include randomization in their filenames and may not have exactly the filenames you see listed on your system. Please use this listing as well as what you see on your system to determine what should be deleted:

%user%\Desktop\ArmorDefender.lnk
%user%\Start Menu\Programs\ArmorDefender.lnk
%progfiles%\ArmorDefender Software
%progfiles%\ArmorDefender Software\ArmorDefender
%progfiles%\ArmorDefender Software\ArmorDefender\ArmorDefender.exe
%progfiles%\ArmorDefender Software\ArmorDefender\Uninstall.exe
%win%\1076zspa9bot475.cpl
%win%\1193z5py605.exe
%win%\1218bzckd9o5653.bin
%win%\122z5not-a-virus795.exe
%win%\system32\391dsz95are2473.exe
%win%\system32\3922tzr5at91349.ocx

After all of these have been killed off and deleted, even with a perfect manual removal of armor defender, then you should follow up with a complete scan from a reputable cleaner such as superantispyware or malwarebytes antimalware. Then perform a scan with a reputable antivirus such as AVG/McAfee/Norton/etc.