Home Malware Programs Rogue Anti-Spyware Programs Windows Defence

Windows Defence

Posted: September 6, 2010

Windows Defence is a rogue security program which spreads via the Internet by using Trojans and fake online security websites. Windows Defence is installed on victim computers without the user's approval. It will secretly enter the system before modifying settings and registry entries to have itself run whenever Windows is operating. Once active, computer users may experience constant security alert pop-ups advertising Windows Defence. Windows Defence runs its own virus scan which detects false threats on the computer to mislead users into getting the licensed version of this useless program. Windows Defence poses a huge security threat to PC safety and should be terminated immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Local Settings\Application Data\\
    2 c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\smmservice.exe
    3 c:\Documents and Settings\All Users\Application Data\mswd\Base.dat
    4 c:\Documents and Settings\All Users\Application Data\mswd\db.avdb
    5 c:\Documents and Settings\All Users\Application Data\mswd\DefenceCenter.exe
    6 c:\Documents and Settings\All Users\Desktop\ Defence Center .lnk
    7 c:\Documents and Settings\All Users\Start Menu\Programs\Defence Center\ Defence Center .lnk
    8 c:\Documents and Settings\All Users\Start Menu\Programs\Defence Center\Uninstall\Uninstall.lnk
    9 c:\protocol.log

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_USERS\.DEFAULT\Software\DefenceCenterHKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\smmservice

Related Posts

3 Comments

  • shashi kanth kangayam says:
    March 8, 2011 at 2:12 pm

    thank you for the detailed scripts

  • christian says:
    May 28, 2012 at 2:52 am

    ok so this thing called "windows defence counsel entered my sister's laptop, and she doesnt download anything but this virus is just killing her laptop,i have run many tests on it, like: it brings up the pop-up every 3min.38sec. and as soon as you open the internet it pops up as soon as you do, so in other words, i want to know how to kill it and end it, becasue i dont want her spending $100 to download the "safety feature" its seems to me like a bunch of bull $h1- i have been working to solve this for 2 days and a full night so if you could please help me out! and if you do name it "kill the virus" thank you!

  • james dickson says:
    June 24, 2012 at 12:04 pm

    i want windows pro releif removed from my computer

Loading...