Remove Spyware Protection

so i made it to application data on a windows xp the thing is its not a 8 digit number or anything i cant seem to find where it is. please help this is a family computer and i really need it back.

Did you already try the other path listed in the guide? What about the msconfig menu or right clicking on the dekstop icon and selecting properties? We show a few tricks in the video on how to help locate it.

Please reply back with the the full path to were you are looking. I want to ensure you are in the right location.

On my computer (Windows XP Pro SP2) the executable file was named:
C:\Documents and Settings\[Username]\Application Data\defender.exe

Many thanks for this helpful information!

Boot into safe mode or use an alternate method

my task manager says its being blocked and i also tried to download killprocess and it wont work.

Thanks for your help. I finally got rid of this little bug. Your video helped alot.

I appreciate the help. I have a Macbook and spyware was on my Bootcamp side. I did as others and renamed the SPW to pileofshit. I had a problem deleting the larger application. For some reason Safe Mode does not work on my bootcamp side, so I relocated the POS appto my desktop so I could find it easily later. I then shut down and went back to my MAC side and looked at thru my windows hardrive and located the POS app on my desktop and dragged it to my trash can on my MAC side. Worked great.

What is your OS? If it’s Vista or Win 7 please follow the guide and video that shows you how to access the AppData Folder.

You should boot into safe mode with networking and update your antivirus client and try the scan there. If it does not pick this threat up then do as the guide recommends and download / install Spyware Doctor with Antivirus and run a scan. From there it will show you EXACTLY were the threats are and you can then manually browse to that location and delete the virus.

I tried task manager and safe mood without good results. Finally I deleted using the task manager. I think that the virus need a few seconds when you restart the computer so if you open de task manager fast and you know the name of file (defender.exe) then you have higher chances of killing the process.

Thank you for your help and comments very helpful.

Hi, I tried doing Tactic 1, 2 and 3 but the virus is still on my computer!!!

I have Windows Vista and Bullguard Antivirus (not updated and now cannot open because of the virus).
Task Manager would not open. I tried to locate the files: I couldn’t find any called Spyware but there were a few with the programmes logo on so i renamed, restarted and sent to the recycle bin (which I cannot find now) and the virus is still on here tried safe mode but couldnt find the AppData folder at all… PLEASE HELP

Hannah

Just an FYI: The virus threat will not be running in safe mode. That is why if you use the Task Manager there it will not show up. In normal mode, your are correct. You have several seconds from when you first log-in to when this threat actually starts. So if you start the Task Manager right after you log-in you will be able to delete this threat providing you know what to look for.

Still I recommend most people follow the guide and video for best results.

Any ideas where i can find my /application data/ folder on XP? I’m stuck on step 2

thanks

I found the application data folder, didn’t think anything was hidden in the folder, but i found it. yay!!

First of all, I cannot open my task manager. But when I tried to remove the virus using your alternate options, I couldn’t because the spyware protection (defender.exe) file itself could not be found on my computer, and I have no way of deleting or disabling it. It is not on my desktop or my start menu. There isn’t even a file in my computer named “appdata” My operating system is Windows 7 and i currently do not have a full anti-virus software installed. Please help!

Most people will not be able to use the task manager till they stop the executable from running.

Your OS is Windows 7 so you do have a folder called AppData. As mentioned in the video it’s a hidden folder so you can either manually type in the path shown in the guide or copy and paste it in from the guide. Just change out the user name.

So the path would look like C:\Users\Jacob\AppData Take note. Jacob is my user name.

Now follow the rest of the guide and let us know if you have any other questions. Be sure to scan your computer in the end using a good antivirus client like Spyware Doctor with Antivirus.

Please help me!

I’m trying over and over but it won’t allow me to start the Task Manager. I search for it and it’s not there. All the recommended pathways for deleting it are blocked. I don’t know what to do but it’s annoying!

What is the folder path you are looking in? What is your OS?

On my computer (Windows XP Pro SP2) the executable file was named:
C:\Documents and Settings\[Username]\Application Data\defender.exe

Wow who ever made this needs to be dragged through the streets and have salt poured on them!!

Thanks for the info on how to remove it.

I had a bit of experience with these programs before, so I was lucky, and when I restarted my computer, I deleted all running programs that looked suspicious, and mine was called defender.exe While the programs was running, I couldn’t even open my Firefox so I had no idea where the program was, but your guide helped me find it.

—Note— Windows Vista OS, mine was in C:\Users\Felixan\AppData\Roaming, not the Local Temp folder. Anyway, my question is, is there a small backup program I can install and run if I get this problem again? I have the free vers. of AVG but that didn’t seem to stop it. I don’t have the money to pay for a anti-virus, is there something I could install in AVG to stop this?

Glad we were able to help.

Free clients do not provide enough protection so that answer is no. All free clients are behind on updates and most have limited features compared to the full version. You would need to purchase an antivirus client to be protected.

I watched your video and I tried every step but my task manager, system configuration, regedit and typing in the file name in computer all failed because they are blocked. Is there another method?

This guide was pretty easy to follow and it looks like I have removed my threat for now.
My Spyware exe file was called:
0.8063996663563485.exe
and was located at:
c:\users\{username}\appdata\local

I am using a win7 32bit

i am currently having problims geting the program off my computer it wont let me open the task manager and when i do open it on safe mode ther is no way of finding the program i have read the full guide and sofar it cant help me i have 2 free anti virus softwars on my computer one is avg and the outher one is supper anti spyware free adiction

Manually browse down to the file location shown in the guide or in the user comments and view files by date modified. You should be able to see only a few folders that have been modified in the last few days that you had the infection. From there you will be able to determine the name of the threat from the guide and re-name it. Then re-boot and delete the file.

FYI: AppData\ is a hidden folder. You will have to show hidden files and folders to view it. That or just manually type the path in and be good.

Regards,

Jacob

Great Update hockeyguy. The latest file path will be added to the guide.

Many thanks

This “Spyware Protection” cannot be deleted from my computer, I cannot search it, I cannot exit it or anything. It blocks me from running system restores, Task Manager, anything that could delete it, is there any other way I can get rid of this piece of shit??

Follow the guide. That’s the best advice I can offer.

If you have any questions related to the guide, please state what you have already done and what exactly you are stuck trying to do. Naming your OS and current security client also helps.

Thanks for your great effort. I am using 64bit windows7 and am not able to:

1. start task manager.
2. find the icon on desktop.
3. search the executable file.

However, based on your instruction, I located “defender.exe” under “c:\users\{username}\appdata\local\roaming” manually.

By the way, do you know why I login as another user and am not able to find this virus when I do a full scan with McAfee.

Thanks,

Fan

It works.

McAfee is not picking up the trace because it does not know it’s there. Plain and simple it’s not been updated to know how to remove this threat. What I would wonder is why this threat was not blocked in the first place by them. If you had it installed and it got through then that is a clear sign your protection is lacking.

Regards,

Jacob

i followed your instructions for vista/7 and found the file in c:\users\(username)\appdata\ it was called “defender” with a shield as an icon. i renamed it in safe mode then rebooted and deleted it. my computer is now virus free.

I know that i am not supposed to do this but last night after this virus first poped up, i restored system to original settings, and it wen’t away. But today the virus poped up again, unfortunately i had only installed the free version of spyware doctor which does not block this. so i got on to this website and followed the steps in the video. there was no desktop icon so i skipped that, there was no start tab(?) icon so i skipped that, then i found the file in the appdata/roaming. but i deleted it without renaming it and removed it deleted it permanently from recycle bin. i also deleted the hkey file that was shown in the video. i scanned now with spyware doctor and nothing was found (paid version). BUT, the virus is still active.

when I start up this program would pop up and it would only give me enough time to end it with the task manager

my system is the acer mini lap top

I installed microsoft security essentials free

and I’m on step 1 tactic 2, but I cannot find the file anywhere besides the hidden icons which disappears after I end the task. how do I locate the actual file if it’s there? and what should I do to remove it?

My OS is windows XP.

I can’t start task manager, can’t use firefox, AVG won’t load, I can’t download/install new programs.

The search feature won’t find defender.exe.

Manually typing in the file path doesn’t work.

Please help obi-wan kenobee, you are my only hope.

i’m comment number 29. when i was infected with this virus and the webpage poped up requesting that i buy there program, i decided to contact support.
this is the reply they sent me

> Szymon F wrote:>> explain to me how to remove this program. i not want this anit-virus and it does not allow me to do anything on my laptop.
>Hello Dear friend!I am really sorry that your computer has been infected. So, these pop-ups and are not the part of our product,they are a some kind of a virus from the internet and don’t belong to our program. It was done by our advertisingpartner and he’s already banned.This program will be self-removed in 6 days. There would be no problems after it is deleted.Also you can just set date and time setting in your windows control panel 6 days later according to current date. Then restart your system to disable program. let me know please if you have any other problems.Thanks and have a great day!

i finally got rid of the virus though, I will return to this website in the future if i geet infected.

Don’t let them fool you. They are lying about their program.

However it’s very interesting to hear about setting the clock forward 6 days. I will have to test this out with new rouges and see if that solution works.

I thank you for your comment and taking the time to help others out.

First can I just say what a fantastic resource you have created here. I spent an hour or so watching the video and reading all the entries. However, by way of contributing I thought it might be useful if I explained how I solved my XP Anti-Virus problem.

I did spend a lot of time checking for the files you mentioned but I could find no physical install. Could this be because no one clicked on any of the pop up windows?

On checking the Task Manager the file that seemed to be controlling the pop ups was snu.exe.

It had effectively locked me out of and i couldn’t install anything to remove the malware.

However, by stopping the *.exe file I did manage to set up a restore system run which did remove the infection.

I am in the middle of a complete scan with Malwarebytes as I write this, but the mere fact that I could install the software seems to indicate a clear computer.

Once again many thanks for all the work you have done it is a great resource..

I run Vista.

I watched your video on how to remove “Spyware Protection”. You are a truly wonderful person doing amazing work. I would have been left clueless had I not watched you tutorial.

Contrary to your video, the executable actually did not leave an icon on my desktop, but i did have sucess in locating it by finding and following the path as you instructed.

I cannot thank you enough.

My friend’s lap-top, running Windows 7, has been infected by Spyware protection. It is running Macafee but since I can’t open Macafee I don’t know the version.
1 Task Manager is closed immediately
2 Mozilla Firefox is closed immediately
3 Regedit is closed immediately
4 Users>Username>Application data is inaccessible even though I have changed permissions
5 Defender does not appear in Windows>System32
6 Scheduled tasks is closed immediately
7 IE8 will open but will close if I try to download anything
8 MalwareBytes closes immediately
9 System Restore closes immediately
How else can I a) find it and b) disenable it?

Follow the guide. Your issues are normal for anyone infected with this threat. Ask specif questions and be sure to let us know what step in the guide you are having troubles with

Also as the guide shows. There is not folder called “Application data” in Windows 7, that is why you can not go into it. The guide clearly shows the correct folder you should go into. Please read the guide again