Title: System Defender

Type: Rogue Antispyware

Remove System Defender. Removal instructions

Also known as: SystemDefender

Severity scale:

(72 / 100)

System Defender is a misleading anti-spyware application that reports false or exaggerated system security threats, displays fake security alerts and uses browser/desktop hijacking techniques to make you think your computer is infected with a whole variety of malicious software. Once installed, the rogue program will prompt you to pay for a full version of the program in order to remove the threats which actually don't even exist. System Defender is just another scam, so be careful about it. Most importantly, do not purchase this program. Then, uninstall System Defender from your PC as soon as possible. Removal delay will only worsen the situation.

System Defender is a new version of the rogue application called Windows System Defender. This program uses Windows OS style and Microsoft's graphics, visual elements to make it look more reliable or to make people think that this is actually a part of Windows operating system. That's obviously not truth. System Defender is usually promoted through the use of fake online scanners, misleading advertisements or websites. The scammers also use social engineering techniques to distribute the rogue application. Systemmdefender.com [Figure 2] is the home page of this malware. It is a clone of windowssystemdefemder.com. Both website are potentially harmful so do not visit them.

When running, the program will creates certain registry entry so that it executes whenever Windows starts. Then System Defender will create several harmless files on your computer which later will be detected as serious security threats or infections. Those files are used very often by other rogue applications: ANTIGEN.dll, ANTIGEN.sys, ANTIGEN.tmp, cid.dll, CLSV.dll, ddv.tmp, PE.dll, PE.drv, PE.sys, ppal.exe, runddlkey.drv, std.sys, tempdoc.dll, tjd.exe, tjd.sys.
Next, SystemDefender will imitate system scans and report numerous infections that can't be removed unless you first purchase the program. Please note that the program uses real names of existing infections. The scammers steal those names from reputable anti-virus/security websites. Some of the reported infections you may see:

Trojan-SMS.J2ME.RedBrowser.a
Virus.Win32.Faker.a
Trojan-Spy.Win32.WMPatch
Trojan-Spy.HTML.Citifraud
Trojan-Spy.HTML.Sunfraud.a
Packed.Win32.PolyCrypt
Trojan-PSW.Win32.Antigen.a
BAT.Looper
Trojan-PSW.Win32.Delf.d

Last but not least, System Defender will display fake security alerts stating that your computer is infected or under attack. It will impersonate Windows Security Center too. The fake one is called Windows Advanced Security Center. No doubt, this misleading application must be removed as soon as possible. Please use the removal guide below to remove System Defender from the infected computer manually for free. If you have already purchased the rogue program, you should contact your credit card company and dispute the charges. Finally, scan your PC with a legitimate anti-spyware application like Spyware Doctor and remove the remains of this program or additionally downloaded malware.

Related files: search.xml, tjd.sys, tjd.exe, tempdoc.dll, std.sys, runddlkey.drv, ppal.exe, PE.sys, PE.drv, PE.dll, ddv.tmp, CLSV.dll, cid.dll, ANTIGEN.tmp, ANTIGEN.sys, ANTIGEN.dll, vd952342.bd, sqlite3.dll, mozcrt19.dll, 68.mof, Instructions.ini, cookies.sqlite, System Defender.lnk, wsd.cfg, WSD.ico, WS339.exe

System Defender properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Stays resident in background

System Defender snapshot:

Automatic System Defender removal:

remover for System Defender

SpyHunter is recommended remover to uninstall System Defender. You should confirm using free trial that it detects current version of parasite.

Note: Tested and Confirmed means that we have tested spyware remover with multiple versions of System Defender and got the best results. There might be updated or modified version of particular parasite that require manual killing of parasite process or an update. In such case try other removers in the line.

Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove System Defender using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

Tested and Confirmed! STOPzilla removes System Defender (2009-11-16 00:31:03)

Malwarebytes Anti Malware

download | review

Tested and Confirmed! Malwarebytes Anti Malware removes System Defender (2009-11-16 00:31:03)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing System Defender (2011-03-09 13:23:23)

XoftSpySE Anti Spyware

download | review

System Defender manual removal:

FORUM:
Discuss System Defender in
spyware removal forum

Kill processes:
WS339.exe ppal.exe tjd.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CLASSES_ROOTCLSID{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOTxp_7a9be.DocHostUIHandler
HKEY_CURRENT_USERSoftwareClassesSoftwareMicrosoftInternet ExplorerSearchScopes "URL" = "http://search-gala.com/?&uid=220&q={searchTerms}"
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "RunInvalidSignatures" = "1"
HKEY_CLASSES_ROOTSoftwareMicrosoftInternet ExplorerSearchScopes "URL" = "http://search-gala.com/?&uid=220&q={searchTerms}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun "System Defender"

HELP:
how to remove registry entries

Unregister DLLs:
mozcrt19.dll sqlite3.dll ANTIGEN.dll CLSV.dll PE.dll tempdoc.dll

HELP:
how to unregister malicious DLLs

Delete files:
WS339.exe WSD.ico wsd.cfg System Defender.lnk cookies.sqlite Instructions.ini 68.mof mozcrt19.dll sqlite3.dll vd952342.bd ANTIGEN.dll ANTIGEN.sys ANTIGEN.tmp cid.dll CLSV.dll ddv.tmp PE.dll PE.drv PE.sys ppal.exe runddlkey.drv std.sys tempdoc.dll tjd.exe tjd.sys C:\Program Files\Mozilla Firefox\searchplugins\search.xml

HELP:
how to remove harmful files

Delete directories:
c:Documents and SettingsAll UsersApplication Data[RANDOM DIRECTORY NAME]
c:Documents and SettingsAll UsersApplication Data117fc
%UserProfile%Application DataSystem Defender
%UserProfile%Desktop[RANDOM DIRECTORY NAME]
%UserProfile%Desktopxp_7a9be

Information added: 2009-11-16 00:31:03
Information updated: 2011-03-09 10:46:08

Additional resources related to System Defender:

Attention: If you know or you have a website or page about System Defender removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about System Defender parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Related discussions:

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.