Severity scale:  

The fake Microsoft Security Essentials Alert. How to remove? (Uninstall guide)

removal by Jake Doevan - -   Also known as Microsoft Security Essentials Alert | Type: Trojans

The fake Microsoft Security Essentials Alert is a Trojan virus that impersonates the legitimate Microsoft Security Essentials antivirus program and states that your computer is infected with Unknown Win32/Trojan. This malicious software promotes five different fake anti-virus programs: Red Cross Antivirus, Peak Protection 2010, Pest Detector 4.1, Major Defense Kit and AntiSpySafeguard. The fake Microsoft Security Essentials Alert will state that it was unable to remove Unknown Win32/Trojan threat and will prompt you to install one of those five rogue programs to remove the infection which actually doesn’t even exist on your computer. Actually, it will display a list with 35 different antivirus programs, 30 of which are legitimate antivirus programs, but it let you install only the rogue ones.

Once the rogue program is installed, it will prompt you to reboot your computer. After the reboot, it will scan your computer for malware once again and will state that all found infections can be removed only with a full version of the program. That’s the main goal this malware – to trick you into purchased the rogue program. The scan results are false. You can safely ignore them. And, of course, don’t purchase any of those rogue programs. The fake Microsoft Security Essentials Alert and related rogue programs should be removed from the computer as soon as possible. However, if you already purchased it then you should contact your credit card company and dispute the charges.

There are two other every annoying things about this malware: it blocks task manager, registry editor and other legitimate programs and it also displays fake security alerts to scare you into thinking that your computer is infected with spyware, adware, Trojans and other malware. Some of the fake security alerts read:

The application taskmgr.exe was launched successfully but it was forced to shut down due to security reasons.
This happened because the application was infected by a malicious program which might pose a threat for the OS.
It is highly recommended to install the necessary heuristic module and perform a full scan of your computer to exterminate malicious programs from it.

Warning! Database updated failed!
Database update failed!
Outdated viruses database are not effective can’t guarantee adequate protection and security for your PC! Click here to get the full version of the product and update the database!

The fake Microsoft Security Essentials Alert and all those five rogues Red Cross Antivirus, Peak Protection 2010, Pest Detector 4.1, Major Defense Kit and AntiSpySafeguard should be remove from the system upon detection. It is obvious that this is a scam. Non of those programs will actually protect your computer against malicious software. If your computer is infected with The fake Microsoft Security Essentials Alert virus or any of those five programs please follow our removal instructions below to remove it from your computer either manually or with an automatic removal tool.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove The fake Microsoft Security Essentials Alert you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall The fake Microsoft Security Essentials Alert. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.
Press mentions on Reimage
The fake Microsoft Security Essentials Alert snapshot
The fake Microsoft Security Essentials Alert

The fake Microsoft Security Essentials Alert manual removal:

Kill processes:



Delete registry values:

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnonBadCertRecving" = "0"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "WarnOnPostRedirect" = "0"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "tmp"

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce "SelfdelNT"

HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon "Shell" = "%UserProfile%Application Dataantispy.exe"

Delete files:
%UserProfile%\Application Data\antispy.exe

%UserProfile%\Application Data\hotfix.exe

%UserProfile%\Application Data\tmp.exe

%UserProfile%\Local Settings\Temp\kjkkklklj.bat

About the author

Jake Doevan
Jake Doevan - Computer technology expert

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions

  • Dawson Lodge

    Why isnt the useless government finding these scumbags,
    putting them in jail, confiscating their computers,
    shutting down their money laundering accounts?
    Oh I forgot, they are too busy finding retards to set up
    for the next false flag event to expand their budgets………………..

  • Evil Monkey

    I feel for this and tried to download the thing it provided. But my Acer computer blocked it completely. I am currently running a scan with McAfee, and then looked this up with curiosity. Thank you so much. I freaked out because I have heard of the Java thing on the news. to me it didnt have one thing, it has three. One of them is some kind of Adware called WIN32.Fraud, another is a HackTool named WIN32/Welevate.A, and the last one is a Trojan called PSW.WIN32.launch. They are all fake I guess. I tried downloading some add-on for a game, and when Mediafire came up, that “Windows Security” came up. Probably hopped on my laptop from an add. Looks who isnt going on Mediafire for awhile…

    Thanks again! Going to tell my buddies from Deviantart!

  • Terry

    I had this virus today. The popup was suspicious since
    I had never installed MSE. I killed IE and ran a quick scan
    with McAfee which found and fixed one threat. I found none
    Of the files or registry entries mentioned above. Hopefully
    This problem is behind me.

  • Susan

    The fake Microsoft Security Essentials popped up on my computer but it looked suspicious to me, so I ran my real version and found no problems. Then I Googled the “fake MSE, etc., and found I was right. I never downloaded the thing and closed the tabs so I hope I dont have any more problems with it….???? I just hope its not still in my system. Can anyone tell me if there is anything else I need to do to make sure this is gone? Thank you.

  • vijay

    wht is hotfix,exe
    it is virus?

  • Dan

    my registry malicious process was called —-defender.exe—
    watch for that name anywhere

  • Jackie

    I had this today, did a system restore and its gone.

  • Vandyorga

    I Had this annoying type of virus too after I install program which I had downloaded fro, internet…After I delete some registry as shown…it works…thanks

  • Guest

    I have this problem, tried finding this file “hotfix” cant find. every program I open closes within 3-5 sec, can open internet, command prompt, task manager.. Help

  • Guest

    after more work i rezolve problem.
    I install another task manager (advanced task manager) and i have put in quarantine a proces named k856436.exe
    After this windows task manager start working.

  • I hate viruses

    I didn't click on anything except to close it on the “alert”. I can;t figure out how to remove it. I dont have anything saved as hotfix.exe. HELP!

  • BlueMage

    A client computer has been infected with this, and now I am unable to log-in to the %userprofile%/Application Data sub-dir to even look for the potential target files, from any user account, am going to try knoppix-boot to access the HD next, just from reading user posts.

  • Guest

    To end the process when task manager is blocked us command prompt tasklist and taskkill commands.

  • Guest

    it blocks my task manager no matter how I try to open task manager. Is there anything else I can do? it also blocks me going onto the internet.

  • Guest

    Mine was also under hotfix.exe I deleted the file and things seem to be back to normal. Thank you very much for your help.

  • More BS

    THey jsut want your money to delete the same things freeware deletes. Find another way!

  • Guest

    i mean wat i already had open

  • Guest

    help!!! when i deleted it all u could see was my backround and wat i already had deleted…plz help.

  • Guest

    A user got this virus and it too was named hotfix. I logged in under Safe mode and as administrator on the user's PC and was able to delete hotfix.exe. After removal I was able to run MalwareBytes and access the Internet.

  • Guest

    Mine was also named hotfix, in the application data folder. I dragged it onto the desktop, changed the name, and was able to delete it after a reboot.

  • Guest

    Mine was named hotfix.exe as well though it was not in a folder marked PAV it was just stuck in the application data folder. Also I couldn't locate anything in the run reg. that seemed malicious.

  • Guest

    Mine blocks Firefox , Task Manager, regedit, etc, you will need to download complete fix from another computer if this happens.

  • Guest

    Yes it is as of this date Oct 4 inamed hotfix in the usersroaming directory. Use windows explorer to get to c: windows system32 to invoke task manager, since it blocks that program. It will still try to stop deletion asking for an administrator but when moved to a flashdrive can be deleted.

  • sbarbarino

    I also just ran into this thing and it was hotfix.exe i the application data folder. This fix should be udated. I signed into the system using another profile and removed the hotfix.exe file.

    Deleted registry files and all was fine.

  • Guest

    Thank you so much!! My program was also listed as hotfix.

  • Boomer

    I recently had this virus and used this guide to get rid of it but on my computer it showed up as hotfix.exe in the application data folder. Finally found out that was it and got rid of the dang thing.