Click on screenshot to zoom
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Blocks internet connection
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • System crashes
  • Annoying Pop-up's
  • Slow Computer
  • Shows commercial adverts
Infection Video Windows Active Defender

Windows Active Defender

To keep your computer safe and your money protected, you need to be aware of the true Windows Active Defender intentions, and if this fake security tool is already inside your system, you should not wait any longer to remove it from your Windows system. Such drastic measures are required because Windows Active Defender pretends to be an antispyware program, which rushes you to purchase its full version to have all infected files deleted. However, all of this is just a scam, and everything, from its invasion to its removal tool, is not only highly unlawful, but also cannot offer you any beneficial services!

Windows Active Defender can be distributed in various ways; from spam email attachments to social engineering scams, from encrypted downloads to fake video codecs, etc. Such security cracks can be found in your system, if you do not own legal security software or keep it updated, so make sure you fix that, once Windows Active Defender gets deleted. Inside a computer, this bogus application can cause tremendous changes to your OS, and system crashes, Internet disconnection, or slower PC performance, are amongst many possible symptoms, which are meant to distract you from having Windows Active Defender removed! Besides that, various computer scanner reports and other fake notifications, popping from the Task Bar, will continue reappearing, and forcing you to believe the fictitious infection.

You should not let Windows Active Defender control your system, because this malicious program cannot delete any true infections, and instead can only let other malware infiltrate faster. So, hurry up and install automatic removal tools, which will deal with the task in only a few minutes. Windows Active Defender manual removal is not an easy task, and most professionals detect it as highly demanding, so we recommend trusting legal tools to delete Windows Active Defender for you!

UPDATE

Windows Active Defender is part of the Rogue.VirusDoctor family, which is held responsible for releasing such computer viruses as Windows Instant Scanner, Windows Privacy Counsel and Windows Custom Safety. The newly released, dangerous infection can remove your access to Registry Editor and Task Manager, block the running of most executable files, and disable your Internet connection. These disturbances are meant to hide the rogue from being detected and deleted, but you can remove the symptoms, once you activate this license key:

0W000-000B0-00T00-E0020

Together with all irritating symptoms, the key will also remove such deceitful security notifications:

Error
Potential malware detected.
It is recommended to activate protection and perform a thorough system scan to remove the malware.

Error
Software without a digital signature detected.
Your system files are at risk. We strongly advise you to activate your protection.

Warning! Spambot detected!
Attention! A spambot is sending viruses from your e-mail has been detected on your PC.
Yes, protect my PC and remove spambot now (Recommended)

Recommended:
Please click “Remove all” button to erase all infected files and protect your PC

Download Spyware Removal Tool to Remove* Windows Active Defender
  • Quick & tested solution for Windows Active Defender removal.
  • 100% Free Scan for Windows

How to renew your internet connection:

This rogue antispyware blocks your Internet connection to prevent you from removing the rogue application. To enable the Internet connection, please follow these instructions:
  1. Open Internet Explorer and go to >Tools< select >Internet Options<

  2. Select >Connections<

  3. Select >LAN Settings<

  4. Now you need to uncheck the checkbox labeled >Use a proxy server for your LAN< in Proxy Server section. Then press the >OK< button to close this screen and press the >OK< button to close the Internet Options screen.

  5. Now you can download the SpyHunter scanner and remove the infection.

Download Spyware Removal Tool to Remove* Windows Active Defender
  • Quick & tested solution for Windows Active Defender removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Active Defender

Files associated with Windows Active Defender infection:

Windows Active Defender.lnk
Protector-wcsf.exe
%AppData%\NPSWF32.dll
%AppData%\Protector-[Random].exe
%AppData%\result.db
%AppData%\1st$0l3th1s.cnf
%CommonStartMenu%\Programs\Windows Active Defender.lnk
%Desktop%\Windows Active Defender.lnk

Windows Active Defender DLL's to remove:

%AppData%\NPSWF32.dll

Windows Active Defender processes to kill:

Protector-wcsf.exe
%AppData%\Protector-[Random].exe

Remove Windows Active Defender registry entries:

HKEY_CURRENT_USER\Software\ASProtect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "otbpxlqhjd"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe
Disclaimer

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.