Windows Vista Blog

Advanced Defender is a rogue software application that has been cloned from the well known fake anti-spyware programs Personal Guard 2009 and Personal Detector. It uses the same scare tactics as its relatives to scare the user into buying a license to the software. Advanced Defender gets installed on user’s system via malicious software and Trojans that get automatically downloaded from dangerous websites. Once installed, Advanced Defender blocks any legitimate antivirus software that the user may have installed, in addition to performing fake system scans and warning the user that the system is heavily infected with viruses and malicious software. Meanwhile, Advanced Defender repeatedly asks the user to purchase the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is incapable of removing the detected ‘threats’. However, it is important to remember that the so-called ‘full’ version of Advanced Defender is just as incapable of scanning your computer as the ‘trial’ version is.

As soon as you find a copy of this rogue software on your computer, you should take steps to delete Advanced Defender. In order to do this, you must stop its processes, unregister its DLLs, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step that needs to be taken to delete Advanced Defender is to stop the following processes:

• advanceddefender.exe
• certofsystem.exe
• explorers.exe
• regp.exe
• spoos.exe
• winscent.exe

The next step in Advanced Defender file removal is to unregister the following DLL file:

• microsoftdefend.dll

Next, for proper Advanced Defender removal, delete the following files and folders:

• c:\Program Files\Advanced Defender
• c:\Program Files\Advanced Defender\advanceddefender.exe
• c:\Program Files\Advanced Defender\base.wdb
• c:\Program Files\Advanced Defender\baseadd.wdb
• c:\Program Files\Advanced Defender\conf.wcf
• c:\Program Files\Advanced Defender\quarant.wdb
• c:\Program Files\Advanced Defender\q
• c:\WINDOWS\certofsystem.exe
• c:\WINDOWS\explorers.exe
• c:\WINDOWS\microsoftdefend.dll
• c:\WINDOWS\regp.exe
• c:\WINDOWS\secureit.com
• c:\WINDOWS\spoos.exe
• c:\WINDOWS\system32\winscent.exe
• c:\Documents and Settings\All Users\Microsoft PData
• c:\Documents and Settings\All Users\Microsoft PData\track.wid
• %UserProfile%\Desktop\Advanced Defender.lnk
• %UserProfile%\Start Menu\Programs\Advanced Defender
• %UserProfile%\Start Menu\Programs\Advanced Defender\Advanced Defender.lnk

Once these steps have been completed, Advanced Defender no longer resides on your file system. However, it is recommended to conduct a full system scan using genuine antivirus software such as Spyware Doctor with Antivirus at this point in order to make sure that no additional malware remain behind.

Registry Removal Procedures

Removing files and folders alone is not sufficient to completely delete Advanced Defender. You must remove the following keys and settings from the registry as well:

• HKEY_LOCAL_MACHINE\SOFTWARE\Advanced Defender
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Defender
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = “1″
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “advanceddefender”

Once the registry has been cleaned, your computer is safe from Advanced Defender.

Conclusion

Inexperienced users should not attempt to delete Advanced Defender manually, as any mistake made on your part could damage the system. Therefore, inexperienced users are advised to use a web-based repair service such as www.onlinecomputerrepair.org in order to properly delete Advanced Defender.