XP Defender - How to remove

XP Defender (also called as XPDefender) is a fake computer security application which claims to be capable to remove all the cyber threats “detected”. XP Defender shows continuous system scanners at the beginning of its malicious activity and then reports hundreds of viruses that all in truth are invented and do not pose any harm. After making people scared, only the full version of XP Defender is offered them to purchase. Don’t act like XP Defender recommends because you will only grant your money for its creators and install another virus into your machine.

XP Defender infects Operating Systems through security vulnerabilities used by Trojans infections. When inside, these trojans install ave.exe file, which launches badware instead of any other process users want to launch. When inside, XP Defender is configured to start automatically when Windows starts and also begin instead of FireFox or Internet Explorer. Additional activity of XP Defender is showing fake system scanners and fabricated messages that announce variety errors and virus problems. The main reason of giving this misleading information is making users purchase XP Defenders’ so called full version because only the paid version is promised to handle with “detected” cyber threats.

It is obvious that people are clearly pushed into giving their money away for the virus. XP Defender is not capable to detect any actual threat because there is no such engine inside. This malware only misleads its victims into thinking their computers have multiple security issues, so do NOT believe the results it gives. XP Defender must be removed from the system, so get a reputable anti-spyware for that. Delete XP Defender and don’t support its creators that only try to sell a scam. Use this removal guide:

Updated 2012.12.27
Current version of XP Defender stops all processes aggressively.
To remove it, you will need to stop its process first:
1. Open its folder ( C:\Documents and Settings\All Users\Application Data\pcdfdata\ typically)
2. Rename its executable
3. Reboot, scan with spyhunter

Automatic Malware removal tools

Download Spyhunter for Malware detection
(Win)

Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,

Download Combo Cleaner for Malware detection
(Mac)

Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,

Manual removal

Processes:

%AppData%\\ave.exe C:\\Documents and Settings\\All Users\\Application Data\\pcdfdata\\scan.exe or [random]

Files:

%AppData%\\ave.exe %Appdata%\\pcdfdata\\[random]

Registers:

HKEY_CURRENT_USER\\Software\\Classes\\.exe\\shell\\open\\command “(Default)” = “%UserProfile%\\Local Settings\\Application Data\\ave.exe” /START “%1? %* HKEY_CURRENT_USER\\Software\\Classes\\secfile\\shell\\open\\command “(Default)” = “%UserProfile%\\Local Settings\\Application Data\\ave.exe” /START “%1? %* HKEY_CLASSES_ROOT\\.exe\\shell\\open\\command “(Default)” = “%UserProfile%\\Local Settings\\Application Data\\ave.exe” /START “%1? %* HKEY_CLASSES_ROOT\\secfile\\shell\\open\\command “(Default)” = “%UserProfile%\\Local Settings\\Application Data\\ave.exe” /START “%1? %* HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\FIREFOX.EXE\\shell\\open\\command “(Default)” = “%UserProfile%\\Local Settings\\Application Data\\ave.exe” /START “C:\\Program Files\\Mozilla Firefox\\firefox.exe” HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\FIREFOX.EXE\\shell\\safemode\\command “(Default)” = “%UserProfile%\\Local Settings\\Application Data\\ave.exe” /START “C:\\Program Files\\Mozilla Firefox\\firefox.exe” -safe-mode HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\IEXPLORE.EXE\\shell\\open\\command “(Default)” = “%UserProfile%\\Local Settings\\Application Data\\ave.exe” /START “C:\\Program Files\\Internet Explorer\\iexplore.exe” HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center “AntiVirusOverride” = “1? HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center “FirewallOverride” = “1?