1 of 2
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Can't be uninstalled via Control Panel
  • Blocks system files from running
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Shows commercial adverts
  • System crashes
  • Annoying Pop-up's
  • Slow Computer

Windows Defence Master

Windows Defence Master is a dangerous rogue antispyware application that has been created to steal your money and destroy your computer. It looks and behaves like a genuine antivirus application. Windows Defence Master may look like a genuine security program that can help you protect your PC from dangerous infection. Unfortunately, it is a dangerous infection itself, so you need to remove Windows Defence Master as soon as possible. If you fail to get rid of Windows Defence Master on time, you may experience devastating malware infection consequences.

This application might have arrived on your computer via various distribution methods. Windows Defence Master can be distributed via spam email attachments, social engineering and even Trojan infections. It means that your computer might have been infected with malware prior to Windows Defence Master entering the system. However, once this rogue gets installed on your computer, it will spring into action immediately running a fake system scan and then spamming you with a number of fake security notifications. Everything is done in order to convince you into spending your money for nothing.

Needless to say, that you should never spend a single cent on Windows Defence Master. The criminals behind this infection merely want to get a hold of your financial information, so that they could little by little steal all of your money. Close the program at once and then invest in a powerful computer security application that will help you remove Windows Defence Master once and for all. Make sure that the likes of Windows Defence Master never enter your computer again.

Windows Defence Master is a clone of the recently reported fake AVs from the Rogue.VirusDoctor family. The infection mimics Windows Security Master, Windows Defence Unit, Windows Protection Tool and hundreds of other clones. Even though these threats use different names, all of them use the same interface, which is why malware researchers have no trouble identifying them as malicious. If you do not install automatic malware removal software to guard the system or to delete Windows Defence Master in time, many system’s executable files will be blocked. Due to this, you will not be able to connect to the Internet, install automatic malware removal tools or delete the infection quickly. Unfortunately, many computer users fall for the fictitious scanner reports or pop-up warnings (see below) and purchase the full version of the bogus security program. Needless to say, this is not something you should do.

Potential malware detected. It is recommended to activate the protection and perform a thorough system scan to remove the malware.

Instead of activating the fictitious malware remover, you should install authentic security software to remove Windows Defence Master and ensure further Windows protection. Unless you are experienced with dangerous computer infections, we do not recommend proceeding with the manual removal. Use the instructions below to install a reliable security application which will help you delete all existing infections. You can also try to activate the full version of the rogue anti-spyware using a special license key displayed below. Once the key is entered into the registration area, all symptoms should be disabled and you will be able to install automatic malware removal software to delete the existing threat.

License key:

Remove Windows Security Master

  1. Restart the computer to begin the process.
  2. As soon as BIOS loads up – start tapping F8.
  3. Use arrow keys to select Safe Mode with Command Prompt.
  4. Tap Enter on the keyboard to confirm your selection.
  5. In the command prompt place the cursor after the C:\Windows\system32\ line.
  6. Type cd.. and tap Enter. You will find the C:\Windows line appear.
  7. Now type explorer.exe and tap Enter again.
  8. Navigate to the left of the Task Bar and click Start.
  9. Click RUN/Search and type %appdata%. Tap Enter.
  10. Right-click svc-[random file name].exe and select Delete.
  11. Restart the computer in the Normal Mode.
  12. Click RUN/Search in the Start menu once again.
  13. Enter regedit and tap Enter to access the Registry Editor.
  14. Go to HKEY_CURRECT_USER\Software\Microsoft\Windows NT\Current Version\Winlogon.
  15. Right-click the Shell and select Modify.
  16. Locate the Value Data box, enter %WinDir%\Explorer.exe and click OK.
  17. Now launch a browser and go to http://www.pcthreat.com/download-sph .
  18. Download and install a legitimate malware remover SpyHunter.
Download Spyware Removal Tool to Remove* Windows Defence Master
  • Quick & tested solution for Windows Defence Master removal.
  • 100% Free Scan for Windows

How to manually remove Windows Defence Master

Files associated with Windows Defence Master infection:

%AllUsersProfile%\Start Menu\Programs\Windows Defence Master.lnk
%UserProfile%\Desktop\Windows Defence Master.lnk

Windows Defence Master processes to kill:


Remove Windows Defence Master registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "%AppData%\svc-[random].exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = 1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "MS-SEC" = %AppData%\svc-[random].exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "S_SC" = %AppData%\svc-[random].exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ZSFT" = %AppData%\svc-[random].exe
HKEY_LOCAL_MACHINE\Software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\k9filter.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableVirtualization" = 0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\bckd "ImagePath" = 22.sys

Post comment — WE NEED YOUR OPINION!

Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.