- Can't be uninstalled via Control Panel
- Blocks system files from running
- Block exe files from running
- Installs itself without permissions
- Connects to the internet without permission
- Shows commercial adverts
- System crashes
- Annoying Pop-up's
- Slow Computer
Windows Defence Master
Windows Defence Master is a dangerous rogue antispyware application that has been created to steal your money and destroy your computer. It looks and behaves like a genuine antivirus application. Windows Defence Master may look like a genuine security program that can help you protect your PC from dangerous infection. Unfortunately, it is a dangerous infection itself, so you need to remove Windows Defence Master as soon as possible. If you fail to get rid of Windows Defence Master on time, you may experience devastating malware infection consequences.
This application might have arrived on your computer via various distribution methods. Windows Defence Master can be distributed via spam email attachments, social engineering and even Trojan infections. It means that your computer might have been infected with malware prior to Windows Defence Master entering the system. However, once this rogue gets installed on your computer, it will spring into action immediately running a fake system scan and then spamming you with a number of fake security notifications. Everything is done in order to convince you into spending your money for nothing.
Needless to say, that you should never spend a single cent on Windows Defence Master. The criminals behind this infection merely want to get a hold of your financial information, so that they could little by little steal all of your money. Close the program at once and then invest in a powerful computer security application that will help you remove Windows Defence Master once and for all. Make sure that the likes of Windows Defence Master never enter your computer again.
Windows Defence Master is a clone of the recently reported fake AVs from the Rogue.VirusDoctor family. The infection mimics Windows Security Master, Windows Defence Unit, Windows Protection Tool and hundreds of other clones. Even though these threats use different names, all of them use the same interface, which is why malware researchers have no trouble identifying them as malicious. If you do not install automatic malware removal software to guard the system or to delete Windows Defence Master in time, many system’s executable files will be blocked. Due to this, you will not be able to connect to the Internet, install automatic malware removal tools or delete the infection quickly. Unfortunately, many computer users fall for the fictitious scanner reports or pop-up warnings (see below) and purchase the full version of the bogus security program. Needless to say, this is not something you should do.
Instead of activating the fictitious malware remover, you should install authentic security software to remove Windows Defence Master and ensure further Windows protection. Unless you are experienced with dangerous computer infections, we do not recommend proceeding with the manual removal. Use the instructions below to install a reliable security application which will help you delete all existing infections. You can also try to activate the full version of the rogue anti-spyware using a special license key displayed below. Once the key is entered into the registration area, all symptoms should be disabled and you will be able to install automatic malware removal software to delete the existing threat.
Remove Windows Security Master
How to manually remove Windows Defence Master
Files associated with Windows Defence Master infection:
%UserProfile%\Desktop\Windows Defence Master.lnk
Windows Defence Master processes to kill:
Remove Windows Defence Master registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = 1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "MS-SEC" = %AppData%\svc-[random].exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "S_SC" = %AppData%\svc-[random].exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ZSFT" = %AppData%\svc-[random].exe
HKEY_LOCAL_MACHINE\Software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\k9filter.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableVirtualization" = 0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\bckd "ImagePath" = 22.sys