How to Remove Windows System Defender | Removal Guide
Windows System Defender is a new rogue antivirus software along the lines of Windows PC Defender (See the Windows PC Defender Removal guide) (I believe it’s the same family of malware.) It claims to be a powerful and effective antivirus and antispyware suite, but will overwhelm you with warnings and alerts and popups of security problems with your computer and more or less hold you hostage with the fear that your data is at risk unless you purchase their software. All of their scans are falsified and most likely the biggest thing wrong with your computer is having this rogue software installed. Read on for how to remove windows system defender.
The following website should be blocked to protect against future activity from Windows System Defender:
windowssystemdefender.com
Next you may try to uninstall Windows System Defender using the control panel (add/remove programs applet). You never know it may work, but for many of these rogues it doesn’t. So, visit the virus removal toolkit page and download malwarebytes antimalware (and possibly process explorer – see below for why you may need it.) Next try to install, update and run a full scan with malwarebytes antimalware. If you are unable to do so, try the following things. 1 ) reboot into safe mode and rerun the install. 2) rename the installer file for malwarebytes from mbam-setup.exe to something else (henry.exe for instance). 3) continue with the next steps of manual removal and retry the install after you have killed off the running processes associated with Windows System Defender.
The following process should be killed off using the task manager to continue with a manual removal of Windows System Defender. If you are unable to run task manager you may try either copying and pasting the executable to a new file name. (Taskmgr.exe renamed to myfile.exe or something.) If that doesn’t work for you try out process explorer to kill off the running processes. You can find a link to process explorer on the virus removal toolkit page.
WS064.exe
To continue with a manual removal of Windows System Defender then continue to delete the following files and folders:
%docs%\All Users\Application Data\61a60\WSDDSys
%docs%\All Users\Application Data\61a60
%docs%\All Users\Application Data\61a60\WS83b.exe
%docs%\All Users\Application Data\61a60\8727.mof
%docs%\All Users\Application Data\61a60\mozcrt19.dll
%docs%\All Users\Application Data\61a60\sqlite3.dll
%docs%\All Users\Application Data\61a60\WSD.ico
%docs%\All Users\Application Data\61a60\WSDDSys\vd952342.bd
%docs%\All Users\Application Data\WSDDSys
%docs%\All Users\Application Data\WSDDSys\wsd.cfg
%userprof%\Application Data\Windows System Defender
%userprof%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows System Defender.lnk
%userprof%\Application Data\Windows System Defender\cookies.sqlite
%userprof%\Desktop\Windows System Defender.lnk
%userprof%\Recent\ANTIGEN.dll
%userprof%\Recent\cid.dll
%userprof%\Recent\ddv.dll
%userprof%\Recent\eb.sys
%userprof%\Recent\eb.tmp
%userprof%\Recent\energy.sys
%userprof%\Recent\exec.dll
%userprof%\Recent\exec.tmp
%userprof%\Recent\FS.exe
%userprof%\Recent\kernel32.drv
%userprof%\Recent\PE.drv
%userprof%\Recent\PE.sys
%userprof%\Recent\PE.tmp
%userprof%\Recent\ppal.dll
%userprof%\Recent\SICKBOY.exe
%userprof%\Start Menu\Windows System Defender.lnk
%userprof%\Start Menu\Programs\Windows System Defender.lnk
%progfiles%\Mozilla Firefox\searchplugins\search.xml
There may be a randomized component to some of the file names above so use this as a starting point for your search to remove Windows System Defender from your computer. Even after a successful manual removal of Windows System Defender I would continue to install, update and run a scan with malwarebytes antimalware as well as a followup scan with a trusted antivirus program such as avira, or avg.