How to Remove Perfect Defender 2009 (Removal Info)

By Jr. on Dec 6, 2008 | Reply

I don’t understand how this Perfect Defender 2009 installed in my desktop PC. It absolutely disgusted!

By shortie on Dec 6, 2008 | Reply

darn. perfect defender 2009 caught me off guard this morning. i become a victim of this scamware. i followed ur instruction to get rid of most files from perfect defender. however, from my previous experience, i doubt if there is any leftover infectors. to be honest, i am a IT guy myself and it’s such a shame to get infected. good luck to u guys.

By AtomicPunk on Dec 7, 2008 | Reply

After about 20 hrs of trying everything mentioned above, I finally found a solution that worked for me with XP.

Try this:

Reboot in Safe Mode

Click on:

My Computer

Local Disk (C)

Now onto folders:

Documents and Settings

* now find the folder with your user name & click it *

Application Data

Google

INSIDE the Google folder DELETE these:

kjzna1562565.exe

spcffwl.dll

the entire folder called TSCAN

now close & go back to your desktop & empty the recycle bin.

RESTART

You should now be able to open Internet Explorer & have it respond normally.

Hope this helps!

By Steeler on Dec 7, 2008 | Reply

Perfect Defender 2009 is a perfect virus. Stay away smartly or you would be harmed.

By LT on Dec 7, 2008 | Reply

Thanks, AtomicPunk!
The ‘kijna…’ virus was in Google folder!
But not any more!

By LT on Dec 7, 2008 | Reply

Sorry, I mean ‘kjzna…’ virus

By JaKaL on Dec 8, 2008 | Reply

Man I gotta tell you this vundo/conhook virus is the most sly and comprehensive virus I have come across. This scamware “Perfect Defender” is only the tip of the Ice-berg. If you have had issues with perfect defender you likely have some form of the “vundo” aka “conhook” trojan/virus. I have been chasing down little spyware/adware, viruses, and keyloggers all week that this nasty vundo virus has installed. Perfect defender was merely one of them. And though I have had my limited success with finding some “vundo” files and removing them, I fear that there may be even more imbedded somewhere that I havent found yet. Seems that Vundo likes to write itself right into other running processes making it difficult to locate. I am very close to just saving my info I need off my hard drive and doing a complete wipe and starting over with a fresh windows install. I just thought I would warn you guys that perfect defender may only be a symptom of the problem and not the cause. So be careful and “Good Hunting”…

By Warthog on Dec 8, 2008 | Reply

AtomicPunk,
you are my hero (if not a fellow Van Halen fan)! Thanks to you, I can now work at home again tomorrow, rather than spending 4 hours on the train (unless there are delays!), wasting my time, the earth’s resources and exposing myself to terrorist threats!

Your solution seems to work fine. I may appear a bit dim about these things, so I just have a few tips for the non computer savvy (i.e. people like me!):

1) Remember to disable your internet connection first.
2) Like me, you may have to log out and log back in as another user (or Administrator), in order to get into Safe Mode, as otherwise the Run command ‘msconfig’ did not work. I don’t know whether this is just some other latent problem with my machine, or whether Safe Mode is intentionally blocked by the virus.
3) Change file view options, so you can actually see the ‘Application Data’ folder (I told you I was dim).
4) If you’re using the search function to find the pests, the folder to erase was called ‘T-Scan’ on my machine. Presumably these may mutate over time.

I only stumbled on this site by searching on ‘perfect defender 2009′, but I will now be saving xp-vista.com in my favourites.

Thanks again.

By NoKaOi on Dec 8, 2008 | Reply

AtomicPunk has a solution that I’d like to try but I have Vista…those folders have different names in Vista and I’ve been unable to find the right ones. Anyone have any suggestions? Thanks in advance.

By joseph on Dec 8, 2008 | Reply

i did what AtomicPunk has said that works but i still i dont know how to get perfect defender out

By Brad on Dec 13, 2008 | Reply

AtomicPunk and Warthog thank you so much for your tips. I’m not very IT savy but I was able to (eventually) view the hidden Application Data folder. I have vista so there were 3 folders inside of the Application Data folder, inside the one called roaming there was a Google with not only Google History but two files, one called MSCORE.exe and one called MSCORE.dll. After figuring out how to get permissions to delete these files I was able to delete them. There was no TSCAN or T-SCAN folder but I did not actually download the Perfect Defender software, I was just getting the popup window and my IE and Netscape browsers wouldn’t work. After closing out of Safe Mode and going back into Vista I was all set.

NoKaOi,
Once you are in safe mode go to My Computer/Users/(name of user account that is having the problem)/App Data/Roaming/Google. Look for a .dll file and a .exe file with the same name, mine were MSCORE and delete those. The App Data folder is hidden so before you can view it you have to go to Control Panel/Folder Options under the View tab you will see Hidden Files and Folders, choose Show Hidden Files and Folders. As stated above I did not actually download (or pay for) the Perfect Defender software so I did not have the TSCAN folder to delete.

Thanks for all your help.

By Mike on Dec 13, 2008 | Reply

Hi all, I have this stupid perfect defender virus on a common use dell gx280 running xp pro.

I read all of the posts on this dirty bug, and it seems it can be deleted in safe mode, but I cant get my system to start in safe mode (pressing F8 at startup), or even into setup for that matter(F2).

It goes straight to the perfect defender security alert pages and wont respond to any key stroke commands, so I cant get to task list or registry.

Any ideas to force system into safe mode? or suggestions to get rid of virus from this point?

By Jason on Dec 13, 2008 | Reply

So will my account be charged because I was duped into this thing? I am in the process of removing this and its a pain…

By tyson571us on Dec 14, 2008 | Reply

I had a recurring popup warning about “Netsky.Q”; the popup took me to Perfect Defender. I decided to look into Perfect Defender, which took me to this website.

Between AtomicPunk and Warhog’s advice (plus a little synthesis of my own) I was able to get into Google, find the newest files, and eliminate them.

I did not know how get into safemode; I later found out its a simple matter of pressing F8. I found the Google folder by doing a simple search for “google.”

My current virus protection, McAfee did not even “see” the virus.

Again, thanks.

By Colleen on Dec 15, 2008 | Reply

Wait a pain!!! I don’t even know how I got this one? I haven’t had a virus/worm whatever you want to call it in over 6 years! So I followed the above help and found items in the Google folder. It took a bunch of tries and renaming and deletion of the file (pzpsp23511834 instead of kjzn… and mrkgrn.dll none of the names matched above, but once gone seemed to have been the problem) With other tips from above I was finally able to delete the files from the Google folder without having to go into Safe Mode.

Now I am worried about it being somewhere else? I am not redirected to the Perfect Defender site anymore, but does anyone else have any suggestions on what to look for specfically on my computer to make sure it is not hiding? Am I safe logging onto password sites? Was this a simple hijack for the browser? I have Mcafee which didn’t see it, and I downloaded 3 other programs that said they could see it and didn’t - I don’t want this one to come back - EVER - Thanks! Colleen

By screwed on Dec 16, 2008 | Reply

I too got this virus/scam thingy and found this site by searching for pzpsp23511834.exe which was what showed in my Task Manager.

Now when I log onto Google I have this bar at the top of my screen that changes whenever I do a search. I can’t help but wonder if I still have the program even though I can’t see it in the Task Manager.

I’m running XP and did what Atomic Punk suggested. Removing it was similar to what he wrote, but not identical - apparently they’re changing how it runs. I had to delete the pzpsp23511834.exe file from the Google folder, as well as a .dll that unfortunatly I didn’t note before I deleted it.

I’m not running any virus software at the moment but apparently need to get some today. I’m still not quite sure I got rid of the problem.

Good luck to anyone who gets this POS on their computer. I’ve had trojans before but this one is especially sneaky.

By Nik on Dec 16, 2008 | Reply

I started getting warning popup on the 2004 worm win32.zafi.b asking me to download defender 2009 to fix it.
It truly fooled me, I dowloaded all kinds of free removal tools for win32.zaif.b but no use. Finally spending 6 hours on this in frustration i thought I better buy this defender 2009 and get it over with. But the site seemed fishy so i googled on defender 2009 and i realized that itself is the problem not the solution.

Thanks for all the posts, I did the below on my XP and seems to be fixed.

Reboot in Safe Mode
Went to folder
C:\Documents and Settings\*my username*\Application Data\Google

Deleted the two files:
pzpsp23511834.exe and mrkgrn.dll

(I did not have TSCAN or T-SCAN maybe because i never downloaded defender from their bogus website)

Restarted the computer in normal mode.

(PS: However whenever i reboot my computer the windows Firewall shows up as off, i put in ON, but after reboot it again shows as OFF. Not sure if this related to defender or is some other problem.)

By dragonz on Dec 17, 2008 | Reply

thanx,it worked

By gasp on Dec 17, 2008 | Reply

i did not download public defender but i am getting the pop up that brings me to the site. do i follow the same steps to get rid of that?

By Richard on Dec 17, 2008 | Reply

Nik, Got the same virus right NOW!: “pzpsp23511834.exe” I did a safe boot and found it here in the SYSTEM CONFIGURATION UTILITY: C:\Documents and Settings\Administrator\ApplicationData\Google\pzpsp23511834.exe

I am concerned about your Windows Firewall issues…something may be lingering yet, From what I have read this root worm may make plenty of other hidden files, and how do you know if it isplease post here if you find anything else. thanks.

By Glenn Craven on Dec 17, 2008 | Reply

Our home PC also has experienced this nasty little beastie. But the specifics are different from those mentioned here.

I can’t even FIND a Google folder (other than the one housing Google Earth on our machine) and it did not have any of the aforementioned garbage in it. I used the search tool (after turning off our Internet connection and rebooting in Safe Mode) and couldn’t find the knzna~, spcffwl.dll, TSCAN folder, etc.

I *did* find pzpsp235~ as mentioned by Colleen, but not in a Google folder. Rather, it was in C:Windows/Prefetch. However, the mrkgrn.dll she mentions was not on our machine at all.

I did notice two folders with ridiculously strange, long names that were all or mostly numeric. They were just loose on the C drive, the creation date was within the last week, and they didn’t seem to be associated with anything legitimate. Neither of them contained any files that in any way resembled the junk mentioned here, but I threw them away regardless.

Since reboot, I’ve had no apparent issues. But give it time.

I will note that Symantic antivirus saw nothing. I downloaded Avast! and deleted Symantic; Avast did not at first notice anything, but when I tried to open Firefox and browse (and the virus tried to drive my machine to the Perfect Defender ripoff site) Avast would block the browser and warn me. It tried to throw away two infected files in that process, as well.

During this ordeal I’d also loaded Spyware Blaster (no results) and a new Ad-Aware, which said it saw 836 infected files and then proceeded to delete three and not tell me what the other 833 even WERE. So I’m not at all confident that I have this beaten.

Good luck, folks.

By Jeff Williams on Dec 18, 2008 | Reply

My copzpsp23511834.exe
uter has also fallen foul of this beast. Using the above info I’ve identified the pzpsp23511834.exe file in the Google folder but it won’t let me delete it saying it is being used by another user.(Even with the broadband connection unplugged). Does anyone know how I can delete this ?
Thanks

By Jeff Williams on Dec 18, 2008 | Reply

My computer has also fallen foul of this beast. Using the above info I’ve identified the pzpsp23511834.exe file in the Google folder but it won’t let me delete it saying it is being used by another user.(Even with the broadband connection unplugged). Does anyone know how I can delete this ?
Thanks

By hank on Dec 18, 2008 | Reply

Thanks for the post with the file names that were hidden in my Google folder. I tried many spyware/malware scanners and none of them located these files :pzpsp23511834.exe and mrkgrn.dll
Once I deleted these files in Safe Mode the problem went away and I was able to use internet explorer without it crashing and without the Security Alert popups.

By Kathryn on Dec 18, 2008 | Reply

That did it for me too. Thanks for saving me from some drastic measures I was about to take. Keeping fingers crossed that is the last of it.

By Diane on Dec 18, 2008 | Reply

I somehow got this Perfect Defender thing on 12-16-08 (I’m running Windows XP PRO on a laptop with Norton 360. Norton found nothing). By reading your posts, I was able to find pzpsp23511834.exe in the c:windows/prefetch file. I deleted it and then rebooted the computer. The Perfect Defender threat box immediately popped back up. So I went back to safe mode and found pzpsp23511834 in the google file. Deleted it, and it seems to be gone. Should I also search for the Vundo virus as some think Perfect Defender comes in on Vundo???
Thanks to everyone for the suggestions.

By Greg on Dec 18, 2008 | Reply

I have found the pzpsp23511834 file and the mrkgrn.dll but I can’t delete them. I can move them and rename or copy them but it won’t let me delete them. I’ve tried to figure out how to start in safe mode but I can’t. I am running a 6 month old Dell with XP. Help?

By Diane on Dec 19, 2008 | Reply

Here is a good site that explains how to restart the computer in Safe Mode. You can also try tapping F8 repeatedly when you start up, but it doesn’t always work for me.

By Max on Dec 19, 2008 | Reply

Perfect Defender 2009 is undefendable. No ideas where it came from. It attacks my computer without any warnings. It’s worse than an atomic bomb. In order to remove perfect defender 2009, I believe you need to format the hard drive then reinstall the operating system. However, you will lose all the data.