Smart Defender Pro

7 July 2009 Rogue 3 Comments

Smart Defender Pro may sound like a friendly program that can defend a computer from virus and computer hackers. In reality, Smart Defender Pro was categorized as another rogue program that has no legitimate purpose rather than to sell itself and gain profit from its fraud operation. This rogue program may conquer computer who visits and execute any links from it from its attack web sites. Several sites that employ drive-by-download techniques will drop the malware on visitor’s computer without any intervention.

Smart Defender Pro will flood the screen with excessive fake alerts after successful installation. Additionally, it makes changes to the system as well as Internet browser to redirect its home page to Smart Defender Pro’s web site.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista

Characteristics (Analysis)

Malware Behavior
When Smart Defender Pro is active on the computer, it will generate a bunch of fake security alerts and warning messages. Some contains the following notices:

Spyware alert!
Vulnerabilities found
Your computer is infected by spyware – 33 serious threats are found while scanning your files and registry. It is strongly recommended to entirely clean your computer and activate the on-fly protection against future intrusions.
Upgrade to full version of this program security kit to clean your computer and prevent new security and privacy attacks. You will have daily updates and online protection against Internet attacks.

Smart Defender PRO alert
INFILTRATION ALERT
Your computer is being attacked from Internet. It could be password-stealing attack, a Trojan-dropper and so on.

Added Registry Entries:

HKEY_CURRENT_USER\Software\Smart Defender PRO
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Smart Defender PRO" 

Associated Files and Folders:

%UserProfile%\Application Data\Smart Defender PRO
%UserProfile%\Application Data\Smart Defender PRO\smrtdefp.exe
%UserProfile%\Local Settings\Temp\smrtdefp.exe 
c:\Documents and Settings\All Users\Desktop\Smart Defender PRO.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Smart Defender PRO
c:\Documents and Settings\All Users\Start Menu\Programs\Smart Defender PRO\Smart Defender PRO.lnk

Manual Removal Procedure

1. Kill any running process that belongs to Smart Defender Pro.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for the following files and click End Task.
smrtdefp.exe

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit. This will open registry editor.
- Find and delete the following:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Smart Defender PRO"
- Close registry editor. Changes made will be save automatically.

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please Update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by Smart Defender Pro.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Associated Files and Folders.'

Automatic Removal of Smart Defender Pro

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.