Hacker Defener Removal

How it works?

As write an author of Hacker Defender:
"Hacker Defender (hxdef) is a rootkit for Windows NT 4.0, Windows 2000 and Windows XP, it may also work on latest NT based systems.

Program must be absolutely hidden for all others. Now the user is able to hide files, processes, system services, system drivers, registry keys and values, open ports, cheat with free disk space. Program also masks its changes in memory and hides handles of hidden processes. Program installs hidden backdoors, register as hidden system service and installs hidden system driver. The technology of backdoor allowed to do the implantation of redirector.

Morphine is very unique application for PE files encryption. Unlike other PE encryptors and compressors Morphine includes own PE loader which enables it to put whole source image to the .text section of new PE file. This one is very powerful because you can compress source file with your favourite compressor like UPX and then encrypt its output with Morphine. Another powerful thing here is polymorphic engine which always creates absolutely different decryptor for the new PE file. This mean if your favourite trojan horse is detected by an antivirus you can encrypt it with Morphine. You will not get the virus alert again."

Antiviral software could not detect the HackerDefender encrypted by Morphine.
Please, take a look at McAffe description of HackerDefender.

We need the universal detector and removal too for HackerDefener.

UnHackMe can help you

UnHackMe allows you quickly and easily detect HackerDefener and its clones.

UnHackMe uses the fact that HackerDefender installs the service and driver. HackerDefender hides these keys from enumeration by registry functions.

We can export the registry hive to a file. The export function writes all registry keys and values into binary file without filtering.

We can get the list of services from exported file and compare it with the current registry keys list. It's not easy because the format of Microsoft registry binary files is not documented. But we can do it!

After that the hidden keys will be easily found. That's all!

Click the Check button.

If a Trojan is found you will see the Results page.

Click on the Stop button and restart your computer.

Hacker Defender Rootkit will be completely deleted at the next reboot of your computer.