What is defender.exe?

Defender.exe has been classified by several anti-virus and malware scanners as a trojan (TROJ_FAKEAV.SM49, TROJ_FAKEAV.SMIH, Trojan-Dropper.Win32.FrauDrop.xyrw, and Trojan-PSW.Win32.Papras.bit), a malicious computer virus - software designed to infect and spread through computer networks. This process can remotely execute programs and run commands, use a keylogger to track keyboard entries, send data across networks and spread copies of itself. If this file is found in "C:\Documents and Settings\[UserName]\Application Data" or "C:\Windows\System32", it may be regarded as highly dangerous. This process may also damage personal data by renaming, editing, or corrupting user files. It is highly recommended to use a dedicated anti-virus or anti-malware software to scan and clean the infected computer.

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the defender.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for defender.exe related errors

Defender.exe file information

Windows Task Manager with defender
Defender.exe process in Windows Task Manager

The process known as Defender Software or Jdrtuaqlaaeepmqnb or defender MFC Application or Algvkigeuolrsioyawb or Phourhaawoyanpufg or Urcbyubqaidmmuktppvcfiooszq

appears to belong to software defender Application or © NEHLU Software or Copyright © ZOSAL Software or © BGX Software or Rlvr

by Heaventools Software ( or Defender Software or G Data.

Description: Defender.exe is not essential for Windows and will often cause problems. Defender.exe is located in a subfolder of "C:\Program Files" or sometimes in C:\. Known file sizes on Windows 10/8/7/XP are 1,411,720 bytes (65% of all occurrences), 1,063,488 bytes and 5 more variants. 
There is an icon for this program on the taskbar next to the clock. It is not a Windows system file. The file has a digital signature. The process is a hidden stealth process. Defender.exe is a Verisign signed file. It can change the behavior of other programs or manipulate other programs. Defender.exe is able to record keyboard and mouse inputs, monitor applications, hide itself, manipulate other programs and connect to the Internet. Therefore the technical security rating is 72% dangerous; however you should also read the user reviews.

Uninstalling this variant: If you experience any issues with installation of defender.exe, you may also want to uninstall the associated program (Start > Control Panel > Uninstall a Program > Browser Defender).

Recommended: Identify defender.exe related errors

Important: Some malware also uses the file name defender.exe, for example TROJ_FAKEAV.SM49 or TROJ_FAKEAV.SMIH (detected by TrendMicro), and Rogue:Win32/FakeRean (detected by Microsoft). Therefore, you should check the defender.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

If "defender.exe" is in subfolder "...\T-Online\Dialerschutz-Software" then it belongs to the T-Online protection software against dialer. In this case it is absolutely neccessary. You can test your "defender.exe" on the page ""; there your file is testet by the most popular scan software.
  hardy475   (further information)
T-Online Dialerschutz Software
defender.exe is a virus!!, malware,spyware, add-aware. It self-installed when i was looking for some software. The icon is a blue and yellow shileld divided into four sections. I have removed it twice might need further looking into it.
Besides The Windows Product, defender.exe is a file that gets downloaded to your \username\Applicitation Data folder Its vector seems to be a browser expliot with these keys ( use Registry Mechanic, ) HCR\CLSID\{9E936C4C-..} DW29.tmp This tmp file is actually the payload delivery, that registers itself as a InprocServer32 Does the registry changes, and adds DEFENDER.EXE to the startup. ( Not the Windows one, in program files, but a trojan in the \username\Application Data folder ) ( and also it Defender, was dated in the future, contained TR/Crypt.XPACK.Gen Properties revealed, Size is 1,77
Had it auto-install itself onto my computer while on It refused new processes from opening (including task manager) and closed down most non-essential processes. Required a reboot into safe mode and manual deletion, including the file itself (under my temporary files) and its registry key.
  Dave Crane  
Defender.exe is present under your users/"yourprofilename"/appdata/roaming folder and can be removed by going to safe mode and deleting the file along with its path in the startup. Use cccleaner- tools to remove the link from the startup. Download Dr. Web Antivirus from another PC and run it. it cleans the malware. Do all the steps in Safe mode only.
dangerous, disruptive
  Lynn Hughes  
2 Defender.exe files were associated with an infection I had from "system tool" in C:\Documents and settings.
If defender.exe is located in C:\Documents and Settings\[UserName]\Application Data folder, then it is related to the rogue security software called Spyware Protection 2010.
  Michael   (further information)
I've got no T-Online-Software on my system and defender.exe self-installed and blocked all other software. Avira and other anti-virus-tools can't be used. On this way it is a virus or anything like that!
It installed itself in "c:\Documents and Settings\(user name)\Application Data" on my machine.
  Swami Rabbitima  
If in the user's Application Data directory and called 'Spyware Protection', it is definitely dangerous
  B   (further information)
It installed into Application Data directory. It is a spyware / malware. Rebooted in Safe Mode and deleted manually from drive and registry in CURRENTVERSION/RUN.
It screws up your operating system and shuts down your programs automatically. It is a virus and malware.
appears as Malware Protects - remove
It's a trojan and appeared in my .../All Users/Application Data folder. Keeps giving an annoying popup with a program called malware.exe. Fakes to be a maleware remover and wants you to buy stuff.
This program suddenly appeared while I was browsing the internet. It started scanning and began to advise me of a number of infections on my computer, which is protected by up to date security software. Some of the alleged infections are viruses that came out as long ago as 2003 and against which Windows Vista and Windows 7 (and Windows XP with the necessary updates applied) are immune. This software is at best trying to trick you into buying some unnecessary security and at worst may make your computer vulnerable to real problems.
use safemode f8 on boot and in combi with vipre antivirus
It self-installed on my system without notice - to me, that alone makes it dangerous
Got rid of it in less than 5 minutes. 1. It's not legit, 2. Installs itself without permission (how rude! if someone suspicious walked into my house in such a manner, they should expect me to literally throw them out just as quickly as they snuck in, hence my swift removal of this program) 3. Screwed up my AVG settings (a 10 second fix). To fix it: If there is a fake-looking shield icon on your desktop (and you'd have to be an idiot not to realize its questionable presence) right click it and select "properties." Look at the program location, go to it, and simply delete the defender.exe file.
I caught a defender.exe . It uploaded itself, killed my browser and anything that might shut it down, insisting I should run the "Malware Software" scan because said files are "infected by win32/blaster worm". I restarted the PC in Safe Mode and removed it that way. After my restarting my PC, spybot caught the registery change and I denied it. Don't see any other signs of it now. Sound like the same thing Istec saw!
defender.exe in the C:\Program Data folder is scareware, at least. If you get a multi colored shield in the task bar and get an "Infected" message when opening virtually any .exe file it's this "virus".
malware, page hihack, fake virus
  Nick T.  
It's malware, a scam
EASY FIX - go into safemode where defender.exe can't open. In windows 7, delete the file "defender.exe" from Computer/C:/Users/ your user name /AppData/Roaming/defender.exe. That's it! If you have another operating system, download EMSA Win Startup Manager...the program will tell you the exact name and location of the "defender.exe" file...then just go into explorer and delete it (again, you must be in safe mode to do this).
It is a Trojan. Don't be fooled by reviews of people who know just enough to be dangerous. Run Combofix then Maywarebytes. I included the links.
    (further information)
Defender is a fake antivirus recently had a problem with it on one of my windows comps, biggest tell you can look for is printspool being disabled and not being able to restart it, also the program that starts saying you have other viruses eg blaster worm and what not. Another tell is that you wont be able to start any .exe file. manual removal of Defender.exe is needed via safe mode + file deletion, then antivirus scan in safe mode.
  Des   (further information)
There are probably more than one programs called Defender.exe, probably some safe ones, at least one dangerous one. I just got one in C:\Documents and Settings\All Users\Aplication Data. p/ I was able to get rid of it by pulling the plug of my computer, rebooting it, and deleting it before it activated itself and locked the Task Manager. p/ I'm still looking for other nasty things it may or may not have installed on my computer.
Spyware Trojan and who ever wrote the virus screwed my computer up started in safe mode and deleted the virus

Rating chart

Summary: Average user rating of defender.exe: based on 37 votes with 29 user comments. 4 users think defender.exe is essential for Windows or an installed application. One user thinks it's probably harmless. 32 users think defender.exe is dangerous and recommend removing it.

Do you have additional information?
What do you know about defender.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving defender issues

A clean and tidy computer is the key requirement for avoiding problems with defender. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the defender.exe process on your computer, the following programs have proven to be helpful: ASecurity Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. BMalwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

defender.exe [all]