What if the WIN8 computer defender program files are compromised?

　　Specific methods

1, press the Windows logo key win+x, click the "command Prompt (Administrator)";

2, then enter the Sfc/scannow command and press ENTER to perform, this process may take some time, even if the progress seems to stop, need to wait patiently;

3, after the execution of the previous command, and then copy the following code paste into the command Prompt window, the code a bit line, do not omit:

　　Reg export "Hkey_local_machinesystemcurrentcontrolsetserviceswindefend"%PUBLIC%DESKTOPREG_WD backup. reg&echo= Windows Registry Editor Version 5.00 "%temp%reg_wd.reg&echo="%temp%reg_wd.reg&echo=[hkey_local_ Machinesystemcurrentcontrolsetserviceswindefend] "%temp%reg_wd.reg&echo=" DisplayName "=" @%programfiles% Windows defendermpasdesc.dll,-310 "%temp%reg_wd.reg&echo=" ErrorControl "=dword:00000001"%temp%Reg_WD.reg &echo= "ImagePath" =hex (2): 22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00, "%temp%Reg_WD.reg &echo= 69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73, "%temp%Reg_WD.reg& echo= 00,20,00,44,00,65,00,66,00,65,00,6e,00,64,00,65,00,72,00,5c,00,4d,00,73,00, "%temp%Reg_WD.reg&echo= 4d , 00,70,00,45,00,6e,00,67,00,2e,00,65,00,78,00,65,00,22,00,00,00 "%temp%reg_wd.reg&echo=" "Start" =dword:0 0000002 "%temp%reg_wd.reg&echo=" Type "=dword:00000010"%temp%reg_wd.reg&echo= "Description" = "@% Programfiles%windows Defendermpasdesc.dll,-240 "" "%temp%reg_wd.reg&echo=" DependOnService "=hex (7): 52,00,70,00,63,00,53,00,73,00,00,00,00,00" " temp%reg_wd.reg&echo= "objectname" = "LocalSystem" "%temp%reg_wd.reg&echo=" Servicesidtype "=dword:00000001 "%temp%reg_wd.reg&echo=" Requiredprivileges "=hex (7): 53,00,65,00,4c,00,6f,00,61,00,64,00,44,00,72,00,69," "% temp%reg_wd.reg&echo= 00,76,00,65,00,72,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00, "%temp% reg_wd.reg&echo= 00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74, "%temp%Reg_ wd.reg&echo= 00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00, "%temp%Reg_WD.reg &echo= 65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,00,76,00,69,00,6c, "%temp%Reg_WD.reg& echo= 00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,6f,00,72,00, "%temp%Reg_WD.reg&echo= 65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65, "%temp%reg_wd.reg&echo= 00, 44, 00,65,00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00, "%temp%reg_wd.reg&echo= 67,00,65,00,00,00,53,00,65,00 , 43,00,68,00,61,00,6e,00,67,00,65,00,4e,00,6f, "%temp%reg_wd.reg&echo= 00,74,00,69,00,66,00,79,00,50,00,72, 00,69,00,76,00,69,00,6c,00,65,00,67,00, "%temp%reg_wd.reg&echo= 65,00,00,00,53,00,65,00,53,00,65,00,63,00, 75,00,72,00,69,00,74,00,79,00,50, "%temp%reg_wd.reg&echo= 00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65, 00,00,00,53,00,65,00,53,00, "%temp%reg_wd.reg&echo= 68,00,75,00,74,00,64,00,6f,00,77,00,6e,00,50,00,72, 00,69,00,76,00,69,00,6c, "%temp%reg_wd.reg&echo= 00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,63, 00,72,00,65,00,61,00, "%temp%reg_wd.reg&echo= 73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,00,69, 00,76,00,69,00,6c, "%temp%reg_wd.reg&echo= 00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69, 00,67,00,6e,00, "%temp%reg_wd.reg&echo= 50,00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65, 00,6e,00,50, "%temp%reg"_wd.reg&echo= 00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00, "%temp%Reg_WD.reg &echo= 63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53, "%temp%Reg_WD.reg& echo= 00,65,00,53,00,79,00,73,00,74,00,65,00,6d,00,45,00,6e,00,76,00,69,00,72,00, "%temp%Reg_WD.reg&echo= 6f , 00,6e,00,6d,00,65,00,6e,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65, "%temp%reg_wd.reg&echo= 00, 67, 00,65,00,00,00,00,00 "%temp%reg_wd.reg&echo=" Failureactions "=hex:80,51,01,00,00,00,00,00,01,00,00,00,03,00 , 00,00,14,00,00, "%temp%reg_wd.reg&echo= 00,01,00,00,00,64,00,00,00,03,00,00,00,64,00,00,00,00,00,00,00,64, 00,00,00 "%temp%reg_wd.reg&echo=" launchprotected "=dword:00000003"%temp%reg_wd.reg&echo= " Failurecommand "=" c:windowssystem32mrt.exe/ehb/servicefailure "camp=4.6.305.0;approximate-" Engine=1.1.11202.0; avsig=1.189.1057.0; assig=1.189.1057.0 "/q" "%temp%reg_wd.reg&echo=" "%temp%reg_wd.reg&echo=[hkey_local_machinesystemcurrentControlsetserviceswindefendsecurity] "%temp%reg_wd.reg&echo=" Security "=hex:01,00,14,80,f4,00,00,00,00, 01,00,00,14,00,00,00,30,00,00,00,02, "%temp%reg_wd.reg&echo= 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f, 00,01,01,00,00,00,00,00,01,00,00, "%temp%reg_wd.reg&echo= 00,00,02,00,c4,00,07,00,00,00,00,00,18,00,9d, 01,02,00,01,02,00,00,00,00,00, "%temp%reg_wd.reg&echo= 05,20,00,00,00,21,02,00,00,00,00,14,00,9d,01,02, 00,01,01,00,00,00,00,00,05, "%temp%reg_wd.reg&echo= 12,00,00,00,00,00,18,00,9d,01,02,00,01,02,00,00,00, 00,00,05,20,00,00,00,20, "%temp%reg_wd.reg&echo= 02,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00, 05,04,00,00,00,00,00, "%temp%reg_wd.reg&echo= 14,00,9d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00, 00,28,00,ff,01,0f, "%temp%reg_wd.reg&echo= 00,01,06,00,00,00,00,00,05,50,00,00,00,B5,89,FB,38,19,84,C2,CB, 5C,6C,23,6D, "%temp%reg_wd.reg&echo= 57,00,77,6e,c0,02,64,87,00,00,28,00,ff,01,0f,00,01,06,00,00,00,00,00, 05,50, "%temp%reg_wd.reg&ech"o= 00,00,00,bf,55,08,72,3b,e0,28,d0,89,79,4b,f8,91,89,6e,7c,40,25,ec,f4,01,01, "%temp%Reg_WD.reg&echo= 00,00 , 00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 ""%temp%reg_wd.reg®import%temp%Reg_WD.reg

4, after the execution, we can go to the list of services to open Windows Defender Service.

　　Small Sticker: Win8.1 system can not open Windows Defendere service is usually caused by a registry key error, the third step above can fix the problem, and then create a Reg_wd.reg file on the desktop so that the next time the same problem to repair, double-click it.