What is MSDERUN.EXE, How to remove MSDERUN.EXE


MSDERUN.EXE is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: MSDERUN
Filename: MSDERUN.EXE
Registry key:

HKEY_CLASSES_ROOT\exefile\shell\open\command | @=”\”C:\DOCUME~1\user\LOCALS~1\Temp\MSDERUN.EXE\” /START \”%1\” %*”

Command: %Temp%\MSDERUN.EXE
Startup Type: File associations
Combofix/RSIT Line:

.exe – open – “C:\DOCUME~1\comp\LOCALS~1\Temp\MSDERUN.EXE” /START “%1″ %*

Description: trojan FakeAlert that uses to install Defense Center (rogue antispyware)

How to remove: use the Defense center removal guide or the steps below.

1. Download fix.zip from here, unzip it. Double Click fix.reg and click YES for confirm.

2. Download TDSSKiller from here and unzip to your desktop. Open tdsskiller folder and right click to TDSSKiller, select Rename. Type something like 123myname and press Enter. Double click it and follow the prompts.

3. Download Malwarebytes Anti-malware. Install and perform a scan and let it remove what it found. Reboot afterwards (important).

This entry was posted on Saturday, July 17th, 2010 at 9:05 am and is filed under File associations, Trojan. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

3 Responses to “What is MSDERUN.EXE, How to remove MSDERUN.EXE”

  1. Kate Says:
    July 18th, 2010 at 11:43 pm

    I can’t thank you enough for this!!! I had been battling this virus for 2 hours and this got rid of it in like thirty minutes. Thank you soooo much for putting up this article!

  2. Mohd Says:
    July 24th, 2010 at 12:51 pm

    Thanks. This helped immensely.
    I also suggest the following. I found Dr Guard installed as the second antivirus and removed it.

    Click Start, Run.
    Type wbemtest and press Enter.
    Windows Management Instrumentation Tester opens.
    Click Connect… button.
    Type root\SecurityCenter and press Enter.
    Click to Query button.
    Type SELECT * FROM AntiVirusProduct and click on Apply button.
    If there is more than one result, it means there is more than one Antivirus program installed. Double click on each result to view the properties for that Antivirus product.
    Identify the product(s) installed and DELETE any records for an Antivirus software (or rogue security program) that is no longer installed.

  3. Will Says:
    July 29th, 2010 at 2:16 pm

    I removed this from several computers by Locating where the Exe was running from, booting into safemode with cmd prompt, and doing a “del C:\Documents and Settings\%User%\Local Settings\Temp\Msderun.exe” or what ever the path to it was. It is a nasty little thing that ran between windows and whatever program a user would run.

Leave a Reply