For the past few days, I have been following with the latest malware called XP-antispyware. I was of the opinion that this is only spread via its own website and when downloaded and installed. But today it proved me all wrong. I was searching google and when I opened one result, to my surprise, another popup opened breaking all my popup blockers stating that my computer had some spyware and that I needed to scan for spyware using XP-Antivirus. I just closed the Window and another dialog box appeared which I captured:
I didn’t press OK. Just clicked the red Cross and everything was fine. I have NOD32 Security Suite and I have the latest definitions installed. It should have caught this dangerous page but it didnt.
XP-Antivirus is still new and can affect even with
your antivirus installed. So be aware of the danger.
How to stay away from XP-Antivirus
As I have already mentioned that the detection of this malware is really very poor, so you should also be careful about what you are doing. Just stay away from the following sites:
- XpAntivirusonline.com
- XPOnlinescanner.com
- XPSecuritycenter.com
- XPAntispyware.com
- XPAntiviruspro.com
- XPAntivirus2008.com
- XPAntivirus-scanner.com
- XPAntivirus.com
- XPAntivirussite.com
- XPCleanerpro.com
- XPAntivirussecurity.com
In the last one month or so, the creators of this malware have created so many sites and it is expected that the variants will keep on coming. Please note that this malware can install automatically so please DONOT try to open any of the sites above.
How to remove XP-Antivirus
If you are infected with this malware. Please follow the instructions below to remove xp-antivirus:
Remove the following processes:
- %program_files%xpantivirusxpantivirusupdate.exe
- xpantivirus.exe
- download.exe
- %program_files%xpantivirussysbackupntoskrnl.exe
- install_xp.exe
- %program_files%xpantivirussysbackupntoskrnl.exe.md5
- %program_files%xpantivirussysbackupexplorer.exe.md5
- %program_files%xpantivirusunins000.exe
- xpantivirusupdate.exe
- %program_files%xpantivirussysbackupexplorer.exe
- %program_files%xpantivirusunins000.exe
- install_xp.exe
- %program_files%xpantivirusxpantivirusupdate.exe
- %program_files%xpantivirussysbackupntoskrnl.exe
- %program_files%xpantivirussysbackupexplorer.exe
- %program_files%xpantivirusxpantivirus.exe
- %program_files%xpantivirusxpantivirus.exe
- Where %program_files% is your Program Files directory e.g, C:Program Files.
- To remove all these processes, open your task manager, go to processes tab and remove all the above processes whichever are running.
Remove the following folder created by XP-Antivirus:
- %program_files%xpantivirus
- %common_programs%xp antivirus
- HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun xp antivirus
- HKEY_CURRENT_USERsoftwarexp antivirus
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilter displayname
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilter errorcontrol
- HKEY_CURRENT_USERsoftwarexp antivirusoptions firstrunminimize
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 nno setup: user
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 installdate
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 installlocation
- HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionexplorermenuorderstart menuprogramsxp antivirus
- HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun xp antivirus
- HKEY_CURRENT_USERsoftwarexp antivirusoptions autoupdate
- HKEY_CURRENT_USERsoftwarexp antivirusoptions billingurl
HKEY_CURRENT_USERsoftwarexp antivirusoptions enableantirootkit - HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 urlupdateinfo
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilter
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 displayname
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 helplink
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 inno setup: app path
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 inno setup: icon group
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 inno setup: setup version
- HKEY_CURRENT_USERsoftwarexp antivirusoptions firstrunurl
- HKEY_CURRENT_USERsoftwarexp antivirusoptions billingurlapproved
HKEY_CURRENT_USERsoftwaremicrosoftwindowsshellnoroammuicache c:program filesxpantivirusxpantivirus.exe - HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 publisher
- HKEY_CURRENT_USERsoftwarexp antivirusoptions updateurl
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilter imagepath
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilter start
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilter type
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilterenum
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilterenum count
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 nomodify
- HKEY_CURRENT_USERsoftwarexp antivirusoptions aff
- HKEY_CURRENT_USERsoftwarexp antivirusoptions registerurl
- HKEY_CURRENT_USERsoftwarexp antivirusoptions startminimized
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilterenum initstartfailed
- HKEY_CURRENT_USERsoftwarexp antivirusoptions enablesysbackup
- HKEY_CURRENT_USERsoftwarexp antivirus
- HKEY_CURRENT_USERsoftwarexp antivirusoptions checkhidden
- HKEY_CURRENT_USERsoftwarexp antivirusoptions enableadvanced
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 norepair
- HKEY_CURRENT_USERsoftwarexp antivirusoptions versionurl
- HKEY_CURRENT_USERsoftwarexp antivirusregister
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorerbrowser helper objects{9a19966f-ae0e-4699-8cce-9b6f5f1c352c}
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 quietuninstallstring
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 uninstallstring
- HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallxp antivirus_is1 urlinfoabout
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfilterenum nextinstance
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfiltersecurity
- HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicesxpantivirusfiltersecurity security
- HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionrun xp antivirus
Remove the following registry keys:
- If your homepage has been changed by XP-Antivirus, please change it to default.
- This will hopefully remove the malware from your system. If you have any queries, please comment.
Got computer/technical problems? Get FREE help from Technize Forums
I think that manual removal is the most effective way to get rid of XP antivirus, though regretfully not the easiest. For ordinary users out there, deleting entries from the Windows registry can quickly become a worse experience than this scam itself. However, it mutates so fast that antimalware programs work on certain PC’s and don’t work on others, so manual check and step-by-step guide is always a better idea than a blind belief in some “powerful remover”.
Manual remove does work but i have found you have to double check ourself to get all of the files removed. If some are left behind you end up still getting the popups. Also, be careful with the registry entries, if you are not sure then don’t mess with your registry or you may end up re-installing windows!
Thank you AntivirusExpert and Techie Bob for your expert comments. May be we should also work on a removal tool for this malware because it is spreading rapidly. I’ll try to make one removal tool specifically for XP-Antivirus.
Honi soit the dazzlingly buy cytotec then announced estivities.
Run smitfraud.exe to remove XP Antivirus. It’s a free download.
Disable System Restore, Run “SmitFraudFix” & Followed By “RogueFix” (Run Both In Safe Mode)
Run “Disk Heal: & Lastly “SuperAntiSpyware”.
Enable System Restore:-)
Very useful information. Also, you can check a great free tool.