How To Remove XP Anti-Virus 2011

XP Anti-Virus 2011 is a fake antivirus application that uses scare tactics to goad the user into purchasing a "registered" version of the product. XP Anti-Virus 2011 will display several warnings, popups and messages claiming that your system is at risk. Naturally, all of these red flags that XP Anti-Virus 2011 throws up are false, and are nothing more than a scare tactic.

How did I get in Infected with XP Anti-Virus 2011?

XP Anti-Virus 2011 is typically installed as a drive-by download, which usually means that it's installed without your permission.

What is XP Anti-Virus 2011 doing to My Computer Right Now?

Once installed on a user's computer XP Anti-Virus 2011 does not appear to disable task manager or any other processes, but its presence is often stubborn and highly annoying. It also performs fake scans with intentionally vague or fallacious results in an attempt to get you to purchase it.

XP Anti-Virus 2011

» Download XP Anti-Virus Removal Software

As soon as you find yourself infected with XP Anti-Virus 2011 you need to take immediate action to remove it. XP Anti-Virus 2011 removal can be very challenging for non savvy computer users.

How to Remove XP Anti-Virus 2011 Manually

You will have to kill the following process first as the initial step to remove XP Anti-Virus 2011:

• [RANDOM].exe

The main executable of this threat is random. This makes removing such threats that much harder. The threat is normally found in %AppData%Local[RANDOM].exe and %UserProfile%Local SettingsApplication Data[RANDOM].exe

The following files and folders will also need to be deleted:

%UserProfile%Templatest3e0ilfioi3684m2nt3ps2b6lru
%UserProfile%Local SettingsApplication Data[RANDOM].exe
%AllUsersProfile%t3e0ilfioi3684m2nt3ps2b6lru
%AppData%RoamingMicrosoftWindowsTemplatest3e0ilfioi3684m2nt3ps2b6lru
%AppData%Localt3e0ilfioi3684m2nt3ps2b6lru
%AppData%Local[RANDOM].exe
%AppData%t3e0ilfioi3684m2nt3ps2b6lru

%Temp%t3e0ilfioi3684m2nt3ps2b6lru

Remove XP Anti-Virus 2011: Cleaning the Registry

Once you are done with deleting the files listed above, don't forget to clean your registry. You will have to get rid of the following registry keys:

• HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellsafemodecommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[RANDOM].exe" /START "C:Program FilesMozilla Firefoxfirefox.exe" -safe-mode'
• HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[RANDOM].exe" /START "C:Program FilesMozilla Firefoxfirefox.exe"'
• HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[RANDOM].exe" /START "C:Program FilesInternet Exploreriexplore.exe"'
• HKEY_CLASSES_ROOT.exeshellrunascommand "IsolatedCommand" = '"%1" %*'
• HKEY_CLASSES_ROOT.exeshellrunascommand "(Default)" = '"%1" %*'
• HKEY_CLASSES_ROOT.exeshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[RANDOM].exe" /START "%1" %*'
• HKEY_CLASSES_ROOT.exeshellopencommand "IsolatedCommand" = '"%1" %*'
• HKEY_CLASSES_ROOT.exeDefaultIcon "(Default)" = '%1'
• HKEY_CLASSES_ROOTexefileshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[RANDOM].exe" /START "%1" %*'
• HKEY_CLASSES_ROOTexefileshellopencommand "IsolatedCommand" = '"%1" %*'
• HKEY_CLASSES_ROOTexefileshellrunascommand "IsolatedCommand" = '"%1" %*'
• HKEY_CLASSES_ROOTexefile "Content Type" = 'application/x-msdownload'
• HKEY_CURRENT_USERSoftwareClasses.exeDefaultIcon "(Default)" = '%1' = '"%UserProfile%Local SettingsApplication Data[RANDOM].exe" /START "%1" %*'
• HKEY_CURRENT_USERSoftwareClassesexefileshellrunascommand "IsolatedCommand" – '"%1" %*'
• HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand "IsolatedCommand" = '"%1" %*'
• HKEY_CURRENT_USERSoftwareClassesexefileshellrunascommand "(Default)" = '"%1" %*'
• HKEY_CURRENT_USERSoftwareClassesexefileDefaultIcon "(Default)" = '%1'
• HKEY_CURRENT_USERSoftwareClassesexefile "Content Type" = 'application/x-msdownload'
• HKEY_CURRENT_USERSoftwareClassesexefile "(Default)" = 'Application'
• HKEY_CURRENT_USERSoftwareClasses.exeshellrunascommand "IsolatedCommand" = '"%1" %*'
• HKEY_CURRENT_USERSoftwareClasses.exeshellrunascommand "(Default)" = '"%1" %*'
• HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[RANDOM].exe" /START "%1" %*'
• HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand "IsolatedCommand" = '"%1" %*'
• HKEY_CURRENT_USERSoftwareClasses.exe "Content Type" = 'application/x-msdownload'
• HKEY_CURRENT_USERSoftwareClasses.exe "(Default)" = 'exefile'
  

It is recommended that you run a full virus scan of your machine to make sure that it is completely free of all sort of threats including XP Anti-Virus 2011. For the scan, we suggest using Spyware Doctor with Antivirus.

Conclusion

Removal of XP Anti-Virus may be a bit complicated, but is by no means an impossible feat. Once you have followed he manual removal instructions, your computer should no longer be infected with this threat. However you do need to run a full virus scan to ensure you are no longer infected. We Recommend you run a scan with Spyware Doctor with Antivirus. If you need advanced help and can not remove this threat yourself you may ask your questions below or head over to www.pcninja.com to have an expert remote in and remove this virus for you.

Related Article Keywords: XP Anti-Virus 2011, Remove XP Anti-Virus 2011, XP Anti-Virus 2011 Removal, How to Remove XP Anti-Virus 2011