• Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

My AntiSpyware

Free antispyware software, Online Scanners, Instructions on how to remove spyware and malware.

Menu
  • Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools
Home › Malware removal › Rogue Anti Spyware › How to remove XP AntiSpyware 2010, XP Antivirus Pro 2010

How to remove XP AntiSpyware 2010, XP Antivirus Pro 2010

Myantispyware team February 22, 2010     125 Comments    

XP AntiSpyware 2010 also known as XP AntiSpyware, XP Antivirus Pro and XP Antivirus Pro 2010 are names of one program, which is a rogue antispyware application. It is promoted and installed with the help of trojans. When the trojan is started, it will download and install XP AntiSpyware 2010 (XP Antivirus Pro 2010) onto your computer.

During installation, XP AntiSpyware 2010 (XP Antivirus Pro 2010) will configure itself to run automatically every time when you run any program that have “exe” extension (99% of Windows applications). The rogue also uses this method of running to block the ability to run any programs, including antivirus and antispyware applications.

When XP AntiSpyware 2010 (XP Antivirus Pro 2010) is started, it will perform a system scan and detect a large amount of infections. All of these infections are fake, so you can safely ignore them. What is more, while the rogue is running, it will display various fake security warning and notifications from Windows task bar that have “Spyware infection has been found” or “Tracking software found” header. However, all of these alerts are fake and like false scan results should be ignored.

Last but not least, XP AntiSpyware 2010 (XP Antivirus Pro 2010) will hijack Internet Explorer and Firefox and display fake warnings when you opening a web site.

As you can see, XP AntiSpyware 2010 (XP Antivirus Pro 2010) is created with one purpose to scare you into thinking that your computer in danger as method to trick you into purchasing the full version of the program. If your computer is infected with this malware, then most importantly, do not purchase it! Remove the rogue from your computer as soon as possible. Use the removal guidelines below to remove XP AntiSpyware 2010 (XP Antivirus Pro 2010) from your PC for free.

Use the following instructions to remove XP AntiSpyware 2010 (XP Antivirus Pro 2010) (Uninstall instructions)

Step 1. Repair “running of .exe files”.

Click Start, Run. Type command and press Enter. Command console “black window” opens. Type notepad as shown below


Command console

Press Enter. Notepad opens. Copy all the text below into Notepad.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

You will see window similar to the one below.


Notepad

Save this as fix.reg to your Desktop (remember to select Save as file type: All files in Notepad.) Double Click fix.reg and click YES for confirm.
Reboot your computer.

Step 2. Remove XP AntiSpyware 2010, XP Antivirus Pro 2010 associated malware.

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

malwarebytes-antimalware1
Malwarebytes Anti-Malware Window

Select Perform Quick Scan, then click Scan, it will start scanning your computer for XP AntiSpyware 2010 (XP Antivirus Pro 2010) infection. This procedure can take some time, so please be patient.

When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.

mbam
Malwarebytes Anti-malware, list of infected items

Make sure that everything is checked, and click Remove Selected for start XP AntiSpyware 2010 (XP Antivirus Pro 2010) removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.

Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.

XP AntiSpyware 2010 (XP Antivirus Pro 2010) creates the following files and folders

%AppData%\av.exe
%AppData%\WRblt8464P

XP AntiSpyware 2010 (XP Antivirus Pro 2010) creates the following registry keys and values

HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\.exe\shell
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start\command
HKEY_CURRENT_USER\Software\Classes\secfile
HKEY_CURRENT_USER\Software\Classes\secfile\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\secfile\shell
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command
HKEY_CURRENT_USER\Software\Classes\secfile\shell\runas
HKEY_CURRENT_USER\Software\Classes\secfile\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\secfile\shell\start
HKEY_CURRENT_USER\Software\Classes\secfile\shell\start\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | @ = “”%AppData%\av.exe” /START “%1″ %*”
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | IsolatedCommand = “”%1″ %*”
HKEY_CURRENT_USER\Software\Classes\.exe | @ = “secfile”
HKEY_CURRENT_USER\Software\Classes\.exe | Content Type = “application/x-msdownload”
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command | @ = “”%AppData%\av.exe” /START “%1″ %*”
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command | IsolatedCommand = “”%1″ %*”

Malware removal Rogue Anti Spyware

Author: Myantispyware team

Myantispyware is an information security website created in 2004. Our content is written in collaboration with Cyber Security specialists, IT experts, under the direction of Patrik Holder and Valeri Tchmych, founders of Myantispyware.com.

125 Comments

  1. Patrik
    ― March 15, 2010 - 11:20 am  Reply

    Brad, no C drive in My computer folder ?

  2. Nicole
    ― March 18, 2010 - 11:50 pm  Reply

    Thank you so so much. I luckily have internet on my phone and was able to get to your site. you’re amazing it worked!

  3. Sarah
    ― March 20, 2010 - 9:40 am  Reply

    Hello,

    Please i really need help! I have XP AntiMalware on my computer, I created the fix.reg, doubleclicked and rebooted but my internet browser will not open for me to download malware butes! Please help me!

  4. Sarah
    ― March 20, 2010 - 9:43 am  Reply

    I am using my work computer right now,and the infection is on my laptop.

  5. Patrik
    ― March 20, 2010 - 12:03 pm  Reply

    Sarah, follow the steps below:
    Click Start, Run, type regedit and press Enter.
    Registry editor opens.
    Navigate in the left panel to HKEY_LOCAL_MACHINE \ SOFTWARE \ Clients \ StartMenuInternet \ IEXPLORE.EXE \ shell \ open \ command

    I the right part of window click twice to “@”. You will see a screen with the contents like below: “C:\Documents and Settings\user\Local Settings\Application Data\av.exe” /START “C:\Program Files\Internet Explorer\iexplore.exe”
    Remove left part, leave only “C:\Program Files\Internet Explorer\iexplore.exe”.

    Reboot your PC and try download Malwarebytes once again.

  6. mike
    ― March 22, 2010 - 9:48 pm  Reply

    I followed all the steps, but every time I reboot, Malwarebytes is always able to find and “remove” 5 items. Something keeps reinstalling every time there is an internet connection.

  7. M Bha
    ― March 23, 2010 - 10:03 am  Reply

    I ran the malware and removed the infected files but Antivirus is still hijacking my computer. Please help?

  8. Mike
    ― March 23, 2010 - 1:40 pm  Reply

    I followed all the steps, but when I reboot and run Malwarebytes again, it finds and “removes” 5 items every single time. It also seems like when ever there is an active internet connection, the program takes hold again. AVG pops up an alert about a possible trojan horse in the WINNT folder. Thanks for the help so far. Any tips on cleaning for good would be appreciated.

  9. Anthony
    ― March 24, 2010 - 8:54 am  Reply

    Greetings from Guam USA……Thanks a million! It worked for me.

  10. Patrik
    ― March 24, 2010 - 9:43 am  Reply

    Mike, open a new topic in our Spyware removal forum. I will check your computer.

  11. Patrik
    ― March 24, 2010 - 9:54 am  Reply

    M Bha, please open a new topic in our Spyware removal forum. I will check your PC.

  12. May
    ― March 25, 2010 - 10:11 am  Reply

    I am not able to save the notpade ad fix.reg.
    It saves as fix-nodepad. and it opens as a notepad.
    Any help…please.
    May

  13. ali
    ― March 25, 2010 - 11:19 am  Reply

    it doesnt copy and paste onto that notepad mate

  14. Patrik
    ― March 25, 2010 - 11:41 am  Reply

    May, most important, in the Save dialog, you need select File type: All files.

  15. Patrik
    ― March 25, 2010 - 11:42 am  Reply

    Ali, if you can`t copy and paste, then manually type a text.

  16. Larry
    ― March 31, 2010 - 10:12 pm  Reply

    Total success! You are a modern hero! Thanks for your selfless dedication!

    Now, if only I could figure out how this **** got on my PC!

  17. Heather
    ― April 4, 2010 - 2:58 am  Reply

    HEY, i some how got this virus, and the solutions they provide here really work. :] THANK YOU SO MUCH

  18. Heather
    ― April 4, 2010 - 3:00 am  Reply

    also, the notepad thing didn’t work for me either, but when i downloaded malwarebytes anti-malware–it got rid of it successfully and quickly.

  19. mitsie
    ― April 7, 2010 - 8:37 am  Reply

    Thanks alot. I think I got this infection from a fake ups email.

  20. Jack
    ― April 7, 2010 - 10:01 am  Reply

    If your screen locks up and you cant do anything try to open task manager and kill the av.exe program running on the system. You should be able to open an internet browser and fix the problem as shown above.

    Good luck

  21. Michele
    ― April 7, 2010 - 8:16 pm  Reply

    I am trying your steps for removal but the installation of Spyware Doctor keeps getting hung when it says “Creating registry entries…”. What do I do now?

  22. Patrik
    ― April 8, 2010 - 2:06 am  Reply

    Michele, open a Malwarebytes page (link in the instructions above), then scroll down to Malwarebytes Anti-malware direct link. Download it and run.

  23. laura
    ― April 8, 2010 - 9:25 pm  Reply

    I’m unable to type the full command into the notepad as the computer freezes due to the number of things running

  24. Patrik
    ― April 9, 2010 - 11:39 am  Reply

    laura, try boot your computer in Safe mode and follow the steps above.

  25. Psqad
    ― April 11, 2010 - 3:56 pm  Reply

    thank you for this superb explanation and guide! it help my friend .. from a distance …
    thx a lot 😉

  26. bob`
    ― April 13, 2010 - 8:57 am  Reply

    Another thought people…if you do some research you find that this is a russian-sourced program that might not load on your pc if it detects certain things in your browser history–like going to google.ru!

    Apparently if the program thinks you know Russian, it will not load on your machine.

    So you might want to tell your peeps to go to google.ru today.

  27. Lee
    ― April 13, 2010 - 6:22 pm  Reply

    after loading the fix.reg and rebooting anything I try to open asked for what program to open with. it’s the same with IE as well as Malwarebytes exe.Thanks for the help

  28. Lee
    ― April 13, 2010 - 6:41 pm  Reply

    Sorry, I should look more carefully at what I typed. Thanks Again

  29. Rachel
    ― April 14, 2010 - 5:09 pm  Reply

    Thankyou sooooooo much that was a horrible virus and thanks to you it’s gone. You’re great!!!

  30. Dan M.
    ― April 16, 2010 - 10:20 am  Reply

    How do I reverse the registry changes? Everytime I try to start a program, including the command prompt, I get the error message “This file does not have a program assosciated with it for performing this action. Create an association in the Folder options control panel.”

« Previous 1 2 3 4 5 Next »

Leave a Reply to dan Cancel reply




New Guides

Newstorg.cc
How to remove Newstorg.cc pop-ups (Virus removal guide)
SportSearchMaster
How to uninstall SportSearchMaster from Chrome, Firefox, IE, Edge
Newsshop.cc
How to remove Newsshop.cc pop-ups (Virus removal guide)
Revercecaptcha.com
How to remove Revercecaptcha.com pop-ups (Virus removal guide)
Newsmaster.cc
How to remove Newsmaster.cc pop-ups (Virus removal guide)

Follow Us

Search

Useful Guides

How to reset Internet Explorer settings to default
Malwarebytes won’t install, run or update – How to fix it
adwcleaner
AdwCleaner – Review, How to use, Comments
This setting is enforced by your administrator (Removal guide)
How to reset Mozilla Firefox (Updated Apr. 2018)

Recent Posts

How to remove Virus Protector (Uninstall instructions)
How to remove PC Defender (Uninstall instructions)
How to remove Antimalware Doctor (Uninstall instructions)
How to remove Security Central (Uninstall instructions)
How to remove Personal Anti Malware (Uninstall instructions)

MYANTISPYWARE.COM

  • About Us
  • Contact Us
  • Privacy Policy

NEED A HELP ?

If you're seeing unwanted pop-ups or ads in your web-browser, you might have an adware installed on your computer. Use the following guide to stop pop-up ads and remove malicious software. Or ask for help here.

Links

  • Downloads
  • Instructions
  • Questions and Answers
  • Free Malware Removal Tools
Copyright © 2004 - 2020 My AntiSpyware - Free antispyware programs and Spyware Removal Instructions.