Remove XP Antivirus 2008, XP Antivirus 2009, XP Antivirus - Fake Antivirus

[laurentio]

XP Antivirus 2008, XP Antivirus 2009, and XPAntiVirus Rogue Software removal procedure:

Fake programs that, when run, display false infections on your computer as a tactic to scare you into purchasing the software.(see attached screenshots)











Under no circumstances should you buy it!!!

Associated XP Antivirus 2008, XP Antivirus 2009, and XPAntivirus Files:
c:\Program Files\XP Antivirus
c:\Program Files\XP Antivirus\xpa.exe
C:\Program Files\XPAntivirus\
C:\Program Files\XPAntivirus\XPAntivirus.exe
c:\WINDOWS\system32\scui.cpl
%UserProfile%\Desktop\XP Antivirus 2008.lnk
%UserProfile%\Start Menu\XP Antivirus 2008
%UserProfile%\Start Menu\XP Antivirus 2008\Uninstall XP Antivirus 2008.lnk
%UserProfile%\Start Menu\XP Antivirus 2008\XP Antivirus 2008.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\XP Antivirus 2008.lnk
C:\WINDOWS\krln32.exe
C:\WINDOWS\system32\scvh0st.exe
C:\Program Files\Common Files\trjdwnl.dll
C:\WINDOWS\shlext32.exe

Associated XP Antivirus 2008, XP Antivirus 2009, and XPAntivirus Windows Registry Information:
HKEY_CURRENT_USER\Software\XP antivirus
HKEY_CURRENT_USER\Software\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\X PAntivirusFilter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\XPAntivirusFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{4e7bd74f-2b8d-469e-dcf7-f96da086b434}\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{6C6B8C69-9285-4D94-8492-9E920C8C2B65}\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{74f25a2c-22b3-4023-8f1a-ca616c30a8b5}\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{9a19966f-ae0e-4699-8cce-9b6f5f1c352c}\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{D714A94F-123A-45CC-8F03-040BCAF82AD6}\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\XP antivirus_is1\
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "XP Antivirus"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "mmnext06"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "shellbn"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "System"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "Windows Framework"
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run ""

Removal instructions:
Download these 2 programs:
1) Malwarebytes from here
2) Super Antispyware from here

Install both programs and make sure you update them.
Restart the computer in safe mode (keep pressing F8 right after restart and the computer should take you to a special menu from where safe mode can be selected) Once there, run both programs you've just installed.
Restart when requested.

Please let us know if the above posted solution has helped you or not.
It is not only about helping others but helping yourself and making us better. Open an account with us today and get an automatic confirmation email with your username and password that will save you time in future.
(It is free and it takes less than a minute)
Thank you.

[laurentio]

This pseudo antivirus has changed the interface that now it is "fully compatible" with Vista's interface. See the attached screen shots...








Malwarebytes cannot remove it on it's own any more so you'll need again smitfraudfix in order to kill any running processes.

[Lyndsey]

Hi

I have infected my machine, somehow with 'spyware guard 2009' Have used Norman Walware Cleaner to disable it then ran malware bytes and antivir in safe mode but its still there, I can't update any of my malware removal or anti virus progs and can't find any of the codes? you suggest?

although I don't know where to look for the HKEY files?

Help

[laurentio]

1. First and foremost, download the latest version of malwarebytes @ http://www.malwarebytes.org/

2. If for some reason you are unable to download it from the infected computer, you will need to download it from another computer and transfer the program to the infected computer. You can do this various way…..burn to CD, transfer with removable storage.ie….thumb drive….external hard drive…….etc.


3. Once transferred to the infected computer, install the malwarebytes program. Now if you are unable to install it on the infected computer, rename the executable to a batch file: mbam-setup.exe -> mbam-setup.bat
Now you can install the program….and when it’s time to run the program….you can do the same and rename the application/executable to a batch file and it will run. For some reason I think the spyware guard 2009 disease stops you from running the program.
Anyway…that’s how to get rid of it. Malwarebytes removes spyware guard 2009 100%….if not….then you have other issues.


As I can see you are talking about an antivirus. Can you detail please? Also, what codes are you talking about??



Try this also:
1. Remove all existing antivirus and antimalware software you might have already installed.


2. Download and install Avast Antivirus. Let it scan at the system's restart.


3. Download, install and scan with Trojan Remover.


4. Download, install and can the computer with Tune-up Utilities 2009.


Hope this help; please let us know the results.


p.s. No need to do follow the above steps in safe mode.

[Lyndsey]

hanks Laurentio

I have bought a little laptop so have managed to get a cd copy of malwarebytes but it won't let me run it? Can you explain in a little more detail how to rename the cd copy?

Its a shame you are so far away, I have 3 pc's that are not working and my sons has all his course work in it that he needs to hand in on Friday. His screen has stopped working (graphics card is shot I think)

Also I don't know if you recall, I emailed you for help with the UPS virus, that is still on my system and I'm running 2 OS's?

Not had a lot of fun with pc's at the mo

But for now how do I make a cd a batch file?

Many Thanks

Lyndsey

[Lyndsey]

I have now managed to get rid of it by doing this... Start > Run > type devmgmt.msc click OK > View > Show hidden devices > Non-Plug and Play Drivers > TDSSserv.sys > right click > DISABLE > RESTART computer.

I could then update and run Malwarebytes and super antispyware

I don't know what it is I did and should probably enable it again but the pesky little virus has gone