XPAntivirus

XPAntivirus Description

XP Antivirus (also known as XP Anti Virus 2008, XPAnti Virus and XP Antivirus 2008) is a fake spyware removal tool that is usually downloaded onto your computer by a Trojan (most likely the Zlob Trojan) or under other dubious circumstances. XP Antivirus is not a legitimate spyware removal tool. XP Antivirus has moved on to be cloned onto other rogue anti-spyware programs like Antivirus 2009, Antivirus 2008, Vista Antivirus 2008, Windows Antivirus 2008 and others.

Once downloaded, XP Antivirus begins to haunt the user by displaying false security alerts that read:

“WARNING!!! Quick System Scan Results

XP antivirus Online Scanner detected
dangerous spyware on your system!

Detected malicious programs can damage your computer and compromise your privacy. It is strongly recommended to remove them immediately.”

XP Antivirus may also create nine (9) entries in your Windows Registry that convince you that your computer is infected with spyware, which is really XP Antivirus that is the spyware and not an outside source.

These entries are simply created by XP Antivirus so when it runs its system scan those entries will be considered as threats. The purpose of these tactics is to get you to purchase the full version of XP Antivirus spyware removal application.

Even though XP Antivirus’s program may seem legit with its uninstall option available on ‘Add or Remove’ Programs list, its files will still reappear after reboot, launch XP Antivirus and its “System scan” messages may continue to pop up on your task manager. In addition, XP Antivirus installs another application named “Windows Security Alert” that displays nonstop popups stating that Windows Security Alert has detected that your antivirus is not working. All these occurrences are scare tactics used by XP Antivirus to convince you that you need to purchase XP Antivirus’ commercial version for US$49.95. It is strongly recommended to remove XP Antivirus from your system without any hesitation.

Aliases

a variant of Win32/InstallBrain.M [ESET-NOD32]Riskware.Win32.InstallBrain (A) [Emsisoft]Heuristic.BehavesLike.Win32.PasswordStealer.D [McAfee-GW-Edition]TROJ_GEN.R47H1LC [TrendMicro-HouseCall]Artemis!20C1BDF782B9 [McAfee]Trojan.Dropper.RQU.2 [MicroWorld-eScan]Artemis!B986AFD43D79 [McAfee-GW-Edition]Trojan-FakeAV.Win32.FakeRecovery.dc [Kaspersky]Gen:Variant.Kazy.48467 [BitDefender]Win32:Cycbot-PM [Trj] [Avast]

More aliases (794)

XPAntivirus Automatic Detection Tool (Recommended)

Is your PC infected with XPAntivirus? To safely & quickly detect XPAntivirus, we highly recommend you run the malware scanner listed below.

Download SpyHunter's* Malware Scanner to detect XPAntivirus What happens if XPAntivirus does not let you open SpyHunter or blocks the Internet?

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

#	File Name	Detection Count
1	%ProgramFiles%\XP Antivirus	689
2	scui.cpl	665
3	XPAntivirus.lnk	630
4	Uninstall XP Antivirus 2008.lnk	630
5	XPAntivirus on the Web.lnk	593
6	xpa.exe	330
7	XPAntivirus.exe	220
8	xpa2008.exe	220
9	xpa_eng.exe	110
10	xpa2008pro.exe	28

More files

Registry Modifications

Tutorial: To edit and delete registry entries manually, read the tutorial on how to remove malicious registry entries.

Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.

The following newly produced Registry Values are:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}63825787604427079274186537277345XP antivirusXPAntivirusHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}XP antivirus_is1