XP Defender 2013

XP Defender 2013 Description

XP Defender 2013 is a fake anti-malware scanner whose ancestry can be traced to other members of the widespread FakeRean family. Most FakeRean-based scamware like XP Defender 2013 and its relatives are installed by Trojans with threat-downloading functions (such as Tibs Trojans). Even though XP Defender 2013 uses the name of a Microsoft OS and attempts to make itself appear as a useful anti-malware tool, SpywareRemove.com malware analysts have confirmed that XP Defender 2013 can neither detect malware nor remove any genuine infections. Instead, XP Defender 2013 only has the ability to create fake warnings as a sleazy marketing scheme to make you buy its ‘full’ software. As a PC threat, itself, XP Defender 2013′s alerts should be disregarded, and XP Defender 2013 should be removed with a real anti-malware program of your choice.

XP Defender 2013: a Fraud that’s Perfectly-Functional in 2012

XP Defender 2013′s name may reference a dusty and antiquated version of Windows, but XP Defender 2013′s ties to other scamware have XP Defender 2013 associated with some of the most regularly-updated and redistributed rogue anti-malware products of today. As a new scamware variant from the FakeRean family, XP Defender 2013 can be considered identical in its hoax and its security risks to PC threats like Win 8 Home Security 2013, Vista Antivirus 2012, Win 8 Antispyware 2013, XP Security Plus 2013, Win Server Defender, XP Security 2013, Win 7 Defender, Windows XP Internet Security 2012, Win 7/Vista/XP Smart Defender, Windows Vista Internet Security 2012, Win 7 Security Cleaner Pro, Vista Smart Defender Pro, Windows Vista Antivirus 2012, XP Internet Security 2013, XP Security 2012, XP Total Security 2013, PCclean Pro, CleanThis, Internet Security 2012, Vista Antivirus 2008, Vista Antivirus 2008, Palladium Pro, Win 8 Defender 2013, XP Smart Defender Pro, Privacy Protection, XP Antispyware 2013, Vista Home Security 2013, Win 7 Antispyware 2013, Windows Antivirus 2008, Internet Security, Win 7 Home Security 2013, Vista Internet Security 2012, Win 8 Antivirus 2013, Vista Security 2012, XP Anti-Virus 2011, Windows Vista Security 2012, XP Security Cleaner Pro, Vista Defender, XP Home Security 2012, Antispyware Pro 2012, Win 8 Security System, XPdefender, XP Internet Security Pro 2013, Windows 7 Antispyware 2012, Vista Antivirus 2013, Spyware Protection 2010, XP Internet Security 2012, Vista Security Cleaner Pro, XP Home Security 2013, PC Defender Plus, Win 7 Internet Security 2013, Antivirus2008Pro, Win 7 Home Security Pro 2013, Antivirus2008, Vista Antispyware 2013, Win 7/XP/Vista Protection 2013, Win 7 Internet Security 2011, Antivirus Pro 2009, Windows 7 Internet Security 2012, AntiSpy Safeguard, Win 7 Smart Defender Pro, Windows Essentials Pro 2013, Vista Security 2013, Win 7 Antivirus 2013, Win 7 Security Plus 2013, Win 7 Security 2013, Win 7 Security 2012, Win 7 AntiVirus 2012, XP Antivirus 2013, Win 7 Internet Security Pro 2013, Win 7 Internet Security 2012, Vista Security Plus 2013, Internet Security 2013, Internet Protector, AntivirusXP 2008, Win 8 Security Suite 2013 and ThinkPoint. SpywareRemove.com malware experts recommend that you consider XP Defender 2013 and other FakeRean-based scamware to be dangers to your PC due to payloads that can include:

Attempts to block processes or programs as they’re launched.
Registry changes to your browser’s settings that force it to use a proxy server.

Websites may be blocked by XP Defender 2013 and confidential information may be monitored.
Even more Registry changes that disable Windows Update, Windows Security Center and/or Windows Firewall.
XP Defender 2013′s persistent display of fake security information, including denouncing harmless files as infected and claiming that nonexistent attacks have taken place.

The End-All and Be-All of XP Defender 2013′s Scam

XP Defender 2013′s main design goal is to create a false appearance of multiple types of malware afflicting your computer and recommend that you spend money on purchasing its software to remove these imaginary threats. SpywareRemove.com malware experts see no reason to buy XP Defender 2013, which is a waste of money and risks exposing financial information to criminals. Even in cases where XP Defender 2013 is purchased, XP Defender 2013 still presents a real security threat to your computer (for the reasons noted above).

XP Defender 2013 can be removed by actual anti-malware products, although you may need to use standard security techniques to prevent XP Defender 2013 from blocking your scans. Because SpywareRemove.com malware experts have noted that XP Defender 2013 has an appreciable chance of being installed by various types of Trojans, any attempts to delete XP Defender 2013 should be capable of detecting related malware that may be responsible for XP Defender 2013 being on your computer in the first place.

Aliases

Win32.Bancos [Ikarus]Trojan/Win32.Diple [AhnLab-V3]TR/Bancos.CDL.8 [AntiVir]Trojan.KillProc.15905 [DrWeb]Win32.Bancos!IK [Emsisoft]Win32:Bancos-CDL [Spy] [Avast]W32/Suspicious_Gen4.ZLLT [Norman]Artemis!8A7BB35885CF [McAfee]Trojan.Generic.KDV.600965 [nProtect]Gen:Trojan.Heur.LP.iu8@aG6fpHgi (B) [Emsisoft]

More aliases (2215)

XP Defender 2013 Automatic Detection Tool (Recommended)

Is your PC infected with XP Defender 2013? To safely & quickly detect XP Defender 2013, we highly recommend you run the malware scanner listed below.

Download SpyHunter's* Malware Scanner to detect XP Defender 2013 What happens if XP Defender 2013 does not let you open SpyHunter or blocks the Internet?

Visual & GUI Characteristics

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

#	File Name	Detection Count
1	%TEMP%\ iglsldvx.exe	888
2	%PROGRAMFILES(x86)%\ Loaris\ Trojan Remover 1.2\ ltr12.exe	724
3	%PROGRAMFILES%\ Ticno\ Tabs\ TicnoTabsBho120605.dll	527
4	setup.exe	356
5	%PROGRAMFILES(x86)%\ PCSafeDoctor\ pcsafedoctor.exe	302
6	%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS].exe	145
7	%PROGRAMFILES%\ ScreensCorner\ Common\ msudt.dll	134
8	%TEMP%\ Imgtask.exe	6
9	%APPDATA%\ Microsoft\ Windows\ Templates\ spsreng.exe	1,096
10	%LOCALAPPDATA%\ Microsoft\ Windows\ Temporary Internet Files\ Content.IE5\ 3FCCG2QO\ musicoasis.exe	1,009
11	%CommonApplData%\[RANDOM CHARACTERS_2]	N/A
12	%Temp%\[RANDOM CHARACTERS_2]	N/A
13	%LocalAppData%\[RANDOM CHARACTERS_2]	N/A
14	%UserProfile%\Templates\[RANDOM CHARACTERS_2]	N/A

More files

Registry Modifications

Tutorial: To edit and delete registry entries manually, read the tutorial on how to remove malicious registry entries.

Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.

The following newly produced Registry Values are:
HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Classes\.exeHKEY_CURRENT_USER\Software\Classes\.exe\ [RANDOM CHARACTERS_0]HKEY_CURRENT_USER\Software\Classes\.exe\Content Type application/x-msdownloadHKEY_CURRENT_USER\Software\Classes\.exe\DefaultIconHKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon\ %1HKEY_CURRENT_USER\Software\Classes\.exe\shellHKEY_CURRENT_USER\Software\Classes\.exe\shell\openHKEY_CURRENT_USER\Software\Classes\.exe\shell\open\commandHKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command\ "[RANDOM CHARACTERS_1].exe" -a "%1" %*HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command\IsolatedCommand "%1" %*HKEY_CURRENT_USER\Software\Classes\.exe\shell\runasHKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\commandHKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command\ "%1" %*HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command\IsolatedCommand "%1" %*HKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]HKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\ ApplicationHKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\Content Type application/x-msdownloadHKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\DefaultIconHKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\DefaultIcon\ %1HKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shellHKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shell\openHKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shell\open\commandHKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shell\open\command\ "[RANDOM CHARACTERS_1].exe" -a "%1" %*HKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shell\open\command\IsolatedCommand "%1" %*HKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shell\runasHKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shell\runas\commandHKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shell\runas\command\ "%1" %*HKEY_CURRENT_USER\Software\Classes\[RANDOM CHARACTERS_0]\shell\runas\command\IsolatedCommand "%1" %*

Additional Information

The following messages's were detected:

#	Message
1	Click Register to register your copy of XP Defender 2013 and perform threat removal on your system. The list of infections and vulnerabilities detected will become available after registration
2	Privacy threat! Spyware intrusion detected. Your system is infected. System integrity is at risk. Private data can be stolen by third parties, including credit card details and passwords. Click here to perform a security repair
3	System hijack! System security threat was detected. Viruses and/or spyware may be damaging your system now. Prevent infection and data loss or stealing by running a free security scan