Windows XP System Repair

Posted: August 9, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	379
Threat Level:	2/10
Infected PCs:	130,225

First Seen:	August 9, 2011
Last Seen:	October 17, 2023
OS(es) Affected:	Windows

Windows XP System Repair is a recent entry into the System Repair family of rogue defraggers. Like the other fake defragmentation programs that Windows XP System Repair is copied from, Windows XP System Repair uses fake scans and error messages to make you think that your hard drive is nearing catastrophic failure. However, this group of scamware products, including Windows XP System Repair, has been verified to contain no real defragmentation or error-checking functions, and all of Windows XP System Repair's shrill warning cries should be ignored. SpywareRemove.com malware analysts have found many problems related to Windows XP System Repair infections, including files seeming to disappear, security and anti-virus programs being blocked and browser hijacks that redirect web browsers to hostile websites. By deleting Windows XP System Repair with a well-equipped anti-malware application, you can rid your PC of both Windows XP System Repair's fake warnings and all related issues.

Piercing Windows XP System Repair's Eggshell-Thin Disguise

After searching through Windows XP System Repair from head to toes, SpywareRemove.com malware researchers haven't seen the slightest indication that Windows XP System Repair can defragment or repair your hard drive. However, what Windows XP System Repair will do instead, is create fake errors and defragmentation displays that make it look like your PC is disastrously damaged. This behavior and even the overall looks that Windows XP System Repair uses are copied from other rogue defragmenters that SpywareRemove.com research team is familiar with, including the newer Windows Vista System Repair and Windows 7 System Repair as well as the older System Repair, WinScan, Windows Startup Repair and Windows Diagnostic.

Most Windows XP System Repair infections readily-detectable by Windows XP System Repair's preference for creating random and exaggerated pop-ups that warn you about problems that no real defragmenter would detect, such as:

Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Critical Error!
Damaged hard drive clusters detected. Private data is at risk.

Critical Error
Hard Drive not found. Missing hard drive.

Critical Error
Windows can't find hard disk space. Hard drive error

Critical Error
RAM memory usage is critically high. RAM memory failure.

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

Low Disk Space
You are running very low disk space on Local Disk (C:).

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

Windows - No Disk
Exception Processing Message 0x0000013

32% of HDD space is unreadable

Data Safety Problem. System integrity is at risk.

Hard drive doesn't respond to system commands

Read time of hard drive clusters less than 500 ms

Bad sectors on hard drive or damaged file allocation table

Ram Temperature is 83 C. Optimization is required for normal operation.

Requested registry access is not allowed. Registry defragmentation required

GPU RAM temperature is critically high. Urgent RAM memory optimization is required to prevent system crash

You should ignore these errors, since following their advice may lead you to harm your PC. Windows XP System Repair creates these false positives and other problems to scam you into giving away your credit card information. However, there's no need to buy Windows XP System Repair, since you can fake activation with the code 8475082234984902023718742058948 before you remove Windows XP System Repair.

Cleaning Up the Remainder of Windows XP System Repair's Scam

Even if you're ready to avoid giving credence to Windows XP System Repair's fake errors, SpywareRemove.com malware researchers have found other attacks that Windows XP System Repair causes that may be more difficult to ignore:

One relatively unique problem that's caused by Windows XP System Repair and related rogue defragmenters is a tendency for files to seem as though they've vanished from their folders or have been moved to the wrong folder. This is a purely visual attack that's based on Windows XP System Repair altering Windows Explorer, so using another program, such as the default Windows application Command Prompt, will bypass it.
Windows XP System Repair may also try to prevent the use of various types of anti-malware and security programs, ranging from basic utilities like Task Manager to dedicated anti-virus scanners. You can use Safe Mode or another secure boot method to launch Windows without Windows XP System Repair starting up and getting in the way of these programs.
Browser hijacks that redirect you to the Windows XP System Repair website may also occur. In extreme instances, these hijacks can even force you to redirect away from websites that could help you remove Windows XP System Repair.

Aliases

WindowsXPSystemRepair

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%TempDir%\dfrgr

File name: %TempDir%\dfrgr
Group: Malware file

%TempDir%\dfrg

File name: %TempDir%\dfrg
Group: Malware file

%Desktop%\Windows XP System Repair.lnk

File name: %Desktop%\Windows XP System Repair.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%Programs%\Windows XP System Repair\Windows XP System Repair.lnk

File name: %Programs%\Windows XP System Repair\Windows XP System Repair.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%Programs%\Windows XP System Repair

File name: %Programs%\Windows XP System Repair
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKCU\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"HKCU\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS].exe"

Additional Information

The following URL's were detected:

popcash.net

XP System Repair