XP Anti-Virus 2011

Posted: February 19, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	9

First Seen:	February 19, 2011
Last Seen:	January 8, 2020
OS(es) Affected:	Windows

XP Anti-Virus 2011 is a rogue anti-virus product from tyhe FakeRean family that alters its name slightly to suit each operating system, as well as adding a few more randomized touches to make it less recognizable. The XP Anti-Virus 2011 rogue scanner will detect clean files as infections, use error messages to block websites and hijack your browser, alter your registry arbitrarily and interfere with the running of programs such as legitimate anti-malware scanners. Consider this rogue scanner a high threat, since deleting XP Anti-Virus 2011 is mandatory if you want your computer to work like normally ever again!

XP Anti-Virus 2011's Many Aliases

Since XP Anti-Virus 2011 changes its outer appearance and name a little with every installation, it can be harder to identify this rogue anti-virus product than most. Here are the known names of XP Anti-Virus 2011 clones: Antivirus 2008 Pro, Antivirus XP 2008, Windows Antivirus 2008, Vista Antivirus 2008, PC Clean Pro, Antivirus Pro 2009, Rogue.Vista Antivirus 2008, AntiSpy Safeguard, ThinkPoint, Spyware Protection 2010, Internet Antivirus 2011, Palladium Pro, CleanThis, XP Security 2012, XP Home Security 2012 and AntiVirus PRO 2015.

All of these may or may not be randomized to have the '2011' year tag included at the end of their names, just to add one more layer to the deception! If you're running a different operating system, you can also expect XP Anti-Virus 2011 to change its name to a more appropriate one, such as 'Win 7 Anti-Virus 2011.'

The Many Errors Behind the Many Brand Names

Ultimately, XP Anti-Virus 2011's name is of little import, since the underlying behavior remains exactly the same. You can find it as a randomly-named, three-character .exe file that runs automatically whenever you start another program due to registry alterations XP Anti-Virus 2011 slips in without your permission.

This registry-fiddling has other consequences as well, including being forced to endure XP Anti-Virus 2011 interfering with your browsing sessions in Firefox and Internet Explorer. XP Anti-Virus 2011 will shut down websites with the following inaccurate error message:

Internet Explorer alert. Visiting this site may pose a security threat to your system!
Possible reasons include:
- Dangerous code found in this site's pages which installed unwanted software into your system.
- Suspicious and potentially unsafe network activity detected.
- Spyware infections in your system
- Complaints from other users about this site.
- Port and system scans performed by the site being visited.

Things you can do:
- Get a copy of XP Anti-Virus 2011 to safeguard your PC while surfing the web (RECOMMENDED)
- Run a spyware, virus and malware scan
- Continue surfing without any security measures (DANGEROUS)

XP Anti-Virus 2011 also uses old rogue product tactics in detecting clean files as infections both via faked scans and falsified error messages. All instances of this should be completely ignored, since they're just XP Anti-Virus 2011's way of trying to get you to spend money on malware. Common messages XP Anti-Virus 2011 may create include:

Attention: DANGER!
ALERT! System scan for spyware, adware, trojans and viruses is complete.
XP Anti-Virus 2011 detected 35 critical system objects.

Security breach!
Beware! Spyware infection was found. Your system security is at risk. Private information may get stolen, and your PC activity may get monitored. Click for an anti-spyware scan.

System Hijack!
System security threat was detected. Viruses and/or spyware may be damaging your system now. Prevent infection and data loss or stealing by running a free security scan.

Privacy threat!
Spyware intrusion detected. Your system is infected. System integrity is at risk. Private data can be stolen by third parties, including credit card details and passwords. Click here to perform a security repair.

Stealth intrusion!
Infection detected in the background. Your computer is now attacked by spyware and rogue software. Eliminate the infection safely, perform a security scan and deletion now.

System danger!
Your system security is in danger. Privacy threats detected. Spyware, keyloggers or trojans may be working the background right now. Perform an in-depth scan and removal now, click here.

This rogue anti-virus product will also shut down programs, such as anti-malware scanning software that could remove XP Anti-Virus 2011, with the following error:

XP Anti-Virus 2011 Firewall Alert
XP Anti-Virus 2011 has blocked a program from accessing the internet
Internet Explorer is infected with Trojan-BNK.Win32.Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.

None of these errors will stop as long as this rogue infection is on your computer, so be ready to fight the good fight until you've deleted XP Anti-Virus 2011 for good. Using the key 1147-175591-6550 to register this malware may also help if removal is proving difficult!

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%\tby.exe

File name: tby.exe
Size: 339.96 KB (339968 bytes)
MD5: D083C8A59A063CFC81CCEBD52A34CB56
Detection count: 15
File type: Executable File
Mime Type: unknown/exe
Path: %AppData%
Group: Malware file
Last Updated: January 8, 2020

15 Comments

ronny oatneal says:

March 26, 2011 at 8:42 pm

Thanks, you help me save my system. Kepp up the great work.

Ronny
James Huerto says:

March 31, 2011 at 8:38 pm

i really hope this works...
deb says:

April 11, 2011 at 8:56 pm

It won't let me open up chrome or firefox ??? Help
Jill says:

April 14, 2011 at 6:47 am

2 computers in this house. One has XP Virus which won't allow access to internet. How can I download scanner or removal tool. Could I download it on my computer to a disk and use the disk on the infected computer?
dee dee says:

April 22, 2011 at 8:34 pm

Thank you SO much for the code!!! It worked like a charm!! You are AWESOME!!!!
tardier says:

April 25, 2011 at 11:50 am

you discounted in my bill would back and of my wife two values 69.95 in the weells fargo and citizenz bank by the I buy of the antiviros xp antivirus 2011 and not was possivel lower the product in the my computer i want of the my one reimbolso my money back. tardier neres and marcella pereira
Adrian says:

April 27, 2011 at 5:06 pm

Another approach that worked for a friend of mine: boot into Safe Mode (hit F8 while booting), and do a System Restore.
Tom H says:

May 20, 2011 at 8:17 am

The RESTORE worked perfectly. Went back to the day before the infection. THANKS TO ALL
david d. says:

May 20, 2011 at 1:47 pm

Code worked perfectly. Thanks so much.
Jake262 says:

May 26, 2011 at 5:03 am

Restoring my PC to a previous restore point worked well enough but isn't there any way to be protected against future attacks? I mean it wasn't even detected until it was too late..
Tonyglez17 says:

May 27, 2011 at 1:19 pm

I thank so much becuse this virus infected my son's computer and was really difficult to get rid of it. Thanks very much for your help, all the info is good, very, very GOOD!!!!
Rachel H says:

May 29, 2011 at 3:27 pm

You people are saints.. Thank you for the adivce, im trying all of them until this thing is off my computer for good!!!
Bobby Belk says:

June 1, 2011 at 12:11 am

I want to check my windows xp computer for malware.
joan mcquillan says:

June 30, 2011 at 4:27 am

i HAVE THE VIRUS BUT CANNOT ACCESS THE INTERNET IN ORDER TO BE ABLE TO DOWNLOAD anything to help. Can anyone advise what I should do?
Daniel M Barnes says:

January 12, 2012 at 8:51 am

Start computer in safe mode with command prompt and open sytem restore from command prompt C:\windows\\system32\restore\rstrui.exe and follow instructions to restore to an earlier safe point. I tried several other methods to remove xp antivirus 2012 and this was the only one that worked, hope this helps