XPAntivirus

XPAntivirus - (also known as XP Antivirus) is a rogue anti-spyware that creeps onto your system through browser security exploits, Trojans, and other illicit mechanisms. Once it is installed, XP Antivirus Protection will launch on Windows startup and badger the user into purchasing the full version of the program by showing misleading warning messages and scan results. XP Antivirus Protection may appear difficult to remove manually because of its feature to automatically re-install.

Download XPAntivirus infection scanner *

Quick & tested solution for XPAntivirus threat removal.
Save to your desktop & launch now!

XPAntivirus löschen	Supprimer XPAntivirus
Verwijderen XPAntivirus	Rens XPAntivirus
Eliminar XPAntivirus	Ta bort XPAntivirus

1 of 2

Danger level:

Type: Rogue Anti-Spyware

Common infection symptoms:

Connects to the internet without permision
Shows commercial adverts
System crashes
Annoying pop-up's
Slow Computer

Other mutations known as:

Antispywareexpert, XPOnlinescanner.com, XP Antispyware 2009, XPAntispyware2009

How to manually remove XPAntivirus

Files associated with XPAntivirus infection:

XPAntivirus.exe
XPAntivirusUpdate.exe
Uninstall XPAntivirus.lnk
XPAntivirus on the Web.lnk
XPAntivirus.lnk
XPAntivirus.url
xpa1503_en.exe
lphcj7cj0ea59.exe
scan22071[1].exe
1024466436.exe
scan2207[1].exe
d.exe
winowl32.dll
xpa.exe
xpscanner.exe
av2008xp.exe
xpa2008.exe
xpa_eng.exe
CfgWiz.exe
xpa_2008.exe
.tt51.tmp.exe

XPAntivirus DLL's to remove:

winowl32.dll

XPAntivirus processes to kill:

XPAntivirus.exe
XPAntivirusUpdate.exe
xpa1503_en.exe
xpa.exe
lphcj7cj0ea59.exe
scan22071[1].exe
1024466436.exe
scan2207[1].exe
d.exe
xpscanner.exe
av2008xp.exe
xpa2008.exe
xpa_eng.exe
CfgWiz.exe
xpa_2008.exe
.tt51.tmp.exe

Remove XPAntivirus registry entries:

SoftwareXP antivirus
SoftwareMicrosoftWindowsCurrentVersionRunXPAntivirus
SoftwareMicrosoftWindowsCurrentVersionRunXP antivirus
MICROSOFT\WINDOWS\CURRENTVERSION\RUN
WINDOWS\CURRENTVERSION\RUN\14931545604967183595324892598563
WINDOWS\CURRENTVERSION\RUN\19785659369864643732137639727298
WINDOWS\CURRENTVERSION\RUN\47715724179478356601833087992991
WINDOWS\CURRENTVERSION\RUN\54480612624282658590606090192204
WINDOWS\CURRENTVERSION\RUN\57900878247254086192821130456015
WINDOWS\CURRENTVERSION\RUN\74983470143324143951555564816958
WINDOWS\CURRENTVERSION\RUN\92049218335572823192410739436224
MICROSOFT\WINDOWS\CURRENTVERSION\RUN\23356220370392311320880324224442
Microsoft\Windows\CurrentVersion\Run\lphcj7cj0ea59
Microsoft\Windows\CurrentVersion\Run\SMrhcn7cj0ea59
MICROSOFT\WINDOWS\CURRENTVERSION\RUN\79946778822613832333313434317816
XP-antvirus
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 14931545604967183595324892598563
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ OneMoreKey
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ e%*)ùýùüûïýóÎÃøøûøôþÊýÆñûÊÞó
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ s9201
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ XP Antivirus
RUNNING PROGRAM\xpa.exe
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 81606926699086117040062386401532
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 64710692090579446669510422956265
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 92049218335572823192410739436224
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 64855477955808037781198632011247
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ e%*)ùýùäûïÊóÎÿøøíøôÏÊýÜñûëÞó
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 81002379890958082434947281251355
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ e%*)ùýùàûïÞóÎ%-'øøÁøôãÊýÜñûïÞó
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 01072529840989591820736799512848
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ e%*)ùýùÙûïÕóÎÃøøãøôÞÊýÅñûÙÞó
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ NAV CfgWiz
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 79946778822613832333313434317816
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 85129964410425544037464324896029
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 51945830572461086813924661854953
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 82559990915731832198696744558246
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 74983470143324143951555564816958
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ e%*)ùýùàûïÞóÎ%-'øøåøôÞÊýÜñûïÞó
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ e%*)ùýùÙûïÕóÎØøøñøôÇÊýÅñûûÞó
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ inrhcchcj0el3n

Comments

C.C Elliott Feb 24, 2008
i was on the internet and all of a sudden this xpantivirus window took over my screen and pretended to scan my system and said that i had been infected and it pretended to remove them and, afterwards i scaned my computer with my normal virus scan on my computer and it found that this xpantivirus thing was a trojan.
i found your site and removed it all.
Thanx
Angel Jun 22, 2008
Thank you very much for having a site up like this. a similar thing happened to me as the person above. i was googling some info when all of a sudden the screen changed to the xpantivirus screen and "scanned" my computer for infections. i didn't know if it was something that was installed on my computer as my fiance does all kinds of stuff like that so i hit remove now. when it prompted me to save the file to remove them i got suspicious. i thought it might be some kind of trojan virus whatever so i looked it up and came across this site. thanks again for having a source like this to help those of us that don't know a whole lot about these kinds of things!!!
andrew Mar 18, 2009
Its catches itself as a virus (haha)
desconocido Sep 2, 2009
spyhunter look says it's a fake antivirus when the scanner is false is the same, miren dice que spyhunter es un falso antivirus en el scaner cuando el que es falso es el mismo

Post comment — WE NEED YOUR OPINION!