Windows XP Restore

Windows XP Restore is a fake program that will pretend as system optimization application in order to deceive computer users. Windows XP Restore virus is distributed by means of Trojans and malicious files uploaded on different servers such as web sites and file-sharing networks. It is also sometime sent through email as an attached file to spam messages. Typically, Windows XP Restore will be installed on computer without the full knowledge of the user. Since it is a deceiving application, so many believe that it is needed to fix any computer-related issues. When loaded on to victims computer, Windows XP Restore will start generating fake diagnostics of the system. It will prompt an advise to fix it by having the paid version of this useless program.

Windows XP Restore was originated from a large group of rogue program developers. It was just a mimic of other variants that has already infection millions of computers world-wide. Protecting a computer from these kind of application can be accomplished by a full version of anti-malaware of anti-virus programs that has a full function of real-time scanning. If infected, remove Windows XP Restore using only trusted application and purchasing the registered version of the rogue software is not recommended. Ignore Windows XP Restore including its fake alerts and messages.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows XP Restore Removal Procedures

1. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) here and save it on your Desktop.
2. After downloading, double-click on the file to install the application.
3. Follow the prompts and install as “default” only
4. If it prompts to update the database after installation, please proceed.

5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly.
7. When scanning is finished, click on the “Show Results”
8. Make sure that all detected threats are marked, click on Remove Selected.
9. Restart the computer.

Note: MALWARE may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system.

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows XP Restore”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows XP Restore Virus.
4. Registry entries created by Windows XP Restore must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows XP Restore start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Technical Details and Additional Information:

Malicious Files Added by Windows XP Restore:

– For Windows XP System
C:\Documents and Settings\All Users\~[restore]
C:\Documents and Settings\All Users\~[restore]r
C:\Documents and Settings\All Users\[restore].dll
C:\Documents and Settings\All Users\[restore].exe
C:\Documents and Settings\All Users\[restore]
C:\Documents and Settings\All Users\[restore].exe
C:\Documents and Settings\<Current User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows XP Restore
C:\Documents and Settings\<Current User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows XP Restore\Uninstall Windows XP Restore.lnk
C:\Documents and Settings\<Current User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows XP Restore\Windows XP Restore.lnk
C:\Documents and Settings\<Current User>\Desktop\Windows XP Restore.lnk

Windows XP Restore Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random]”

Change Log and Updates:

3 Responses

  1. Kurt Herbel says:

    The version of the Windows XP Restore virus I received also blocked my use of the task manager, by setting up a phony administrator and blocking it from my usual”Owner” account. In addition it made it difficult to do just about everything by showing me that my programs file was empty from the start button menu. The evil SOBs that have perpetrated this newest version need to be caught and jailed.

  2. Bo Andersen says:

    Hi Kurt,

    It looks like I have the exact problem that You described.

    I have managed to disable the program in the “start menu” after I reset the “DisableTaskMgr” value.

    After doing the above 2 things, I tried to run “system restore” but that process stops after about one minute and that really pi.. me off big time as that is the status of the computer as of right now.

    I am trying to scan with Malwarebytes right now but so far it came up with zip.

    My knowledge isn’t that great when it comes to Windows core settings like registry editing and such so any help would be greatly appreciated.

    nulle101 @

  3. Bo Andersen says:

    Hi again,

    Malwarebytes came up with 7 errors/infections and after removal of the infections everything looked a little brighter.

    If you make the same mistake as I did to start with in not recognize that what you are looking at is a virus and actually activate/click the scanner module in the user interface, the virus, as per my experience, first disables the task manager, second it disables explorer and the quick launch bar and thrid it disables the desktop (as in disables any desktop icons) soon after it starts to delete any restore points to make any system restore impossible and when it has finished that task it starts to empty your program folders. Maybe I’m overlooking something but I don’t think so !

    That’s why I strongly have to disagree with the Risk Level of this virus, as I would rate it as destructive.

    Anyone out there who has a solution to this problem are strongly encouraged to post it here.

    Thanks in advance

    nulle101 @

Leave a Reply

Your email address will not be published. Required fields are marked *