XP AntiSpyware 2011

5 May 2011 Rogue 7 Comments

XP AntiSpyware 2011 is a misleading security application. It is a program that aims to trick computer users with fake alerts and warning messages. Simply known as XP Anti-Spyware, it may get into system without users knowledge by means Trojan. The Trojan is able to evade your antivirus program with its own sophisticated method. Security experts are calling this skill as rootkit technique.

Coming from the same family as Vista AntiSpyware 2011 and Win 7 AntiSpyware 2011, they share the same design. What separates them from one another is their title. These rogue programs will modify Windows registry to place itself on the start-up items. To gain full control over the system, XP Anti-Spyware 2011 loads its module right after Windows started. It now has the power to block your software particularly antivirus program.

Remove XP Anti-Spyware 2011 and if you want to stop any irregularities from your system.  This fake AV software is the culprit for system inconsistencies. The main objective of rogue software is to provide false information regarding computer’s security status. It will attempt to force users into obtaining the licensed version of the program by using misleading alerts and fabricated scan results. The only way to get rid of XP Anti-Spyware 2011 from your PC is to scan it with real security application. It is best to use an anti-malware program as stated below.

Screen Shot Image:

Technical Details and Additional Information:

Alias: Vista Antispyware 2011, Win 7 Antispyware 2011

Damage Level: Medium

Systems Affected: Windows XP

Malware Behavior
While XP AntiSpyware 2011 is present on the computer, it will produce too much fake security warnings. This is its own method of pushing user to purchase the licensed version of the software. Some of the fake messages may have these contents:

System danger!
Your system security is in danger. Privacy threats detected. Spyware, keyloggers or Trojans may be working the background right now. Perform an in-depth scan and removal now, click here.

Stealth intrusion!
Infection detected in the background. Your computer is now attacked by spyware and rogue software. Eliminate the infection safely, perform a security scan and deletion now.

Moreover, system tray firewall alert is also used to mislead victims into thinking that PC is under virus attack. It states that Internet browser program is infected with a Trojan. It requires immediate activation of XP AntiSpyware 2011.

Added Registry Entries:

HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" 
= '"%UserProfile%\Local Settings\Application Data\.exe" /START "%1" %*'
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" 
= '"%UserProfile%\Local Settings\Application Data\.exe" /START "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" 
= '"%UserProfile%\Local Settings\Application Data\.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" 
= '"%UserProfile%\Local Settings\Application Data\.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" 
= '"%UserProfile%\Local Settings\Application Data\.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"'
HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'exefile'
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon "(Default)" 
= '%1' = '"%UserProfile%\Local Settings\Application Data\.exe" /START "%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" 
= '"%UserProfile%\Local Settings\Application Data\.exe" /START "%1" %*'

Associated Files and Folders:

%AllUsersProfile%\[random]
%AppData%\[random]
%UserProfile%\Local Settings\Application Data\.exe
%UserProfile%\Templates\[random]
%Temp%\[random]

Manual Removal Procedure

1. Press Ctrl+Alt+Del on keyboard to stop the process associated to "XP Anti-Spyware 2011". When Windows Task Manager opens, go to Processes tab. Find and end this process.
(random characters).exe

2. You need to update your installed antivirus software. Please connect to the Internet and download the most recent database. This is a one-click process from your AV program’s console.

3. Thoroughly scan the computer and remove any threats found by your antivirus program. If delete option is not available, your best next choice is to quarantine the infected file. There is also a need to manually locate and delete malicious files. Please see the file section for items that are relevant to XP Anti-Spyware 2011.

4. Next, you need to remove registry entries created by XP Anti-Spyware 2011. Please refer to registry section to view entries related to the rogue program.
- (Windows 2000/XP) Go to Start > Run, type "regedit" on dialog box then press Enter on keyboard.
- (Windows Vista/7) Go to Start > Search Program and Files, type "regedit" and press Enter.

5. Exit registry editor when you are done.

6. Get rid of XP Anti-Spyware 2011 start-up entry by going to Start > Run, type msconfig on the "Open" dialog box. It will launch a new window containing System Configuration Utility. Click on the Startup tab and uncheck the following item.
(random characters).exe

7. Click Apply. You need to restart the computer.

XP Anti-Spyware 2011 Removal Tool

In order to remove the threat completely, you need to download and run Malwarebytes Anti-Malware. This is a free malware removal tool. If Trojan infection blocks the downloading of this program, get it using a clean computer. Rename the executable file before executing on the infected PC.

Using AntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Download and run AntiSpyware Portable Scanner.