XP Internet Security

29 January 2010 41 Comments

XP Internet Security with alias XP Internet Security 2010 is a security application created in the tradition of mischief security program. XP Internet Security virus comes from the fake antivirus group where Vista Internet Security and Win 7 Internet Security are affiliated. These programs assure to remove self-detected threats on the computer in conformity that acquisition is required. One must purchase the full version of XP Internet Security before it proceeds with decontamination. This method is similarly applied to every rogue security programs. In any case, remember that XP Internet Security was produced to be sold in deceitful means and rip off money from computer users. Rogue software was invented without any benefits to consumers. XP Internet Security and oe resemblance cannot even secure a computer because it does not contain any module to perform the task. Its function is limited to scan and deceive, oe than that its complete rubbish.

The problem is XP Internet Security can be installed on computers at ease but cannot be remove unless you pay for the license version. The same mechanism engaged by ransom-ware computer virus.

To totally remove this fake program without the need to possess XP Internet Security activation key, only trusted anti-malware application must be trusted. Oewise, situation may end up in most terrible mistake when registration of rogue program is accomplished.

Screen Shot Image:

Image of XP Internet Security

 

While struggling to persuade victims to make a purchase of regular version, XP Internet Security constantly demonstrates various alerts and warning signs like this one.

Attention: DANGER!
ALERT! System scan for spyware, adware, Trojans and viruses is complete. XP Internet Security 2010 detected 34 critical system objects. These security breaches may be exploited and lead to the following…

XP Internet Security Image

Alias: XP Internet Security 2010

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

XP Internet Security Removal Procedures

XP Internet Security REMOVAL TOOL:
In order to completely remove the threat, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected computer.

MANUAL REMOVAL PROCEDURE:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “XP Internet Security”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
av.exe or ave.exe

2. You need to update your installed antivirus application to have the latest database.

3. Thoroughly scan the system and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to XP Internet Security Virus.

4. Registry entries created by XP Internet Security must also be remove from the Windows system. Please refer below for entries associated to the rogue program.
- For Windows 2000/XP: Go to Start > Run, type “regedit” on dialog box then press Enter on keyboard.
- For Windows Vista/7: Go to Start > Search Program and Files, type “regedit” and press Enter.

5. Exit registry editor.

6. Get rid of XP Internet Security start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
av.exe or ave.exe

7. Click Apply and restart Windows.

Technical Details and Additional Information:

Malicious Files Added by XP Internet Security
%AppData%\av.exe
%AppData%\WRblt8464P

File Location for Windows Versions:

  • %AppData% for Vista/7 refers to C:\Users\<Current User>\AppData\Roaming, while for Windows XP/2000 user it is C:\Documents and Settings\<Current User>\Application Data.

XP Internet Security Registry Entries:
HKCU\Software\Classes\.exe
HKCU\Software\Classes\.exe\DefaultIcon
HKCU\Software\Classes\.exe\shell\open\command | @ = “”%AppData%\av.exe” /START “%1? %*”
HKCU\Software\Classes\.exe\shell\open\command | IsolatedCommand = “”%1? %*”
HKCU\Software\Classes\.exe | @ = “secfile”
HKCU\Software\Classes\.exe | Content Type = “application/x-msdownload”
HKCU\Software\Classes\secfile\shell\open\command | @ = “”%AppData%\av.exe” /START “%1? %*”
HKCU\Software\Classes\secfile\shell\open\command | IsolatedCommand = “”%1? %*”