Severity scale  
  (72/100)

Windows XP Restore. How to Remove? (Uninstall Guide)

removal by - -   Also known as WindowsXPRestore | Type: Rogue Antispyware
12

Windows XP Restore is a rogue computer optimization and defragmentation program that wants to scare you into thinking that your computer has some problems and issues. Windows XP Restore pretends to scan your hard drives and system memory for various errors. Then it states that you need to use the defragment tool to fix supposedly found errors. It fixes some errors for free and then prompts to pay for a full version of the program to fix other programs as well. Please do not fall victim to this rogue program and remove Windows XP Restore from your computer upon detection. Please use the removal instructions below.

Windows XP Restore enters the system without user permission and in order to protect itself attempts to disable legit antimalware software found. Actually, it blocks nearly all programs on the computer. Just run a program several times and it will eventually work. Compromised computer becomes completely taken over by this fake program in the result of such actions and Windows XP Restore begins the campaign it was designed to. Win Defrag will be configured to launch at startup, so be sure it will greatly affect your computer by running fake scanners and pop-up ads or notifications that will annoy you.

Overall, your computer will work slower. You will also see fake alerts from Windows taskbar. As you can see, Windows XP Restore is a total scam. Do not purchase it. If you have this rogue program on your computer please use the removal instructions below. You can remove Windows XP Restore manually but we strongly recommend to use an automatic removal tool given below.

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use. By downloading any of provided Anti-spyware software you agree with our Privacy Policy and Agreement of Use.
Do it now!
Download
Reimage - remover Happiness
Guarantee
Compatible with Microsoft Windows
What to do if failed?
If you failed to remove infection using Reimage Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows XP Restore. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Reimage is recommended to uninstall Windows XP Restore. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Not using OS X? Download a remover for Windows.
Press Mentions on Reimage
Alternate Software
Alternate Software
STOPzilla
Tested and Confirmed! STOPzilla removes Windows XP Restore (2011-06-14 13:51:32)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes Windows XP Restore (2011-06-14 13:51:32)
Plumbytes
We are testing Plumbytes's efficiency (2012-02-06 00:15)
Hitman Pro
STOPzilla
Tested and Confirmed! STOPzilla removes Windows XP Restore (2011-06-14 13:51:32)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes Windows XP Restore (2011-06-14 13:51:32)
Webroot SecureAnywhere AntiVirus

Windows XP Restore manual removal

Kill processes:
[random].exe
Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random].exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = 0'
Delete files:
%AllUsersProfile%\Application Data\~[random]
%AllUsersProfile%\Application Data\~[random]r
%AllUsersProfile%\Application Data\[random].dll
%AllUsersProfile%\Application Data\[random].exe
%UserProfile%\Desktop\Windows XP Restore.lnk
%UserProfile%\Start Menu\Programs\Windows XP Restore\Uninstall Windows XP Restore.lnk
%UserProfile%\Start Menu\Programs\Windows XP Restore\Windows XP Restore.lnk
Delete directories:
%UserProfile%\Start Menu\Programs\Windows XP Restore
%AllUsersProfile%\Application Data\[random]

Geolocation of Windows XP Restore

Map reveals the prevalence of Windows XP Restore. Countries and regions that have been affected the most are: Philippines, United States, Canada, India and New Zealand.

Information updated:

Comments on Windows XP Restore

0
0
carson
This article really was usefull !!! Restore a Windows XP system to a previous State using System Restore.

Post a comment

Attention: Use this form only if you have additional information about a parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name



«

(All fields are required)