Title: XP Defender Pro

Type: Rogue Antispyware

Remove XP Defender Pro. Removal instructions

Also known as: XP Defender Pro

Severity scale:

(68 / 100)

XP Defender Pro is a rogue anti-spyware program distributed and installed through the use of Trojans that pretend to be legitimate programs. Once installed, Trojan virus will install the rogue and configure it to start automatically when you log on into your computer. When running, XP Defender Pro will simulate a system scan and report numerous infections on your computer. The rogue program will then claim that it will not remove these files until you first purchase it. This is nothing more but a scam. You should remove this virus from your computer as soon as possible using the removal instructions below.

XP Defender Pro will also display a fake security alerts and fake Windows Security Center screen that will suggest that you purchase XP Defender Pro. The rogue program will also hijack Internet Explorer so that it randomly displays a security warning when you browse the web. This security warning will state that the site you are visiting is infected or malicious and that you should purchase XP Defender Pro to protect yourself. What is more, this fake program will block legitimate antivirus programs and certain Windows system tools to protect itself from being removed.

As you can see, you should not purchase XP Defender Pro. If you have already purchased the program, then you should contact your credit card company and dispute the charges. The please use the removal instructions below and remove XP Defender Pro from your computer.

XP Defender Pro removal instructions:

1. Click Start->Run (or WinKey+R). Input: "command". Press Enter or click OK.

2. Type "notepad" as shown in the image below and press Enter. Notepad will open.

3. Copy and past the following text into Notepad:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USERSoftwareClasses.exe]
[-HKEY_CURRENT_USERSoftwareClassessecfile]
[-HKEY_CLASSES_ROOTsecfile]
[-HKEY_CLASSES_ROOT.exeshellopencommand]

[HKEY_CLASSES_ROOTexefileshellopencommand]
@=""%1" %*"

[HKEY_CLASSES_ROOT.exe]
@="exefile"
"Content Type"="application/x-msdownload"

4. Save file as "exefix.reg" (without quotation-marks) to your Desktop.
NOTE: choose Save as type: All files

5. Double-click to open exefix.reg. Click "Yes" for Registry Editor prompt window.

6. Download Spyware Doctor or an automatic removal tool below. Update Spyware Doctor and run a full system scan.

If you can't complete the above steps then please use another PC to download an automatic removal tool and exefix.reg (Right Click (Save Target As)) to download file. Copy these files to USB flash drive or any other external media and transfer them to infected computer. Launch exefix.reg file first and then install Spyware Doctor.

Related files: ave.exe, av.exe

XP Defender Pro properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Stays resident in background

XP Defender Pro snapshot:

Automatic XP Defender Pro removal:

remover for XP Defender Pro

SpyHunter is recommended remover to uninstall XP Defender Pro. You should confirm using free trial that it detects current version of parasite.

Note: Tested and Confirmed means that we have tested spyware remover with multiple versions of XP Defender Pro and got the best results. There might be updated or modified version of particular parasite that require manual killing of parasite process or an update. In such case try other removers in the line.

Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove XP Defender Pro using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

Tested and Confirmed! STOPzilla removes XP Defender Pro (2010-03-18 05:42:37)

Malwarebytes Anti Malware

download | review

Tested and Confirmed! Malwarebytes Anti Malware removes XP Defender Pro (2010-03-18 05:42:37)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing XP Defender Pro (2011-05-20 09:42:49)

XoftSpySE Anti Spyware

download | review

XP Defender Pro manual removal:

FORUM:
Discuss XP Defender Pro in
spyware removal forum

Kill processes:
av.exe ave.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "%1" %*
HKEY_CURRENT_USERSoftwareClassessecfileshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "%1" %*
HKEY_CLASSES_ROOT.exeshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "%1" %*
HKEY_CLASSES_ROOTsecfileshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "%1" %*
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "C:Program FilesMozilla Firefoxfirefox.exe"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellsafemodecommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "C:Program FilesMozilla Firefoxfirefox.exe" -safe-mode
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "C:Program FilesInternet Exploreriexplore.exe"
HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "%1" %*
HKEY_CURRENT_USERSoftwareClassessecfileshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "%1" %*
HKEY_CLASSES_ROOT.exeshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "%1" %*
HKEY_CLASSES_ROOTsecfileshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "%1" %*
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "C:Program FilesMozilla Firefoxfirefox.exe"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellsafemodecommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "C:Program FilesMozilla Firefoxfirefox.exe" -safe-mode
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "C:Program FilesInternet Exploreriexplore.exe"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "AntiVirusOverride" = "1"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "FirewallOverride" = "1"

HELP:
how to remove registry entries

Delete files:
av.exe ave.exe

HELP:
how to remove harmful files

Delete directories:
C:Documents and SettingsAll UsersApplication DataQJyrk5wvCU1
%UserProfile%Local SettingsApplication DataQJyrk5wvCU1
%UserProfile%Local SettingsApplication DataWRblt8464P
%UserProfile%Local SettingsTempQJyrk5wvCU1
%UserProfile%TemplatesQJyrk5wvCU1

Information added: 2010-03-18 05:42:37
Information updated: 2011-05-20 07:05:34

Additional resources related to XP Defender Pro:

Attention: If you know or you have a website or page about XP Defender Pro removal, feel free to add a link to this list: add url

more resources

I did this and ran spyware doctor and it did not work...

Reply »

2010 04 06

<Guest>

The above instructions to remove the XP defender pro trojan worked out amazingly.
I was not able to use Internet explorer to even read this page. I used firefox to complete the instructions stated above. Thanks for this post.
Good Luck.

Reply »

2010 04 17

Post Comment:

Attention: Use this form only if you have additional information about XP Defender Pro parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.