Title: XP Defender

Type: Rogue Antispyware

Remove XP Defender. Removal instructions

Also known as: XPDefender

Severity scale:

(68 / 100)

XP Defender is a rogue security program that reports false scan results and displays fake security alerts to convince you that your computer is infected with malware. This fake program is a clone of XP Internet Security 2010 and XP Defender Pro. Usually, XPDefender is promoted through the use of Trojans and fake online anti-malware scanners as well as various misleading websites. Usually, Trojans are disguised as video codecs required to view certain online videos.

Once active, XP Defender will supposedly scan your computer and displays a variety of infections and claim that those security threats can be removed only with a registered version of XP Defender. Don't buy it!. This is a scam. Furthermore, XP Defender will constantly display fake security alerts. These fake alerts may appear like every minute or two. It will also impersonate Windows Security Center and display counterfeit notifications form Task bar claiming that anti-virus protection is disabled or that your computer is under attack.

Last, but not least, XP Defender will hijack your Internet browser and redirect you to various misleading websites full of ads. You should remove this parasite from the system upon detection. Please use the removal instructions below to remove XP Defender from your computer either manually or with an automatic removal tool.

XP Defender removal instructions:

1. Click Start->Run (or WinKey+R). Input: "command". Press Enter or click OK.

2. Type "notepad" as shown in the image below and press Enter. Notepad will open.

3. Copy and past the following text into Notepad:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand]
[-HKEY_CURRENT_USERSoftwareClassessecfileshellopencommand]
[-HKEY_CLASSES_ROOT.exeshellopencommand]

[HKEY_CLASSES_ROOT.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[-HKEY_CLASSES_ROOTsecfile]

4. Save file as "exefix.reg" (without quotation-marks) to your Desktop.
NOTE: choose Save as type: All files

5. Double-click to open exefix.reg. Click "Yes" for Registry Editor prompt window.

6. Download Spyware Doctor or an automatic removal tool below. Update Spyware Doctor and run a full system scan.

If you can't complete the above steps then please use another PC to download an automatic removal tool and exefix.reg (Right Click (Save Target As)) to download file. Copy these files to USB flash drive or any other external media and transfer them to infected computer. Launch exefix.reg file first and then install Spyware Doctor.

Related files: av.exe, ave.exe

XP Defender properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Stays resident in background

XP Defender snapshot:

Automatic XP Defender removal:

remover for XP Defender

SpyHunter is recommended remover to uninstall XP Defender. You should confirm using free trial that it detects current version of parasite.

Note: Tested and Confirmed means that we have tested spyware remover with multiple versions of XP Defender and got the best results. There might be updated or modified version of particular parasite that require manual killing of parasite process or an update. In such case try other removers in the line.

Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove XP Defender using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

Tested and Confirmed! STOPzilla removes XP Defender (2010-04-06 07:38:15)

Malwarebytes Anti Malware

download | review

Tested and Confirmed! Malwarebytes Anti Malware removes XP Defender (2010-04-06 07:38:15)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing XP Defender (2010-04-06 10:18:07)

XoftSpySE Anti Spyware

download | review

XP Defender manual removal:

FORUM:
Discuss XP Defender in
spyware removal forum

Kill processes:
av.exe ave.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "%1" %*
HKEY_CURRENT_USERSoftwareClassessecfileshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "%1" %*
HKEY_CLASSES_ROOT.exeshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "%1" %*
HKEY_CLASSES_ROOTsecfileshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "%1" %*
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "C:Program FilesMozilla Firefoxfirefox.exe"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellsafemodecommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "C:Program FilesMozilla Firefoxfirefox.exe" -safe-mode
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataav.exe" /START "C:Program FilesInternet Exploreriexplore.exe"
HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "%1" %*
HKEY_CURRENT_USERSoftwareClassessecfileshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "%1" %*
HKEY_CLASSES_ROOT.exeshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "%1" %*
HKEY_CLASSES_ROOTsecfileshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "%1" %*
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "C:Program FilesMozilla Firefoxfirefox.exe"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellsafemodecommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "C:Program FilesMozilla Firefoxfirefox.exe" -safe-mode
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = "%UserProfile%Local SettingsApplication Dataave.exe" /START "C:Program FilesInternet Exploreriexplore.exe"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "AntiVirusOverride" = "1"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "FirewallOverride" = "1"

HELP:
how to remove registry entries

Delete files:
av.exe ave.exe

HELP:
how to remove harmful files

Delete directories:
C:Documents and SettingsAll UsersApplication DataQJyrk5wvCU1
%UserProfile%Local SettingsApplication DataQJyrk5wvCU1
%UserProfile%Local SettingsApplication DataWRblt8464P
%UserProfile%Local SettingsTempQJyrk5wvCU1
%UserProfile%TemplatesQJyrk5wvCU1

Information added: 2010-04-06 07:38:15
Information updated: 2010-04-06 07:40:52

Additional resources related to XP Defender:

Attention: If you know or you have a website or page about XP Defender removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about XP Defender parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Related discussions:

Advanced XP Defender

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.