XP Home Security 2012. How to remove? (Uninstall guide)

removal by Linas Kiguolis - -   Also known as XPHomeSecurity2012 | Type: Rogue Antispyware
12

XP Home Security 2012 is a rogue anti-spyware program that simulates a system scan and reports false scan results just to scare you and make you think that your computer is infected with Trojans, worms and other malware. Once installed, it will display fake security alerts or notifications and then inform you that you need to pay money to register the program if you want to remove the infections and computer threats, which of course do not even exist. Do not pay for this software and get rid of XP Home Security 2012 from your computer upon detection using the removal stated guide below.

XP Home Security 2012 displays warnings and notifications about serious security threats and privacy issues. It will also state that it has detected many critical spyware objects and that these objects can expose private information, for example:

XP Home Security 2012 Firewall Alert
XP Home Security 2012 has blocked a program from accessing the internet
Internet Explorer is infected with Trojan-BNK.Win32.Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.

Malware Intrusion
Sensitive areas of your system were found to be under attack. Spy software attack or virus infection possible. Prevent further damage or your private data will get stolen. Run an anti-spyware scan now. Click here to start.

Of course, that's not true. This is just a part of whole scam. Besides, no matter what you decide to do, it will ask to pay for a full version of the program to protect your computer from malware and possible attacks from the Internet. Just ignore all of this and read the removal instructions carefully. Use updated anti-spyware to remove XP Home Security 2012 as soon as possible!

Note that if you can't launch your anti-spyware, there are some special tips you should know:

1. Try renaming the executable to something else, like iexplore.exe so XP Home Security 2012 will not block it.

2. From another user account on Windows XP system

3. Launch anti-malware programs from safe mode with networking.

4. Stop XP Home Security 2012 processes with task manager or other utility.

5. Using codes like 3425-814615-3990 or 9443-077673-5028 to disable malware.

This will allow running legitimate anti-malware programs and completely clean your PC from Win 7 Total Security 2012.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove XP Home Security 2012 you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall XP Home Security 2012. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

More information about this program can be found in Reimage review.

XP Home Security 2012 manual removal:

Kill processes:
kdn.exe

Delete registry values:
HKEY_USERS.DEFAULTSoftwareMicrosoftInternet ExplorerBrowserEmulation "TLDUpdates" = '1'

HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "%1" %*'

HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "%1" %*'

HKEY_CLASSES_ROOT.exeshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "%1" %*'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "C:Program FilesMozilla Firefoxfirefox.exe"'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellsafemodecommand "(Default)" = '"%LocalAppData%kdn.exe" -a "C:Program FilesMozilla Firefoxfirefox.exe" -safe-mode'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "C:Program FilesInternet Exploreriexplore.exe"'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "AntiVirusOverride" = '1'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "FirewallOverride" = '1'

Delete files:
%AllUsersProfile%Application Datau3f7pnvfncsjk2e86abfbj5h

%LocalAppData%kdn.exe

%LocalAppData%u3f7pnvfncsjk2e86abfbj5h

%Temp%u3f7pnvfncsjk2e86abfbj5h

%UserProfile%Templatesu3f7pnvfncsjk2e86abfbj5h

About the author

Linas Kiguolis
Linas Kiguolis - Expert in social media

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

More information about the author


  • Joe

    Worked Perfectly! Thank You!

  • Alexis

    It worked perfectly, thanks for your help!!!

  • macca

    it doesnt work for me because the “XP Home Security 2012” prevents your download from opening. very frustrating!

    • wtaiii

      The name of the problem exe will be a three letter exe located in the %AppData%Local Settings folder. Mine was infected with one named ljo.exe.

  • nhots

    It worked perfectly…
    Many thanks..

  • Aaron

    I dont have a kdn.exe in my processes

  • Sharon

    Thank you so much the manual removal steps worked a treat. The variant infecting my PC wasnt called kdn.exe it was dsl.exe

  • mike

    executable also presenting as cpo.exe as well as kdn/dsl. watch out for those variants!

  • Patrice

    Also showing up as gjf.exe

  • gmc

    also showing up as xou.exe

  • some guy

    also showing up as iov.exe

  • Austin

    I cant terminate anything through task manager. i hit terminate and ok and nothing happens.

  • DWJ

    only shows up as FAU.exe in task mgr. I terminate the process but cant find the file on my pc after many searches. since i cant locate the file i cant terminate it.

  • Noita “Brut” Sam

    Also showing up as yrt.exe

  • Turbo

    I came accross the daa.exe variant.

  • Joe

    Also shows up as drn.exe

  • justin

    showed up as frq also

  • Eli Joice

    The process name is not always “kdn.exe”. To find what the process is named on your PC:
    1) Open Task Manager
    2) Allow one of the annoying windows to pop up
    3) In the “Applications” tab, right click on the pop up windows icon/name
    4) At the bottom of the drop down menu, click “Go To Process”
    5) This will take you directly to the process that is running, end that process and continue with the rough anti-spyware removal.
    =D

  • RKing

    I have not been able to locate the 3rd HKEY listed above or the file listed in the 3rd step…. some Im not sure what to do.

  • IsThereATargetOnMyHead

    Just got hit by XP Home Security 2012 and whoever did it also tried to install these

    http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AJS%2FComesis.A
    http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FCutwail.BE
    http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit%3AWin32%2FPdfjsc.YN

    Looks like someone is trying to install a root-kit. Who knows if they succeeded? I hope they get really bored watching me…

  • tfunk

    Found it as sob.exe

  • nicole j

    Mine came up as aai.exe
    Thank you eli joice! Your suggestions worked perfectly!

  • peda

    I found it as oey.exe

  • Julie

    found it as ojk.exe

  • ConMan

    Thank you so much thus us awesome!!!!!!

  • BND

    Looks like my variant was named WUA.exe

  • Loustar

    this code no longer works. tried it with and without the dashes – 2233-298080-3424, 3425-814615-3990 – is there another code?

  • OD

    Mine came up as bsq.exe. There is a really good YouTube video that helped me remove this stupid thing. Its called “How to Remove XP Home Security 2012”. Its 9:14 long, and I did a bit of pausing during it, but it made things easy. Hope that helps.

  • Anis

    If you delete the ntuser.dat file for the specific user, the program will stop running aswell. It worked for me, and its alot faster. Of course you need to have a second administrator account on your computer to be able to do that, and you need a freshly restarded pc that the infected user(on my pc it was only one user that was infected) hasnt logged into yet(if the user has logged in while the computer was started the ntuser.dat file cant be deleted for that specific user.

  • POPEAL

    QKM.exe Removed. Stubborn.

  • Scharf

    My suggestions for the best way to perform these tasks is to reboot and start in safe mode. then install off a usb drive…then run these anti-spam programs. Do quick and then full….after that you should be ok.

  • alexandar

    kuta software ha sala is ne mera system hijack kr dya ha yh ek virus ha sala plzzzzzzzzzzzzzz jn k pc mein aa chuka window dobara kr lo ni to maree jao ge avien

  • tekctrl

    I found and deleted the 3-letter executable, but then discovered that it had somehow disabled the Microsoft Updates and Microsoft Security Essentials updaes. They reported that they were on and active, but would fail if I tried to do a manual update. Just because the barrage of “Youre Infected” windows stops does Not mean that youre clean. If your systems are updating ok, well and good. If they wont update, you have more cleaning to do.

  • Novi

    I had the virus. Downloaded the fix onto a usb drive. Fixed it. That was 4 weeks ago, now all of a sudden searchcore.net/426 shows up in my browser and the computer wont recognize my IP address. ARGH! I cannot get rid of this searchcore thing. Was there perhaps another piece of this terrible virus that did not get fixed the first time. I am ready to throw my computer out the window.