Title: XP Home Security 2012

Type: Rogue Antispyware

Remove XP Home Security 2012. Removal instructions

Also known as: XPHomeSecurity2012

Severity scale:

(67 / 100)

XP Home Security 2012 is a rogue anti-spyware program that simulates a system scan and reports false scan results just to scare you and make you think that your computer is infected with Trojans, worms and other malware. Once installed, it will display fake security alerts or notifications and then inform you that you need to pay money to register the program if you want to remove the infections and computer threats, which of course do not even exist. Do not pay for this software and get rid of XP Home Security 2012 from your computer upon detection using the removal stated guide below.

XP Home Security 2012 displays warnings and notifications about serious security threats and privacy issues. It will also state that it has detected many critical spyware objects and that these objects can expose private information, for example:

XP Home Security 2012 Firewall Alert
XP Home Security 2012 has blocked a program from accessing the internet
Internet Explorer is infected with Trojan-BNK.Win32.Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.

Malware Intrusion
Sensitive areas of your system were found to be under attack. Spy software attack or virus infection possible. Prevent further damage or your private data will get stolen. Run an anti-spyware scan now. Click here to start.

Of course, that's not true. This is just a part of whole scam. Besides, no matter what you decide to do, it will ask to pay for a full version of the program to protect your computer from malware and possible attacks from the Internet. Just ignore all of this and read the removal instructions carefully. Use updated anti-spyware to remove XP Home Security 2012 as soon as possible!

Note that if you can't launch your anti-spyware, there are some special tips you should know:

1. Try renaming the executable to something else, like iexplore.exe so XP Home Security 2012 will not block it.

2. From another user account on Windows XP system

3. Launch anti-malware programs from safe mode with networking.

4. Stop XP Home Security 2012 processes with task manager or other utility.

5. Using codes like 3425-814615-3990 or 9443-077673-5028 to disable malware.

This will allow running legitimate anti-malware programs and completely clean your PC from Win 7 Total Security 2012.

Automatic XP Home Security 2012 removal:

remover for XP Home Security 2012

SpyHunter is recommended remover to uninstall XP Home Security 2012. You should confirm using free trial that it detects current version of parasite.

Note: Tested and Confirmed means that we have tested spyware remover with multiple versions of XP Home Security 2012 and got the best results. There might be updated or modified version of particular parasite that require manual killing of parasite process or an update. In such case try other removers in the line.

Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove XP Home Security 2012 using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

Tested and Confirmed! STOPzilla removes XP Home Security 2012 (2011-06-08 13:42:14)

Malwarebytes Anti Malware

download | review

Tested and Confirmed! Malwarebytes Anti Malware removes XP Home Security 2012 (2011-06-08 13:42:14)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing XP Home Security 2012 (2012-01-29 21:08:52)

XoftSpySE Anti Spyware

download | review

XP Home Security 2012 manual removal:

FORUM:
Discuss XP Home Security 2012 in
spyware removal forum

Kill processes:
kdn.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation "TLDUpdates" = '1'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = '1'

HELP:
how to remove registry entries

Delete files:
%AllUsersProfile%\Application Data\u3f7pnvfncsjk2e86abfbj5h %LocalAppData%\kdn.exe %LocalAppData%\u3f7pnvfncsjk2e86abfbj5h %Temp%\u3f7pnvfncsjk2e86abfbj5h %UserProfile%\Templates\u3f7pnvfncsjk2e86abfbj5h

HELP:
how to remove harmful files

Information added: 2011-06-08 13:42:14
Information updated: 2012-01-29 18:31:37

Additional resources related to XP Home Security 2012:

Attention: If you know or you have a website or page about XP Home Security 2012 removal, feel free to add a link to this list: add url

more resources

Joe

Worked Perfectly! Thank You!

Reply »

2011 06 13

Alexis

It worked perfectly, thanks for your help!!!

Reply »

2011 06 15

macca

it doesnt work for me because the "XP Home Security 2012" prevents your download from opening. very frustrating!

Reply »

2011 06 20

wtaiii

The name of the problem exe will be a three letter exe located in the %AppData%Local Settings folder. Mine was infected with one named ljo.exe.

Reply »

2011 12 20

nhots

It worked perfectly...
Many thanks..

Reply »

2011 06 22

Aaron

I dont have a kdn.exe in my processes

Reply »

2011 06 24

Sharon

Thank you so much the manual removal steps worked a treat. The variant infecting my PC wasnt called kdn.exe it was dsl.exe

Reply »

2011 06 28

mike

executable also presenting as cpo.exe as well as kdn/dsl. watch out for those variants!

Reply »

2011 07 12

Patrice

Also showing up as gjf.exe

Reply »

2011 07 24

gmc

also showing up as xou.exe

Reply »

2011 07 25

some guy

also showing up as iov.exe

Reply »

2011 07 26

eric

tim.exe

Reply »

2011 07 27

carl

rbi on 7/30/2011

Reply »

2011 07 30

Austin

I cant terminate anything through task manager. i hit terminate and ok and nothing happens.

Reply »

2011 08 02

DWJ

only shows up as FAU.exe in task mgr. I terminate the process but cant find the file on my pc after many searches. since i cant locate the file i cant terminate it.

Reply »

2011 08 03

Noita "Brut" Sam

Also showing up as yrt.exe

Reply »

2011 08 12

Turbo

I came accross the daa.exe variant.

Reply »

2011 12 04

Joe

Also shows up as drn.exe

Reply »

2011 12 06

justin

showed up as frq also

Reply »

2011 12 16

Eli Joice

The process name is not always "kdn.exe". To find what the process is named on your PC:
1) Open Task Manager
2) Allow one of the annoying windows to pop up
3) In the "Applications" tab, right click on the pop up windows icon/name
4) At the bottom of the drop down menu, click "Go To Process"
5) This will take you directly to the process that is running, end that process and continue with the rough anti-spyware removal.
=D

Reply »

2011 12 16

RKing

I have not been able to locate the 3rd HKEY listed above or the file listed in the 3rd step.... some Im not sure what to do.

Reply »

2011 12 17

IsThereATargetOnMyHead

Just got hit by XP Home Security 2012 and whoever did it also tried to install these

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AJS%2FComesis.A
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FCutwail.BE
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit%3AWin32%2FPdfjsc.YN

Looks like someone is trying to install a root-kit. Who knows if they succeeded? I hope they get really bored watching me...

Reply »

2011 12 19

tfunk

Found it as sob.exe

Reply »

2011 12 19

nicole j

Mine came up as aai.exe
Thank you eli joice! Your suggestions worked perfectly!

Reply »

2011 12 19

peda

I found it as oey.exe

Reply »

2011 12 22

Julie

found it as ojk.exe

Reply »

2011 12 23

ConMan

Thank you so much thus us awesome!!!!!!

Reply »

2011 12 27

BND

Looks like my variant was named WUA.exe

Reply »

2011 12 30

Loustar

this code no longer works. tried it with and without the dashes - 2233-298080-3424, 3425-814615-3990 - is there another code?

Reply »

2012 01 01

Mine came up as bsq.exe. There is a really good YouTube video that helped me remove this stupid thing. Its called "How to Remove XP Home Security 2012". Its 9:14 long, and I did a bit of pausing during it, but it made things easy. Hope that helps.

Reply »

2012 01 05

Anis

If you delete the ntuser.dat file for the specific user, the program will stop running aswell. It worked for me, and its alot faster. Of course you need to have a second administrator account on your computer to be able to do that, and you need a freshly restarded pc that the infected user(on my pc it was only one user that was infected) hasnt logged into yet(if the user has logged in while the computer was started the ntuser.dat file cant be deleted for that specific user.

Reply »

2012 01 16

POPEAL

QKM.exe Removed. Stubborn.

Reply »

2012 01 16

Scharf

My suggestions for the best way to perform these tasks is to reboot and start in safe mode. then install off a usb drive...then run these anti-spam programs. Do quick and then full....after that you should be ok.

Reply »

2012 01 17

alexandar

kuta software ha sala is ne mera system hijack kr dya ha yh ek virus ha sala plzzzzzzzzzzzzzz jn k pc mein aa chuka window dobara kr lo ni to maree jao ge avien

Reply »

2012 01 18

tekctrl

I found and deleted the 3-letter executable, but then discovered that it had somehow disabled the Microsoft Updates and Microsoft Security Essentials updaes. They reported that they were on and active, but would fail if I tried to do a manual update. Just because the barrage of "Youre Infected" windows stops does Not mean that youre clean. If your systems are updating ok, well and good. If they wont update, you have more cleaning to do.

Reply »

2012 01 24

Novi

I had the virus. Downloaded the fix onto a usb drive. Fixed it. That was 4 weeks ago, now all of a sudden searchcore.net/426 shows up in my browser and the computer wont recognize my IP address. ARGH! I cannot get rid of this searchcore thing. Was there perhaps another piece of this terrible virus that did not get fixed the first time. I am ready to throw my computer out the window.

Reply »

2012 01 29

Post Comment:

Attention: Use this form only if you have additional information about XP Home Security 2012 parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Related discussions:

xp home Security 2012 removal

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.