Severity scale  

XP Security 2012. How to Remove? (Uninstall Guide)

removal by - -   Also known as XPSecurity2012, XPSecurity 2012 | Type: Rogue Antispyware

XP Security 2012 is a fake security program that pretends to be a malware removal tool. This rogue anti-spyware usually comes unnoticeably without any permission asked, so if you find XP Security 2012 on your computer you are most likely to have got it through a Trojan. These Trojans not only install this fake anti-spyware thing but also change the Registry and drop fake random files which later are detected as malware.

Security experts announce that when installed on different OS, XP Security 2012 appears in different name, though the malcode stays the same. So, when using Win 7 Antispyware name, the trial version of this parasite infects only Windows XP OS. Installed without any knowledge and consent, program firstly applies the tactics typical for this type of malware. It usually triggers fabricated general system scans that return the results which can be easily predetermined. Don’t get surprised after being informed that various threats of different severity are detected, please ignore such alerts:

Stealth intrusion!
Infection detected in the background. Your computer is now attacked by spyware and rogue software. Eliminate the infection safely, perform a security scan and deletion now.

XP Security 2012 Alert
Security Hole Detected!
A program is trying to exploit Windows security holes! Passwords and sensitive data may be stolen. Do you want to block this attack?

XP Security 2012 Alert
Internet Explorer alert. Visiting this site may pose a security threat to your system!
Possible reasons include:
- Dangerous code found in this site’s pages which installed unwanted software into your system.
- Suspicious and potentially unsafe network activity detected.
- Spyware infections in your system
- Complaints from other users about this site.
- Port and system scans performed by the site being visited.

Things you can do:
- Get a copy of Vista Security 2012 to safeguard your PC while surfing the web (RECOMMENDED)
- Run a spyware, virus and malware scan
- Continue surfing without any security measures (DANGEROUS)

XP Security 2012 also generates fake positives that report infections that are expected to make you doubt about your PC security. Keep in mind that clicking on any pop-up add will automatically get you into XP Security 2012 "official" website. These sites must be avoided because they only aggressively promote its “full” commercial version. Don’t buy this scam, because you will only support the scammers. Having XP Security 2012 “licensed” version is useless because it will lead you into finding your computer dramatically slow and vunerable to other viruses. To sum up, it must be clear that XP Security 2012 must be removed as soon as possible, so please, don’t waste any minute and delete this scam.  Also, you can use one of these codes 3425-814615-3990, 2233-298080-3424 or 9443-077673-5028 to register the rogue program. Once activated, it won't block web browsers and anti-spyware software.

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use. By downloading any of provided Anti-spyware software you agree with our Privacy Policy and Agreement of Use.
Do it now!
Reimage - remover Happiness
Compatible with Microsoft Windows
What to do if failed?
If you failed to remove infection using Reimage Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall XP Security 2012. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Reimage is recommended remover to uninstall XP Security 2012. You should confirm using free trial that it detects current version of parasite.
Not using OS X? Download a remover for Windows.
Press Mentions on Reimage
Alternate Software
Alternate Software
We are testing Reimage's efficiency (2012-04-10 14:39)
Tested and Confirmed! STOPzilla removes XP Security 2012 (2011-06-08 13:45:40)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes XP Security 2012 (2011-06-08 13:45:40)
Tested and Confirmed! STOPzilla removes XP Security 2012 (2011-06-08 13:45:40)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes XP Security 2012 (2011-06-08 13:45:40)
Webroot SecureAnywhere AntiVirus

XP Security 2012 manual removal

Kill processes:
kdn.exe, ppn.exe and similar, three or more letter randomly named , processes
Delete registry values:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation "TLDUpdates" = '1'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = '1'
Delete files:
%AllUsersProfile%\Application Data\u3f7pnvfncsjk2e86abfbj5h
%LocalAppData%\[random characters].exe

Geolocation of XP Security 2012

Map reveals the prevalence of XP Security 2012. Countries and regions that have been affected the most are: India, Vietnam, United States, Spain and Canada.

Information updated:

Comments on XP Security 2012

psf.exe on mine and thanks for the .bat tip it worked beautifully.^-^
sir, the registration key working fine--3425-814615-3990 -- now it is accepted this , what else i do sir, is that my poplem solved?//
As now computer is working normal with all firewall protection , auto update ,pc protection all ON
Ive done everything listed above, but I still cant renew my ip address! This is driving me crazy. tried to use system restore, but it wont let me. My files seem to be clear, although in my system32/drivers folder, I got a warning from AVG that my netbt.sys file is infected. b
My virus name was jua.exe. First I killed the process to be able to access thee internet. Then i searched for it and deleted it. But then after for some reason I wasnt able to open .exe files so I went to the registry data by typing in regedit on the command prompt and had to change the exe value to exefiles (I followed this video: After I downloaded malwarebytes and they took care of the rest :)
I had just downloaded Malwarebytes and was about to install it when McAfee started automatically downloading an update. I waited for it to finish, as the update process is a big memory hog on my old computer, and at the end of the installation, McAfee notified me it had removed a trojan named gey.exe. This was the 3-letter name the XP Security 2012 was using. And it was totally gone - I rebooted, and it didnt come back! McAfee did the job automatically.
Go into safe mode (usually hit the F12 button on the load up page before the windows logo) once in safe mode restore to a few days previous to infection and then itt will be gone, then scan computer for malware and anti virus.
More comments »

Post a comment

Attention: Use this form only if you have additional information about a parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name


(All fields are required)