Remove XP Security 2012
Removal instructions

Severity scale:  
  (68/100)
XP Security 2012 is also known as XPSecurity2012, XPSecurity 2012 | Type: Rogue Antispyware | Tags: Braviax

XP Security 2012 is a fake security program that pretends to be a malware removal tool. This rogue anti-spyware usually comes unnoticeably without any permission asked, so if you find XP Security 2012 on your computer you are most likely to have got it through a Trojan. These Trojans not only install this fake anti-spyware thing but also change the Registry and drop fake random files which later are detected as malware.

Security experts announce that when installed on different OS, XP Security 2012 appears in different name, though the malcode stays the same. So, when using Win 7 Antispyware name, the trial version of this parasite infects only Windows XP OS. Installed without any knowledge and consent, program firstly applies the tactics typical for this type of malware. It usually triggers fabricated general system scans that return the results which can be easily predetermined. Don’t get surprised after being informed that various threats of different severity are detected, please ignore such alerts:

Stealth intrusion!
Infection detected in the background. Your computer is now attacked by spyware and rogue software. Eliminate the infection safely, perform a security scan and deletion now.

XP Security 2012 Alert
Security Hole Detected!
A program is trying to exploit Windows security holes! Passwords and sensitive data may be stolen. Do you want to block this attack?

XP Security 2012 Alert
Internet Explorer alert. Visiting this site may pose a security threat to your system!
Possible reasons include:
- Dangerous code found in this site’s pages which installed unwanted software into your system.
- Suspicious and potentially unsafe network activity detected.
- Spyware infections in your system
- Complaints from other users about this site.
- Port and system scans performed by the site being visited.

Things you can do:
- Get a copy of Vista Security 2012 to safeguard your PC while surfing the web (RECOMMENDED)
- Run a spyware, virus and malware scan
- Continue surfing without any security measures (DANGEROUS)

XP Security 2012 also generates fake positives that report infections that are expected to make you doubt about your PC security. Keep in mind that clicking on any pop-up add will automatically get you into XP Security 2012 "official" website. These sites must be avoided because they only aggressively promote its “full” commercial version. Don’t buy this scam, because you will only support the scammers. Having XP Security 2012 “licensed” version is useless because it will lead you into finding your computer dramatically slow and vunerable to other viruses. To sum up, it must be clear that XP Security 2012 must be removed as soon as possible, so please, don’t waste any minute and delete this scam.  Also, you can use one of these codes 3425-814615-3990, 2233-298080-3424 or 9443-077673-5028 to register the rogue program. Once activated, it won't block web browsers and anti-spyware software.

Automatic XP Security 2012 removal:

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use.
By downloading any of provided Anti-spyware software to remove XP Security 2012 you agree with our Privacy Policy and Agreement of Use.
Do it now!
Download
remover for XP Security 2012 Happiness
Guarantee
Compatible with Microsoft
SpyHunter is recommended remover to uninstall XP Security 2012. You should confirm using free trial that it detects current version of parasite.
more than 40.000.000 downloads!
What to do if you failed to remove the infection?
If you failed to remove XP Security 2012 using SpyHunter, read here how to submit a support ticket or submit a question to our support team and provide as much details as possible.

Alternate Software

STOPzilla
Tested and Confirmed! STOPzilla removes XP Security 2012 (2011-06-08 13:45:40)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes XP Security 2012 (2011-06-08 13:45:40)
XoftSpySE Anti Spyware
We are testing XoftSpySE Anti Spyware's efficiency at removing XP Security 2012 (2012-04-10 17:16:46)
Defender Pro Ultimate
We are testing Defender Pro Ultimate's efficiency at removing XP Security 2012 (2012-04-10 17:16:46)
Virus Removal Phone Support
1-877-657-9614
Help Line to remove XP Security 2012

XP Security 2012 manual removal

Kill processes:
kdn.exe, ppn.exe and similar, three or more letter randomly named , processes
Delete registry values:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation "TLDUpdates" = '1'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = '1'
Delete files:
%AllUsersProfile%\Application Data\u3f7pnvfncsjk2e86abfbj5h
%AppData%\kdn.exe
%LocalAppData%\u3f7pnvfncsjk2e86abfbj5h
%Temp%\u3f7pnvfncsjk2e86abfbj5h
%UserProfile%\Templates\u3f7pnvfncsjk2e86abfbj5h
%LocalAppData%\[random characters].exe

Geolocation of XP Security 2012

This map reveals the prevalence of XP Security 2012. Countries and regions that have been affected the most are: India, Vietnam, United States, Spain and Canada.

QR code for XP Security 2012 removal instructions

XP Security 2012 qrcode QR is short for Quick Response. They can be read quickly by the mobile phones. QR codes can store more data than standard barcodes, including url links, geo coordinates, and text.
The reason we add QR code to the website is that parasites like XP Security 2012 are really hard to remove on infected computer. you can quicly scan the QR code with your mobile device and have manual removal instructions to uninstall XP Security 2012 right in your pocket.
Simply use the QR scanner and read removal instructions from mobile device.

Information added: 2011-06-08 13:45
Information updated: 2012-04-10 14:39

Additional resources

Attention: If you know know a reputable website reated to security threats, please add a link here: add url

Users comments about XP Security 2012:

1
0
K. Grey
Thanks fot the helpful information, however I found that my harmful process was named under lrl.exe
0
1
John
After removing this malware with malwarebytes, my internet explorer, outlook express, nor windows explorer work. Did I not catch everything or is there something else I need to do?
0
0
NOMAD
use combofix and then malwarebyres anti malware. That took care of my problem
0
0
Jason
The process name varies and will appear in the registry key(s). Mine was uyn.exe
0
0
Adam
I can verify Jason and K. Greys comments about the variety of the process name, on my Dads computer it was called rlm.exe. Fortunately the file name always seems to be always three letters long, once I identified it I was able to remove it.
0
0
Batclaw
When I got this it used tnj.exe not instead of kdn.exe
Example
"C:Documents and Settings...Local SettingsApplication Datatnj.exe" -a "C:Program FilesMozilla Firefoxfirefox.exe"
0
0
Dennis
Hi Dummies
Just go to an earlier restore point, shut down and restart and make an new restore point. After restart delete all previouse restore points and let malware check your system.
And done wiyh that
gretings from [edited]@gmail.com
1
0
Bo
We are trying to delete the XP Security 2012 malware program using MalwareBytes, but we cannot actually load the MalwareBytes software. We have successfully downloaded the install .exe file for MalwareBytes, but whenever we try to run it. XP Security 2012 software blocks the install program from launching. Does anyone know how to get past this or have other suggestion?
0
0
JC
I did everything listed here and ran multiple anti-malware scanners, but it wont go away! I had to give it a fake product key so its not doing anything harmful right now, but I want it gone!
0
0
JohnF
My virus file was called orw.exe, but it can have many names.

Im no expert, but... Open your task manager and watch the processes.

Now open IE or Firefox and watch for a new process to show up when security center runs. That will be the file you search for and delete at the end of all this.
0
0
gunhed
Followed the instructions... other than the obvious .exe filename difference, it worked!

Once I was able to determine the process name, I simply killed the process, dumped the offending files into another folder, deleted them, and was able to run MalwareBytes afterward. It all seems to be working now... thanks!
1
0
Bex29782
My computer wont let me restore it to an earlier time and the xp security virus wont let me get on the internet to fix it! Ive tried to delete the files but its took over my computer and wont even let me open files!! Gonna have to completely wipe my hard drive!! :( Get it off asap people!!
0
0
DDDDDDD
Use CTRL - SHIFT - ESC right after log in to bring up Task Manager. Then kill the process thats bringing up the window. Mine was named csc.exe. Once youve killed the process,. you can do the manual stuff above, but I also run Malwarebytes (Free) for a full scan to get rid of it.
0
0
Sam
Start in safe mode (F8 on boot) then install Malewarebytest. perform a complete scan to clean your system.
0
1
hasan
how to remove xp security 2012
0
0
mike
in the past killing the process has been effective, but this time it just restarts automatically. Started in safe mode, but malwarebytes wont run, the stupid malware just starts again. Tried reinstalling malware bytes, but same reaction....what to do?
2
0
Vinay
1. Running Malwarebytes :

The so called virus in this case blocks all .exe files to be executed hence ;
first rename the setup file to .bat extension and then the setup will run so you can install it.

Once installed again the .exe file in C:/Program Files/.../Malwarebtes Antimalware.exe will not work so again rename that to .bat extension and then run the application.

This time it will work and then do the full scan and it will be cleaned.

2. Other alternative Solution is running Kaspersly Virus Removal Tool in safe mode
http://support.kaspersky.com/viruses/avptool2011?level=2


3. Another Alternative[Ultimate last resort ] Kaspersky Rescue Disk
http://support.kaspersky.com/viruses/rescuedisk?level=2
0
0
john
found instructions to work but mine was installed as ivh.exe
0
0
Bert
I had do kill gju.exe proces.
0
0
radrr
Hi, my application name of XP Security 2012 was rsp.exe.
More comments...

Post Comment

Attention: Use this form only if you have additional information about XP Security 2012 parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name



«

(All fields are required)
Like us on Facebook
News
Subscribe
Ask us
Parasites
Tags
Files
What's your antispyware?
Compare
I failed to remove XP Security 2012 using SpyHunter.

Email


Close
add text box
rss feed
help other
Spreading the knowledge: It is very hard to fight against computer parasites on the Internet alone. If you have a website, we would be more than happy if you would like to cooperate and help us spread the information about latest threats. Remember, knowledge is the most powerful weapon. Help your visitors protect their computers!