XP Internet Security 2010: what it is and how to remove it
XP Internet Security 2010 is a rogue security program that reports false threats and displays fake security alerts to make you think that your computer is infected. This malware is distributed through the use of Trojans that usually come from fake online anti-malware scanners or misleading video websites.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Unsure whether HKEY_CLASSES_ROOT.exe is safe? A free scan checks the file and what starts it.
Do it yourself · free Remove XP Internet Security 2010 yourself 5 steps, about 15 minutes, no software needed.
Start the stepsXP Internet Security 2010: summary
| Detection names | No Microsoft detection name is known |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Name | XP Internet Security 2010 |
| Type | Rogue antivirus |
| Symptoms | An unknown process in Task Manager |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 4 more facts
| Files and processes | HKEY_CLASSES_ROOT.exe |
|---|---|
| Evidence | One write-up by a security site; details still limited |
| First seen | 26 April 2021 |
| Facts checked | 7 October 2026 |
From our report of Apr 2021 · not reviewed since
What XP Internet Security 2010 is
XP Internet Security 2010 is a rogue security program that reports false threats and displays fake security alerts to make you think that your computer is infected.
This malware is distributed through the use of Trojans that usually come from fake online anti-malware scanners or misleading video websites. Once a Trojan virus is installed, it will download and install virus on your PC. Sometimes called as XP Internet Security 2011, the rogue program comes as an update for Windows. The rogue program itself is a typical scareware.
It reports false infections and asks to pay for a full version of the program to supposedly remove those infections. The most important thing to remember is that XPInternet Security 2010 is a scam, don't buy it! Instead please use the removal guide below to remove this infection from your PC as soon as possible.
Unfortunately, XP Internet Security 2010 uses aggressive methods to protect itself from being removed. It blocks anti-virus and anti-malware software. It may block other programs too, even if they are not related with computer security. XP Internet Security 2010 has a list of executable files that can be launched and it checks that list every time you open a particular program.
What is more, it modifies Windows registry and hijacks Internet Explorer and Firefox web browsers. This parasite will display fake security warnings and block certain websites claiming that those websites are dangerous and host malware. XPInternetSecurity2010 removal instructions: 1.
Click Start->Run (or WinKey+R). Input: "command". Press Enter or click OK. 2.
Type "notepad" as shown in the image below and press Enter. Notepad will open. 3. Copy and past the following text into Notepad:
4. Save file as "exefix.reg" (without quotation-marks) to your Desktop. NOTE: choose Save as type: All files 5. Double-click to open exefix.reg.
Click "Yes" for Registry Editor prompt window. 6. Download Spyware Doctor or an automatic removal tool below. Update Spyware Doctor and run a full system scan.
If you can't complete the above steps then please use another PC to download an automatic removal tool and exefix.reg (Right Click (Save Target As)) to download file. Copy these files to USB flash drive or any other external media and transfer them to infected computer. Launch exefix.reg file first and then install Spyware Doctor.
Is XP Internet Security 2010 a real security program?
Names and addresses to look for
- File:
HKEY_CLASSES_ROOT.exe
How to remove XP Internet Security 2010
Nothing it reports is real.
These steps remove it and undo a payment if you made one.
Step 1: Do not pay, and undo a payment if you made one
Nothing that XP Internet Security 2010 says it found needs fixing by it. Close its windows and do not enter card details.
If you bought it, contact your bank or card issuer about a dispute and cancel any renewal, keeping the receipt e-mail as evidence. Uninstalling it from Windows 11 or Windows 10 removes the program but leaves the subscription running.
Full procedure with screenshots: What to do after paying a scammer
Step 2: Uninstall programs you did not mean to install
XP Internet Security 2010 rarely comes alone: it is usually installed by, or together with, a free program. In Windows 11 open Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and sort by install date.
Uninstall every entry from the day the trouble began that you did not install on purpose, for example a download manager, a converter or a browser you never chose.
Keep drivers and entries from Microsoft, Intel, AMD, NVIDIA or your PC's maker unless you are sure.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after XP Internet Security 2010, its publisher or created on the day the problem started.Delete those folders, and check
C:\Program FilesandC:\Program Files (x86)too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 5: Scan the PC, then run the offline scan
A scan finds the parts of XP Internet Security 2010 that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
Questions about XP Internet Security 2010
Is HKEY_CLASSES_ROOT.exe safe?
It depends on where the file is and who signed it, not on the name. Open Task Manager, go to the Details tab, right-click HKEY_CLASSES_ROOT.exe and choose Open file location. A file inside Program Files or System32 with a valid digital signature from a known company is usually part of a legitimate program.
A file in AppData, Temp or ProgramData with no signature, especially one that restarts itself after you end it, is suspicious. If you cannot tie the process to anything you installed, uninstall recent unfamiliar programs and run a Microsoft Defender Offline scan.
Can I end HKEY_CLASSES_ROOT.exe in Task Manager?
Ending an unknown process is safe in the sense that Windows will warn you before you close anything critical, and a restart brings back whatever Windows needs. Ending HKEY_CLASSES_ROOT.exe will not remove it, though: if a task or startup entry launches it, it returns at the next sign-in.
Use ending the process as a test. If something important stops working, it belonged to a program you use. If nothing changes and it comes back by itself, find and disable its starter, delete the file and scan the PC.
Is XP Internet Security 2010 a real Windows warning?
No. Real Windows Security notifications appear in the notification area and in the Windows Security app, use Microsoft's design and never ask you to call a phone number or pay to fix anything. What people report is an unfamiliar process called HKEY_CLASSES_ROOT.exe in Task Manager, drawn by a program that copies the look of a system message.
Open Windows Security from the Start menu to see the real status of your PC. If it shows no threats while the window keeps appearing, the window itself is the problem, and the plan in this guide removes the program that shows it.
Is my card safe after buying XP Internet Security 2010?
Treat it as exposed. The order page belongs to the seller of XP Internet Security 2010, and you cannot know how the number is stored or shared. Ask your bank for a replacement card, which is usually free, and dispute the original charge as a misrepresented product.
Until the new card arrives, check your account daily for small or foreign transactions. If the bank offers alerts for every card payment, turn them on. Keep the receipt and screenshots, because they support the dispute.
Do I need to reinstall Windows to get rid of XP Internet Security 2010?
Usually not. A thorough clean-up is enough when the offline scan finds nothing afterwards and you do not see an unfamiliar process called HKEY_CLASSES_ROOT.exe in Task Manager again. A reset is the safer choice if an attacker had remote control, if security tools were switched off, or if detections come back after every clean-up.
Windows 11 can reset itself without a USB stick under Settings > System > Recovery > Reset this PC. Copy documents and photos out first and scan the copies. A reset does not change passwords or undo stolen data, so the account steps still apply.
What could the caller do while connected to my PC?
Anything you could do. Callers working with fake alerts like XP Internet Security 2010 typically show you Windows logs as "proof", install their own remote tool for later, and steer you to online banking or a gift card purchase. Some add a password to Windows or lock the PC if you refuse to pay.
Remove every remote access program you did not install yourself, check Settings > Accounts > Other users for new accounts, and change important passwords from a clean device. If you cannot be sure what was changed, a reset of Windows is the safe choice.
What if I paid XP Internet Security 2010?
Contact your bank or card issuer the same day, explain that the payment went to a fake security program and ask for a chargeback. Keep screenshots of an unfamiliar process called HKEY_CLASSES_ROOT.exe in Task Manager, the payment receipt and any e-mails.
If you gave card details in the program, ask the bank to block and replace the card. Then uninstall the program and run a full scan in Windows Security. If you also called a number and let someone connect to your PC, uninstall the remote-access tool they used and change your passwords from another device.
Someone called offering a refund for XP Internet Security 2010. Is it genuine?
Almost certainly not. Refund calls are a well-known second stage of scareware and tech support scams. The caller says you are owed money, asks you to install a remote access program to "process" it, then opens your online banking, makes it look as if too much was refunded and asks you to send the difference back.
Hang up. Real refunds go back to the card or PayPal account you paid with, through your bank or the payment provider, and never need remote access or a gift card.
Will Fortect remove XP Internet Security 2010?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For XP Internet Security 2010, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)
- Microsoft Learn: How Microsoft names malware (read October 7, 2026)