Severity scale:  

XP Total Security 2011. How to remove? (Uninstall guide)

removal by Ugnius Kiguolis - -   Also known as XPTotalSecurity2011 | Type: Rogue Antispyware

XP Total Security 2011 is a rogue security program that is promoted through the use of Trojans. When this fake program is running, it will simulate a system scan and display a list of false system security threats. XP Total Security 2011 will display fake security warnings and impersonate Windows Security Center to make this scam look more realistic. It will also hijack your web browser and block antivirus and anti-spyware programs. Finally the rogue program will ask you to pay for a full version of the program to remove the non-existing infections. Don’t purchase it and remove XP Total Security 2011 from your computer upon detection.

XP Total Security 2011 protects itself quite effectively. It blocks legitimate security software and hijack web browsers. In some cases it blocks all programs, not only anti-virus or anti-spyware software. What is more, it will detect many of well known and reputable websites as harmful and display fake security alert stating that you may infect your PC if you open a particular website. And of course, it disables certain Windows functions such as Task Manager. It’s possible to remove it manually, but you have to re-enable those Windows functions at first. You may also download an automatic removal tool, but again have to fix some registry entries and terminate the main process of XP Total Security 2011 to be able to use malware removal tool. As you can see, XP Total Security 2011 is nothing more but a scam. If you have already purchased this rogue program then contact your credit card company and dispute the charges.

When trying to remove XP Total Security 2011, enter its manual registration code: 1147-175591-6550. Malware will think that you have paid for it and then will allow you to launch other security programs.

If this fails, reboot into safe mode with networking, kill its malicious processes and run licensed anti-spyware.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove XP Total Security 2011 you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall XP Total Security 2011. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.
Press mentions on Reimage

XP Total Security 2011 manual removal:

Kill processes:

Delete registry values:
HKEY_CURRENT_USERSoftwareClasses.exe "(Default)" = 'exefile'

HKEY_CURRENT_USERSoftwareClasses.exe "Content Type" = 'application/x-msdownload'

HKEY_CURRENT_USERSoftwareClasses.exeDefaultIcon "(Default)" = '%1' = '"%UserProfile%Local SettingsApplication Data[random].exe" /START "%1" %*'

HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand "IsolatedCommand" = '"%1" %*'

HKEY_CURRENT_USERSoftwareClasses.exeshellrunascommand "(Default)" = '"%1" %*'

HKEY_CURRENT_USERSoftwareClasses.exeshellrunascommand "IsolatedCommand" = '"%1" %*'

HKEY_CURRENT_USERSoftwareClassesexefile "(Default)" = 'Application'

HKEY_CURRENT_USERSoftwareClassesexefile "Content Type" = 'application/x-msdownload'

HKEY_CURRENT_USERSoftwareClassesexefileDefaultIcon "(Default)" = '%1'

HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[random].exe" /START "%1" %*'

HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand "IsolatedCommand" = '"%1" %*'

HKEY_CURRENT_USERSoftwareClassesexefileshellrunascommand "(Default)" = '"%1" %*'

HKEY_CURRENT_USERSoftwareClassesexefileshellrunascommand "IsolatedCommand" - '"%1" %*'

HKEY_CLASSES_ROOT.exeDefaultIcon "(Default)" = '%1'

HKEY_CLASSES_ROOT.exeshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[random].exe" /START "%1" %*'

HKEY_CLASSES_ROOT.exeshellopencommand "IsolatedCommand" = '"%1" %*'

HKEY_CLASSES_ROOT.exeshellrunascommand "(Default)" = '"%1" %*'

HKEY_CLASSES_ROOT.exeshellrunascommand "IsolatedCommand" = '"%1" %*'

HKEY_CLASSES_ROOTexefile "Content Type" = 'application/x-msdownload'

HKEY_CLASSES_ROOTexefileshellopencommand "IsolatedCommand" = '"%1" %*'

HKEY_CLASSES_ROOTexefileshellrunascommand "IsolatedCommand" = '"%1" %*'

HKEY_CLASSES_ROOTexefileshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[random].exe" /START "%1" %*'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[random].exe" /START "C:Program FilesMozilla Firefoxfirefox.exe"'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellsafemodecommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[random].exe" /START "C:Program FilesMozilla Firefoxfirefox.exe" -safe-mode'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = '"%UserProfile%Local SettingsApplication Data[random].exe" /START "C:Program FilesInternet Exploreriexplore.exe"'

Delete files:

Delete directories:



About the author

Ugnius Kiguolis
Ugnius Kiguolis - The mastermind

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Ugnius Kiguolis
About the company Esolutions

  • KrylovGrigorij29

    профессиональная модель работа киев, достойная оплата.

  • Natasha

    This totally worked. Thanx very much for the help:-)

  • Ryanpkmn

    I used the registrtion code so it let me do everything else. that seems to let me get the remover on. thanks.

  • Mat

    I used these instructions to remove XP total security manually. works great now thanks!!

  • Robert G.

    Thank you so much!

  • MM


    When trying to remove XP Total Security 2011, enter its manual registration code: 1147-175591-6550. Malware will think that you have paid for it and then will allow you to launch other security programs.

    NOT TRUE NOT TRUE AND NOT TRUE, dont trust this solution

  • EDWIN 727

    Gracias… mil gracias… si no es por que encontre su valiosa pagina no se que habria hecho porque este programa me tenia bloqueado el pc…}
    gracias nuevamente

  • Azariel

    How do we remove XP Security 2011 off your computer. Here my email. [edited]



  • Jana

    Thank you, I hate XP total security I just fix my computer. Thanks to XP security 2011 I lost all my data and stil dont have antivirus protection. They just took youre money.

  • Andy Thomson

    I want to confirm the spot-on-ness of the manual removal instructions on this page. I am hugely grateful, as XP Total Security 2011 was a real nuisance virus/Trojan to have picked up.
    The only bit of the registry fix that didnt match exactly what I have, was HKEY_CLASSES_ROOT.exe key had no malicious settings, they were all in the exefile key. Thanks again!

  • Amanda

    My pc has that virus and I cant figure out what processes to kill. I ended it on task manager but it just comes back. My McAfee Total protection didnt block it and I did a McAfee scan and it says no problems found. My AVG security program also did not detect it and neither did my Microsoft Security Essentials program. I was able to scan with all my security programs and they still do not detect it but the virus icon is still there and keeps popping up with fake alerts. It also blocks internet explorer. What should I do? please help.

  • jaicne

    Dont bother trying to get a refund if you use a VISA card they wont refund it under the buyer beware clause.

  • Renee Martin

    I was terrified when the scam was played on me and so stupidly I bought the product and now I dont know how to get refund. I am totally broke, fighting cancer, a single Mom and I need help.

  • Josh

    Johnny, what may have happened is that the definition of the .exe file-type was deleted. The easiest way to fix this would be to download a file that would re-associate the .exe files. Here is a link that may help:

  • Claire

    Has anyone tried restoring their PC? After not having much luck with
    the malware (it downloaded but kept freezing up) and PC Doctor, I decided
    to try that while in Safe Mode. It appears to have worked. I clocked back
    to 24 hours before the virus popped up on my screen.

    Now, that Ive suggested this, does anyone know why this would NOT
    work? Id appreciate any feedback if I still need to take other precautions.

  • Claire

    Has anyone tried restoring their PC? After not having much luck with
    the malware (it downloaded but kept freezing up) and PC Doctor, I decided
    to try that while in Safe Mode. It appears to have worked. I clocked back
    to 24 hours before the virus popped up on my screen.

    Now, that Ive suggested this, does anyone know why this would NOT
    work? Id appreciate any feedback if I still need to take other precautions.

  • Johnny

    I fixed this problem by going to HKEY current user software exe defaulticon. I deletd the line for it
    i also found svw (the virus name), where it was installed and deleted it and got rid of the virus.
    problem is,now i cant run any program. i think by deleting this registry value, i messed up running programs normally. for example if i try to run malware antibytes, it asks me what program should it use to run it.
    can anyone help?

  • Joao

    I have fixed this by checking the registry entries above and deleting the .exe file.

    Before that, I found an process named jfg.exe that closed the fake XP Security windows once killed on the Task Manager. I think I did some mistake and while deleting that file, I also deleted one other (where at the same date) that corrupted my registry entries on .exe.
    Then I got a .exe registry fix (google it like “cannot run .exe programs…”), installed again and fixed some entries as above. (some were already Ok, from the registry fix…) By now it is OK. It took me about 2 hours to go to another computer, print this page, execute it, and back to work…

    Thank you all for the info provided.

  • Futfxr

    comment # 19 did the trick. It allowed me to install my malware program. The other things that I tried that were posted in the forum were not working for me. Thanks for the help.

  • Sam

    Im 16 and Ive already had to change out mny hardrive because my computer was taken over by a hostage virus, yesterday I noticed the typical red shield on my toolbar and went to whatever “Microsoft” website to download a scan (oddly enough I felt like it would possibly be something bad) I couldnt right-click on the shield. This morning I see evrything that has been stated up above but I cant even begin to fix the problem because the virus is shutting down my Linksys program that I need for my internet. I have a modem in my basement and have a USB linksys device hooked into my tower. Everytime I click register or purchase full version it opens the “XP” internet but says nothing can be displayed. I need this computer for school…Also, if someone could tell me the most powerful computer protection software they know that would be great. I currently have AVG, would McAfee work? Please help….=/

  • YC Ming

    If they have an account to collect credit card payments, why can we catch them and put them in jail ?

  • Thanks

    Worked great! Thanks a million!

  • Thank You!

    So I removed this program in this ways,it wasny so hard.This program is most stupid program i had saw ever,it want take your money…
    Thank you very very very much guys,this web page is excellent with the people who faced with this program!Thank you again.

  • Bruce

    After weeks of dealing with this evil monster, I found this free, extremely fast, and totally effective solution:

  • Pete

    I entered the code to de-activate the malware. Now I cant run Malware Bytes anti-virus. Tried to close any werid processes in task manager bu they just restart a few minutes later. Any ideas?

  • abhishek

    the code worked well.. virus removed

  • Mr Anonymouskiz

    Rotf lmfao! @ the stupid ass fake program thinking that i actually bought it when i put the fake code in.

  • rj

    Rohan, I followed your method along with calling Microsoft support. PC works fine now but I was wondering if you have to use the new administrator account now or can you go back to the older one. Im just wondering because transferring all of my files over to the new account seems a little tedious is all.

  • Rohan

    I got rid of this by making another Admin account and logged in under this account that stopped this from loading as l had the same issue that was there in Safe mode (Networking) or normal. Once logged in as this new admin account was able to run Malwarebytes to cleanup my PC.

  • CLA

    Once these scamwares install themselves, the only real way to get rid of them is to re-install your operating system. They disable the use of all antivirus programs, and even block the use of web browsers.

    That is why I encourage people to have a slave drive installed, and to save all their work to it instead of to the main drive.

  • NikkiN.

    To those of you who are saying the virus is still on your computer after scanning, no one program can detect ALL viruses. You should always scan your computer with two or more programs. Malwarebytes is an excellent one. It is also one that will detect this particular virus.

    Also, entering the code will NOT get rid of the virus, it will only fool the Trojan into thinking you have purchased its fake program and should now allow you to open the internet and/or your malware scanning progam.

  • FredD

    Too much work!
    My wife is the very definition of unsafe surfing
    When I set my wifes comp up, I got everything set up and configured, then ghosted the drive.
    When she gets one of the scumware programs on her machine, I just format her HDD, then reinstall and ghost her box to put it back to the state it was in before. SHE then gets to redo everything else, Its the easiest thing for me to do, with what I have.

  • jimpapa

    re: by AllSanDiegoComputerRepair. 2011-04-11 19:04:36
    ran the sas_fix.exe then ran combofix(googled and downloaded) and it has removed the program.

  • Hameeth

    Thank U so much ya

  • Jade Rawlinson

    How do I down load any spyware when i cant get on the internet?

  • rider

    It took me about 4 hours to get rid of this – not easy!! I tried many of the remedies suggested online, none worked on its own. I am no computer genius so had to keep trying other things, or trying in a certain order. This is what finally worked:

    I am running XP Home. Rebooting to safe mode and trying to run antivirus software would work temporarily but not permanently. Back in normal windows mode the problem would crop up again…

    The virus gives you the option to enter a manual code to “purchase” the software. CHoose this, and enter the code 1147-175591-6550. This will get the program to stop bugging you and should allow you to access the internet and go about your regular business. To actually get rid of the infection, and correct changes to the registry, do the following:

    Download the program called “Malwarebytes” that is readily available online. Free version worked fine.

    Reboot the computer into “Safe Mode with Networking” (tap F8 while re-starting)
    This will allow you to access the internet, which the virus will not allow you to do while running in normal mode if you have not entered the code noted above.

    Run a full scan of Malwarebytes previously downloaded. Mine took 45 minutes to run. It will identify the problems and take corrective action once you prompt it at the end of the scan. The log is automatically saved.

    Reboot to normal mode. Check that your firewall and the normal “XP Total Security” is working again – not the fraud.

    That should work! Good luck.

  • jay

    Womever Posted this and specifically the registration code, to you sir i say HARUMMMMPH~~~… Ty very much for sharing your knowledge and helping us out.

    Sincere regards

  • asdfg

    just go into safe mode and when it asks if you want to restore your computer to a later time click yes. it worked for me.

  • AllSanDiegoComputerRepair

    fixed this

    here’s the secret…. first, run

    find it at…

    then, run combofix


    ps.. this isn’t spam – i’m a guy who does this for a living and i just want to help ppl figure this out

  • Jasonpark1987

    Is the registration code only work as a temporary measure? I’m concerned after using the code, the virus is still on my computer

  • Neocomer

    Code worked but i still can’t open the a anti virus i can’ even open the regedit…little help plz

  • Jasonpark1987

    This rouge adware even infects my computer’s safe mode with networking, there is no way to download the recomended software when it’s being blocked by other viruses on my computer.

  • kaz

    omg thank u so much i was really worrying u have made my day thanks

  • Matt

    Thanks for this, the code worked well, however even after “purchased”, this annoying thing still wouldn't let me run any programs. Luckily, the registry keys above also helped. Thanks so much.

  • Guest

    Omg. Thank you for this. You have no clue how grateful I am for this. It sucked that both my computers got infected with this trojan. Thanks!!!

  • Guest

    Thanks so much for the code, it worked great!!

  • Guest

    The code worked GREAT !!! Thanks

  • Thankful Kid

    This helped so much

  • Guest

    I used Spydoctor and still can not get rid of XP Total Security 2011