Remove XP Security 2012

What is XP Security 2012?

XP Security 2012 is a malware that is categorized under the Win32/FakeRean family. It makes its way to your PC with the use of Trojans as well as in gaps in your anti-virus product. It can also infect your PC with corrupted websites, viewing online videos, downloading files as well as while surfing with various corrupted websites.

XP Security 2012 poses as an useful security option for your system that performs a scan whenever you reboot. It will tell you that your PC is invaded with all sorts of threats, malware as well as possible loss of files or private details like passwords and log ins however these are all bogus scans and warnings. Its only purpose is to deceive users to pay for the complete version of XP Security 2012 and once you click a button that says repair, scan or protect; you will be led to a web site that will request your credit card details. Getting rid of XP Security 2012 is the best option as it is a sign that Trojans have spread to your system. Use a dependable anti malware tool and to perform a complete system scan afterwards to check for any damage in your system files.

XP Security 2012 is known to be packed with rootkits. TDSS and ZeroAccess rootkits will prevent you from performing security software application and will shield and disguise this malwares' files and data.

Associated XP Security 2012 System Entries and files

XP Security 2012 Processes

[random 3 characters].exe

XP Security 2012 Files

%AppData%\[random characters] %AppData%\[random characters] %Temp%\[random characters] %UserProfile%\Templates\[random characters]

XP Security 2012 Registry Entries

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation "TLDUpdates" = '1' HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = '"C:\Documents and Settings\[UserName]\Local Settings\Application Data\[random 3 characters].exe" -a "%1" %*' HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"C:\Documents and Settings\[UserName]\Local Settings\Application Data\[random 3 characters].exe" -a "%1" %*' HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"' HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode' HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"C:\Documents and Settings\[UserName]\Local Settings\Application Data\[random 3 characters].exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"' HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = '1' HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = '1'

---

How to Stop XP Security 2012 Fake Alerts

To register XP Security 2012 and stop its fake warnings, use the following fake license key.

XP Security 2012 registration code: 9443-077673-5028

NOTE: this code will NOT remove XP Security 2012 from your computer, it will JUST stop the annoying alerts and messages.

---

XP Security 2012 Removal Instructions

Step 1: Reboot in Safe Mode with Networking

To restart your computer in Safe Mode with networking:

1. Restart your computer.

2. When you see the computer manufacturer's logo, press and hold the F8 key.

3. On the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking, and then press Enter.
   
   

4. Log on to your computer with a user account that has administrator rights.

---

Step 2: Disable XP Security 2012 Proxy Server

XP Security 2012 may add a proxy to its package. Its goal is to get the information through the Web connection (password etc).
It also helps to block the connection to certain sites (eg malware removal help sites) or to block the download of trustworthy antispyware and antivirus programs.

The following steps reset the Internet Explorer proxy settings in the Windows registry so that you can access the Internet again:

1. Click Start, and then click Run. (Keyboard Shortcut: Windows logo + R)

2. Copy and paste or type the following text in the Open box in the Run dialog box:
   reg add "HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
   
   

3. Click OK.

4. click Start, and then click Run.

5. Copy and paste or type the following text in the Open box in the Run dialog box:
   reg delete "HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings" /v ProxyServer /f

6. Click OK.

Now that you have disabled XP Security 2012 proxy server, you will be able to browse the web again with Internet Explorer.

1. Click Start, and then click Run. (Keyboard Shortcut: Windows logo + R)

2. Type in iexplore.exe.
   
   

---

Step 3: Remove the XP Security 2012 rootkit

XP Security 2012 may be bundled with the TDSS rootkit. A rootkit is a program that hides the presence of malware in the system.
Kaspersky offers a free utility, TDSSKiller, that removes malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon).

So to find out if your system is infected with any rootkits that make XP Security 2012 hidden and very difficult to remove, follow the steps below:

1. Download Kaspersky TDSSKiller to your desktop from the following link:
   Kaspersky TDSSKiller Download link

2. XP Security 2012 may block all executable files, so when you launch the TDSSKiller file, it will execute itself.
   So Rename tdsskiller.exe to tdsskiller.com or winlogon.exe or iexplore.exe
   
   

3. After you run TDSSKiller (or the renamed version), in the welcome screen click on Start Scan.
   
   

4. TDSSKiller will now scan your computer.
   
   

5. If any infection was found, TDSSKiller will display a screen results like the following one:
   
   Then click on the Continue button and TDSSKiller will clean the infections.

6. A reboot might require after disinfection. In this case, click on Reboot Computer
   
   

7. After the reboot, start your computer again in Safe Mode with Networking and then disable any XP Security 2012 Proxy Server (See Step 1&2).

---

Step 4: Stop XP Security 2012 processes

In order to stop XP Security 2012 from interfering with our removal procedure, we need to end and kill its processes. For this, we will use a FREE powerful utility called RogueKiller.

RogueKiller (by Tigzy) is a tool written in C++, which scans the running processes, and kills those which are malicious. This tool was developed based on speed execution, which will clean the running processes before being killed.

To terminate XP Security 2012 process:

1. Always in Safe Mode Download RogueKiller to your desktop from the following link:
   
   RogueKiller Download link
   
   RogueKiller is a portable application, so you don't need to install anything.

2. XP Security 2012 may block all executable files, so when you launch the RogueKiller file, it will execute itself. So Rename RogueKiller.exe to RogueKiller.com or winlogon.exe or iexplore.exe

3. At this point a "pre-scan" will complete and stop any malicious process. Also a list of options will appear along the right-hand side.
   
   

---

Step 5: Remove XP Security 2012 registry keys

To remove XP Security 2012 malicious registry entries, we will need RogueKiller again.
RogueKiller also checks for rogue Registry entries, rogue drivers, and Master Boot Record (MBR) issues, so rootkits will be cut.
RogueKiller can also fix and restore a Host file, delete any Proxy entries, repair shortcut problems and unhide files.

CAUTION: This tool is not for beginners. In this step we will ONLY use the Registry tab.

To Delete XP Security 2012 Registry entries:

1. Always in Safe Mode run a scan, open RogueKiller and click on Scan.
   
   

2. After a while, you should see a screen with scan results like the following one:
   
   

3. Click on the Registy tab, then click on the Delete button.
   
   

Don't Reboot you computer yet, please stay in Safe Mode.

---

Step 6: Remove XP Security 2012 files

Malwarebytes Anti-Malware is simply the best known FREE malware removal tools online.

To remove XP Security 2012 files:

1. Download Malwarebytes to your desktop from the following link:
   Malwarebytes Anti-Malware Download link
   
   

2. Just Follow the easy setup process. Do not make any changes to the default settings
   When the setup is finished, make sure you leave both the Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware checked.
   You can check or uncheck the Enable free trial of Malwarebytes Anti-Malware PRO as the malware removal is FREE.
   Then click on the Finish button. If Malwarebytes prompts you to reboot, please do not do so.
   
   

3. When Malwarebytes is launched, it will ask you to update the databse. Just click OK.
   
   

4. On the Scanner tab,select Quick scan and then click on the Scan.
   
   

5. When the scan is finished a message box will appear, click OK to continue.
   Then the screen results will show the various malware infections including XP Security 2012 that Malwarebytes has found on your computer.
   the image below is just an example, your results will be different.
   Click on the Remove Selected button.
   
   

6. After Malwarebytes has finished the removal of XP Security 2012, you will get a message stating that you need to reboot your computer.
   Just Do so, and restart your computer in Normal Mode.
   
   

---

Step 7: Check for any XP Security 2012 left over

To make sure that your computer is now completely free of XP Security 2012, redo a Malwarebytes scan in Normal Mode.
After your are finished, Reboot your PC as asked by Malwarebytes anti-malware.

---