Windows Vista Blog

Also known as XPAntivirusPro2010 and XP Antivirus Pro, XP Antivirus Pro 2010 is an operating-system specific rogue antivirus program that tries to trick users into paying for its license. This rogue software gets installed through Trojans and malicious software that reach the user’s system via dangerous websites. Once established on the system, XP Antivirus Pro 2010 performs a large number of fake system scans and reports that the system is heavily infected with viruses. It also blocks any legitimate antivirus software that the user may have already installed. XP Antivirus Pro 2010 then claims that the currently installed ‘trial’ version of the software is incapable of cleaning out the detected ‘threats’ properly, and urges the user to purchase a license to the ‘full’ version of XP Antivirus 2010. However, the so-called ‘full’ version of XP Antivirus Pro 2010 is just as ineffective in cleaning your system as the ‘trial’ version is.

Once you detect a copy of XP Antivirus Pro 2010 on your computer, you should take immediate steps to delete it. In order to delete XP Antivirus Pro 2010, you must stop its processes, delete its files and folders and remove its registry entries.

File Removal Instructions

The first step you need to complete in order to delete XP Antivirus Pro 2010 is to stop the following process:

• av.exe

As the final step in file removal, the following files and folders should be deleted:

• %Documents and Settings%\[UserName]\Application Data\av.exe
• %Documents and Settings%\[UserName]\Application Data\WRblt8464P

Once these steps have been completed, XP Antivirus Pro 2010 no longer resides on your hard disk. However, in order to make sure of this fact, it is recommended to conduct a full system scan using genuine antivirus software such as Spyware Doctor with Antivirus.

Registry Removal Instructions

Removing files and folders alone is not sufficient to completely get rid of XP Antivirus Pro 2010. The following registry keys and settings inserted by XP Antivirus Pro 2010 should also be removed:

• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
• HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
• HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
• HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “av.exe” /START “iexplore.exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1?
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1?

After you have completed the removal of these registry entries, your system is completely safe from XP Antivirus Pro 2010.

Tips & Tricks

It is not recommended for inexperienced users to attempt to delete XP Antivirus Pro 2010 manually, as any mistake made on your part could cause damage to your system. Rogue software like XP Antivirus Pro 2010 is designed to repair itself in case of improper removal. Inexperienced users are advised to use an online repair service such as www.onlinecomputerrepair.org or legitimate antivirus software to delete XP Antivirus Pro 2010 safely and efficiently.