Windows Vista Blog

XP Internet Security 2010 is an Operating System-specific rogue anti-spyware that appears under different names such as Vista Internet Security 2010 or Win 7 Internet Security 2010 according to the Operating System it is installed on. It reaches a user’s system via Trojan viruses that get downloaded along with fake video codecs and malware. Once established on the user’s system, XP Internet Security 2010 will then proceed to load itself as a startup program, blocking Windows utilities such as Task manager and Registry Editor along with any legitimate antivirus software the user has installed. XP Internet Security 2010 also performs fake scans on the system and claims that it is seriously infected with various viruses. It also displays countless fake pop-ups from the Windows taskbar warning that the user’s computer is under serious threat. XP Internet Security 2010 then asks the user to pay for a license to the ‘full’ version of the rogue software, claiming that the currently installed ‘trial’ version of XP Internet Security 2010 is incapable of removing the false ‘threats’ found on the system. However, as this is a fake program none of its versions can scan or clean your computer; therefore you should never allow yourself to be tricked into buying this rogue software.

As XP Internet Security 2010 aggressively tries to block users from removing it, you will have to restart your computer in Safe Mode before you attempt manual removal. The process of XP Internet Security 2010 removal is outlined below.

File Removal Procedures

The first step in XP Internet Security 2010 removal is to kill the following process:

av.exe

The next step is to delete the following files and folders:

%Documents and Settings%\[UserName]\Application Data\av.exe
%Documents and Settings%\[UserName]\Application Data\WRblt8464P

Once these steps have been completed, your file system is safe from XP Internet Security 2010.

Registry Removal Procedures

The final step in XP Internet Security 2010 removal is to delete the following keys and settings from the Windows registry:

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “av.exe” /START “iexplore.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1?

Once these keys and settings have been removed, your computer is completely safe from XP Internet Security 2010. It would be prudent to perform a registry scan using a well-known registry cleaner to ensure that no registry values created by XP Internet Security 2010 remain.

Conclusion

Manual XP Internet Security 2010 removal is not recommended for inexperienced users, as any mistake made during removal could cause damage to the system. Rogue programs like XP Internet Security 2010 are designed to repair themselves if not removed properly, therefore expert knowledge is required when attempting to manually remove such a rogue software. The best route to take for inexperienced users is to use a web-based scanning/cleaning service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus in order to properly remove XP Internet Security 2010 efficiently and in a safe manner.