Braviax
XP Antivirus 2012 is a name-changing scam that may also be found named Win 7 Anti-virus or Vista Antivirus 2012. To avoid being removed from the system, malware always hides behind its three-letter named executable that makes it launched once your PC is rebooted. XP Anti-virus 2012 must be removed as soon as it is noticed no matter how legitimate it may look for you. It will present itself as powerful viruses’ removal tool and, after ‘finding’ hundreds of viruses, will offer to purchase its licensed version for removal. However, just like tons of malwares released, you should remove XP Anti-virus 2012 to save your machine.
Each alert displayed by XP Antivirus 2012 announces dangerous malware found and then recommends purchasing licensed software telling you that it’s the most optimal PC defense tool. To make you believe this, malware will say:
XP Antivirus 2012 Firewall Alert
XP Antivirus 2012 has blocked a program from accessing the internet
Internet Explorer is infected with Trojan-BNK.Win32.Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.
Malware Intrusion
Sensitive areas of your system were found to be under attack. Spy software attack or virus infection possible. Prevent further damage or your private data will get stolen. Run an anti-spyware scan now. Click here to start.
System danger!
Your system security is in danger. Privacy threats detected. Spyware, keyloggers or Trojans may be working the background right now. Perform an in-depth scan and removal now, click here.
System Hijack!
System security threat was detected. Viruses and/or spyware may be damaging your system now. Prevent infection and data loss or stealing by running a free security scan.
Privacy threat!
Spyware intrusion detected. Your system is infected. System integrity is at risk. Private data can be stolen by third parties, including credit card details and passwords. Click here to perform a security repair.
Stealth intrusion!
Infection detected in the background. Your computer is now attacked by spyware and rogue software. Eliminate the infection safely, perform a security scan and deletion now.
Not only it will display annoying system scanners and alerts, XP Antivirus 2012 also affects the functioning of your Operating System – it will disrupt computer’s work and compromise user’s privacy. On some occasions, malware may also let more viruses into the already infected computer.
It’s obvious that hackers are interested in getting your money. By pushing you into purchasing XP Anti-virus 2012, they will easily get not only your money but credit card details as well. So, if you have already purchased XP Anti-virus 2012 or any other scam from this dangerous group of scams that all change their names according to OS found, please get a reputable anti-spyware. If left inside, it may cause more problems for you and your computer. For removal, we highly recommend running Spyhunter, Malwarebytes Anti-Malware or any other reputable anti-spyware.
Special removal instructions for XP Antivirus 2012
1. You can use this key to disable majority of popups: 1147-175591-6550 or 2233-298080-3424 or 3425-814615-3990(all keys might work). Enter it in its manual registration section. This will not fully remove the XP Internet Security 2012, so continue to next steps.
1.a. You can try to change system date to 7 days in the future (doubleclick on the date in status bar). Reboot PC, then change date back. If this works, continue to step 3.
2. Reboot into safe mode with networking, download and run process explorer: https://www.2-viruses.com/wp-content/uploads/PE/eXplorer.exe (backup location). Start it and stop all 3-letter named processes, also processes named like garbage. You might need to edit out registry first.
3. Search for XP Antivirus 2012 files on hard disk and delete them, edit registry OR scan with decent anti-malware programs : spyhunter, Spyhunter, stopzilla, Malwarebytes Anti-Malware, Hitman Pro
4. Reboot, update your antivirus programs (preferably to internet security versions) and scan again. Make sure you got all the trojans out.
Automatic Malware removal tools
(Win)
Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,
(Mac)
Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,
Well, a couple of weeks ago I encountered this. My browser still starts-up. But due to the program, accessibility to any website even safe ones is requires to click a line saying “Continue browsing the web (Dangerous)” or something like that. But even with clicking that, it just refreshes and shows it again. I decided a quick solution (Believing the threat about the program) that would aide me quickly. I found my usb. Went and got another laptop, downloaded another installer, placed in usb. Then, installed in the infected laptop. It was successful. What happened when I opened the browser, was that it opened another popout saying that the browser was infected with the one above, the keylogger thing. When I clicked the second option which was to continue and said dangerous encloses in parenthesis the popout was gone. Waited for a couple of minutes with the fact that if its the first time the browser was opened it would take awhile. Nothing happened. So I decided to run msconfig in the “Run…” program founded in the start menu clicked the “Startup” tab and went to find any xp antivirus 2012. None. Then task manager then, I clicked the Processes tab, searched for any relevant abbreviations or acronyms of the antivirus. But sill none. I decided to consult the internet even with me thinking that this was “Windows produced” or somewhat legal and thought that only I was the one with a problem and no solution will be found. But still, I stand to be corrected. I once more underestimate the wideness of users and problems. Well, this was like a haven for me. Thanks!
i have just paid for this today as it wouldnt let me onto my internet, what do i do?
Not working the following key:
Enter it in its manual registration section.
1147-175591-6550 . This will not fully remove the XP Internet Security 2012, so continue to next steps. Not working at all.
just you need to Download the “Malwarebytes Anti Malware software” file name is “mbam-setup-1.51.0.1200.exe”
Run the program and Scan the System….. it will remove all the spyware virus even in Trial Version. Restart the PC. 100% you PC will get rid from XP antivirus 2012.
No need to pay for “Malwarebytes Anti Malware software”…. to remove this fake XP antivirus 2012..
Surseh Mahajan
Surseh: it is recommended to get full version of malwarebytes to prevent such infections in the future. and it is not 100%, sadly. NO malware or virus removers are.
@admin
When I enter 1147-175591-6550 it says Invalid registration key
ty: Try changing date to 6-7 days in the future.
Will not take registration key or allow me to change the date. Any other suggestions?
Susie: change date in bios, reboot and press del for bios menu to appear.
1147-175591-6550 .when i give this key it is showing invalid key pls reply me as soon as possible
pls tell me what i do
Got the XP 2012 well and truly. Trying to run any program, including downloading Spyware Doctor, and nothing will run as there are no file extensions. I have to look for the program to run from a browing list but nothing seems to work. What can I do?
Where do you go to enter the registery keys. I ran avg and it found nothing I then ran on online virus scanner called eset online scanner and it found the trojan and removed it so now the annoying pop ups are gone and I can get on the net but when I go to run and type ms config i get access denied. I have tried stopping a three letter.exe process in task manager. I cannot find any files begining with % to delete and i have tried installing norton from a portable cd drive but it says access denied. What do I do now. Please help.
i searched all files that were downloaded today (when i got infected by xp antivirus) and deleted all files that had anything to do with xp antivirus will that get rid of them effectively?
Laura: not necessarily. You should scan with anti-malware programs as well. There are 2 reasons for that. First one is that you do not know when the infection took place (it might have no visible effects for a while). And the second is that such infections might effectively hide files from being listed when the parasite is active (not in all cases).
Just restore your hard drive to a safe point. virus deleted
I cannot get my activation code
Well I tried to down load the spy ware doctor but the xp Antivirus 2012 didnt allow it to safe on my computer it keep telling me with a pop up to register it and all my programs are not working i cant even open system restore to use it cause it wont allow it too it pretty much took over my computer i figure out how to use the internet because it dint let me before but that’s the only thing i can use know it wont let me install any other programs because its from a third party or something like that so im not sure but i think im f***ed
frederick: Read full guide. There are ways to disable XP Antivirus 2012 either by using code, killing its processes or changing date.
Please help I had this bullshit on my computer for a few days and I can’t remove it I tried a few this that I read in blogs from deletemalwate blogspit com and It didn’t work it wont let me access anything I cant go on save mode it into the registry that it told me to do on blog from site I listed can u guys please please help me I’m desperate…..it I wait the 7 days n virus dies will I be able to access this things I need to get into to fix it????…….PLEASE HELP!!!!…..Thank you for ur time!
Jershon: read full guide. Try registration keys.
@me
Reboot in safe mode
Press start, find system restore
activate it and enter a date prior to the infection date. Worked fine for me
Good luck,
Vassily
Hi.. I followed steps I found and was able to get rid of the xp 2012 malware. The problem is when my laptop rebooted, now I can’t access the Net. I show that I’m connected to my wireless, but when I try and click on Firefox or IE, it says ‘server not found.’ I CAN however sign into my messenger programs. Any help? I’m about to be out of town until Friday and really need to be able to access the Net. Thanks.
Paul : try changing DNS Servers to google ones. Read the section about DNS Here: http://www.2-viruses.com/how-to-fix-google-results-hijacker-google-redirect-virus-problem . If this fails, scan with other anti-malware tools.
For those who cannot access safe mode let alone boot up, get a hold of an XP live version CD and access your hard drive using this CD. When you start your computer immediately press F8, this should bring you to your boot directory. Insert CD live version and install it via CD Rom Directory. Go to C drive and transfer all your data to an external hard drive. Reinstall XP and Windows. While this may be the long way of doing it, it sure beats banging your head against the wall trying to find a cure on the net that might or might not work. This virus is no different than “The Windows Recovery virus.”
JD: actually, I believe these belong to different malware families. XP antivirus 2012 does not comes with rootkit that often (which is difficult to remove).
I believe reinstal is the safest option always, however, the next necessary step is prevention of such infections by installing decent antivirus or internet security suite.
Only day that is allows you to restore to is the date you were infected. All the other dates are grayed out@Kodorof
The first is not working. Only the second one.
task manager, end files tyc.exe and vde.exe
I was able to get rid of it by using ConfigSafe. I had noticed strange pop-ups yesterday and gone back to a fairly recent “snapshot,” but then the whole XP Antivirus 2012 came up today. So today I rebooted the computer in Safe Mode and went back to a “snapshot” from February (i.e., six months ago), which seems to have worked.
I ran into this twice now. the first time i ended up fdisking but that sucks cuz ofcoarse it removes everything.this time I just removed user and it was gone. most of the rogue files are in docs..and settings/user/localsettings/…
but u must have more yhan one user set up on pc with admin status
Download the following “FREE” portable scanner:
superantispyware.com/portablescanner.html
Copy it to your hard drive and run it. It will run, and will run from the infected user profile. It will most likely immediately find “System.BrokenFileAssociation” which seems to be linked to the XP 2012 virus. Basic rule of thumb, whatever SuperAntiSpyware finds – delete!
SoCalTechGuy
SuperAntiSpyware detects some false positives, especially in cookie domain. Although It is good tool, I would not suggest deleting everything without checking… Personally, I prefer SD or MBAM, Hitman Pro (which is portable scanner too) over it.
I restored my pc to a checkpoint before this malware appeared and it works!!
xp antispyware 2012 is problem on my system
What do I do? I need helf right now!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! This thing haf taken over all my computer stuff and I can’t do what I like to do on it now and I’m really upset!!!!! You need to help me RIGT NOW!!!!! please!!!
What can i do? I wus tol to do something called fdisk or sumpin like that but I don’t know how. Please help me right now or I will not be able to gey into0 my computer andf play games and I like to play my games HELP HELP!!!!!!!!
Richard Elmond:
Do not launch FDISK – you would have to reinstall PC after that.
Look at this video : http://www.youtube.com/watch?v=15QrZkhGKB8 it will show how to disable XP Antivirus 2012 and launch malware removal programs.
Hello, I am in the same boat as Paul, I removed xp antivirus 2012 using malwasrebites and have since run spybot as well but found no other infections. Since rebooting the laptop after removing the infections with malwarebytes, I have been unable to access the internet in any way. Mozilla and Internet explorer both fail to find a server for any website and my laptop shows itself as connected. Any help would be appreciated thank you.
Bob: the problem is that mbam has not fixed registry or internet chain properly. Check if you have disabled proxy server in your browser, and if DNS servers are on autodetection. If still problems, call +1 888 557 8172 to troubleshoot.
So i just got infected with this virus like an HOUR ago and i am so PISSED off with this bullcrap! I’m taking my poor laptop to office max tomorrow or best buy to have them personally take care of it. I got it after installing some adobe thing. So be carefull on the things u install 😛
Hello. Need your help. So managed to run MalwareBytes over night and it found the virus, but the virus kept poping up again. I restarted the computer and pressed F8, but safe mode does not start. All I get is a blank black screen and a flashing cursor in the upper corner of the screen. Can any one help and tell me how I can get my PC start in safe mode? Thanks in advance for your help.
Allen: In your case, get something else than Malwarebytes. It looks like that it either fails to remove trojan completely ( malware has to be added to database), or you get reinfected again. First option looks more likely for me. I recommend Spyware Doctor, Hitman Pro or Stopzilla in your case.
Hello Admin. Thank you for your response, but my problem is that I can not get the system booted. When I do a hard re-boot, all I get is a blank black screen with the cursor. So my question is how do I get the system booted as I am not even allowed to start the computer in safe mode (F8). Just as an FYI, I have am running XP. Thanks again. Allen
Allen: Can you launch the boot menu, or it gets stuck before that? If you can, try last known good configuration. If not , try scanning with alternate OS scanners http://www.2-viruses.com/alternate-os-scanners-introduction or PC support time.
Hello Admin. Unfortunately I can not launch the boot menu, it get’s stuck before that. So the only thing I see on the screen after turning on my PC is the display that show me the F2 and F10 options (boot and BIOS setup) and after this screen goes away, I get the blank black screen with flashing cursor.
Allen: Alternate OS scanner time and maybe repair install using windows CD. If not, reinstall.
Hi Admin, I have an external HDD. Can I install OS on the external drive, boot from it (in safe mode) and then go and clean up the virus from local HDD, or will the virus also spread to the external drive? Thanks AO
Allen: this is malware. It will not spread from secondary hdd unless you launch it accidently.
Ok so my moms computer which had not been used for some time because of the broken monitor had all of its antivirus software but it was no longer under a subscription so i downloaded AVG 2012 antivirus software which had been recommended by a few people. I downloaded it but after my mom started using it the Xp antivirus thing popped up i tried turning off the process under windows task manager to see it pop up agian when ever i tried to open somthing. I though AVG was working but i guess not so i scan my computer i find the file and delete it it stops popping up and it seems fine but nothing will open it just goes to s screen that says open with: and nothing happens even when i try opening IE with IE. So now the only things i can open are my documents and pictures and some other things. Im on the computer right now on this computer there is a link under IE that says Email i click on that and IE opens to hotmail but it wont open when i click on it directly i have no clue why. So i was wondering if there was anyway i could fix it and be able to open my stuff agian. Do i have to open it through safe mode networking? If not she just wanted her pictures and was going to buy a new one this computer is 6 years old its a windws xp.
Hi Admin,
I’m at my wits end here and hoping to find a solution. My Windows Xp got a dose of this virus, and at the time my computer had shut down. I have only been able to restart it in safemode since that time. Trying to start it normally results in the computer getting stuck at the “Windows is starting up…” screen. In safemode, I am unable to use the system restore as it claims to be turned off and prompts me to restart in normal mode. I would welcome any suggestions you might have on how to resolve this.
A second problem that I must tackle later is that in surfing forums for a solution, a Windows 7 laptop I was using was also infected. My solution this time was to attempt to roll it back to its factory condition and format it through the partition. This has failed consistently somewhere around the booting phase and I’ve got another worthless box of wires until I can figure that one out too.
The first problem is my priority, and I’d thank you for any help you could provide- this isn’t the normal sort of thing that I have happen to me and I’m usually the one that has to fix minor computer problems in my circle..heh.
Thanks,
Ryan
Ryan : looks like missing system file/registry messed up for me. Try booting into safe mode with networking and running some registry cleaner. If you still got problems, I would suggest investigating logs (booting with log enabled), or scanning with Alternate OS scanners http://www.2-viruses.com/alternate-os-scanners-introduction .
In worst case, PC repair time like +1-800-839-3572
My computer has been infected by this, can you simply remove the user account that was operating when it was infected or are all user log in account affected?
Ray: I have seen infections of this parasite going both ways. The safest is to scan with anti-malware program, even if you choose to remove one of the accounts
My PC is xp virus i cant access the internet even in safe mode. nor can i access the registry. How do i fix this so i can access the registry and internet. it wont let me run anything either nor open any programs. grrrrrr its worse than the cloud security virus i got rid of. i dont even know how i got this thing, was watching a movie and and it popped up. any help would be appreciated. thanks
what registry cleaner is best to use since this xp antivirus 2012 has taken over my pc and i cant access the internet nor use registry to remove it. I cant open any programs, because it tells me to create a file association or tells me the exe does not exist. When i try to run a program from CD it wont let me that way either. I have tried safe mode with net working and still cant access the internet it says acquiring network ip address. So what do i do, can anyone help me please. thank you marie
i am not computer savvy so i did what gary a previous poster suggested and just restored it to two weeks ago. its up and running fine now.
Marie: Registry cleaner wont help in your case. press ctrl+shift+esc and kill rogue process. Then try running anti-malware program (it might start when virus is disabled) or run registry fix first.
You can try booting the computer in safe mode and do a system restore before you got the virus-it worked for me but not my dad’s.
whats the button yuou keep hitting real fast when you turn computer off so you can do a system restore will that work im not good at this and I got this xp virus
that stupid virus thing is really pissing me off too! i kind of blame the hard
drive my dad replaced in my laptop. hard drives probably carry those
viruses. sorry that i have no answer.
@Andrew
Hey quick fix for most with this malware is to rename the file name then reboot and use anti-malware software.
1) Ctrl-alt-Del
2) Find the process. (Usually a 3 letter extension followed by .exe) For it was ecl.exe and icy.exe
3) End the process
4) Go to control panel—File Folders then view >
5) Click to show all hidden files
6)Go out click on My Computer and select drive C:
7)Click through these C:–>Documents and Settings–>Administrator–>Local Settings–>Application Data
8) Find the one labeled the 3 letter extension, slowly double click it to rename it. Call it virus.exe
9) Reboot computer and run anti malware software. If possible reboot in safe mode with networking if you were unable to download or run antimalware software.
Hope that helps.
My problem with this virus is that it has disabled all my programs and internet connections, with no option to enamble. When I first got the XP Antivirus 2012, I ran malwarebytes in safemode. It did find it. But now when I try to access anything they are “empty”. I get a message that ” no file, path ” can be found. Luckily I had another User Account listed as an Administor. I am able to use my computer and internet with this account. But what I want to know is how to restore this other Account that the virus has destroyed. And is this malware REALLY gone from my computer? I was using Monzilla FireFox as my browser when I got this virus, now I’m afraid to use it, fearing some of the virus may have something attatch to it.
@me
You consult your credit card company and tell them the charges were false and under a virus attack to your computer. Then you get a usb drive, get on another computer, go to Safety.Live.com which will take you to Microsoft’s safety scanner, download that onto your usb drive and plug it into your infected computer. Then run the scanner. 😀
@shelley
Its either F8 key or the esc key.
Well its on my computer and if i had a spare million i would give it to ever cut the head off this low life M-F er who did this and feed it to a bunch of starving PIGs-*—– great advice i am probly about to loose every thing but is there any instrucrtion on how to get it off like get into the registrey?? this virus has cut my lap top off from every thing
How do I get a refund for this mess I downloaded??? This is insane!!!!
Help : contact your bank.
Thanks for this post, i will try that.