While running, XJRAntivirus will display fake security warnings claiming that somebody is trying to attack your PC or that malicious software may steal your passwords and other sensitive information. Moreover, this scareware will block legit anti-virus and anti-malware programs. It will state that your antivirus program is infected and should be uninstalled or cleaned. Besides, the rogue program blocks other tools and programs as well, such as notepad, task manager, MS Word and etc.
It also displays fake svchost.exe error screen and impersonates Windows Security Center.
Some of the fake security alerts read:
"Security Warning
Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer.
Clear here to clean your PC immediately."
"svchost.exe
svchost.exe has encountered a problem and needs to
close. We are sorry for inconvenience."
"Warning!
Running of application is impossible.
The file C:\Windows\System32\notepad.exe is infected.
Please activate your antivirus program."
As you can see, XJR Antivirus is absolutely needless software that should be removed from your computer as soon as possible. It's nothing more but a scam, so obviously you shouldn't buy it. If you have already bought this fake program, then contact your credit card company and dispute the charges. If you have any questions or additional information about this virus please leave a comment. Good luck and be safe!
XJR Antivirus removal instructions:
Method #1
1. Go to Start->Run or press WinKey+R. Type in "command" and press Enter key.
2. In the command prompt window type "notepad". Notepad will come up.
3. Copy all the text in blue color below and paste into Notepad.
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
4. Save file as regfix.reg to your Desktop. NOTE: (Save as type: All files)
5. Double-click on regfix.reg file to run it. Click "Yes" for Registry Editor prompt window. Then click OK.
6. Download one of the following anti-malware applications:
7. Install the selected application, update it an run a system scan.
8. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Method #2
1. Use another computer and download one of the anti-malware applications listed above (Method #1, step 6),
2. Create fix.reg file as said in Method #1 (steps 1-4). Copy an anti-malware application and fix.reg file to USB flash drive or any other removable device and transfer those files to the infected computer.
3. First of all run the fix.reg file. Then install the anti-malware application, update it and run a full system scan.
4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Manual removal:
Associated XJR Antivirus files:
- C:\Program Files\XJR Antivirus
- C:\Program Files\XJR Antivirus\XJR Antivirus.exe
- C:\Program Files\adc_w32.dll
- C:\Program Files\alggui.exe
- C:\Program Files\nuar.old
- C:\Program Files\skynet.dat
- C:\Program Files\svchost.exe
- C:\Program Files\wp3.dat
- C:\Program Files\wp4.dat
- C:\Program Files\wpp.exe
- %UserProfile%\Local Settings\Temp\win1.tmp
- %UserProfile%\Local Settings\Temp\win2.tmp
- HKEY_CURRENT_USER\Software\XJR Antivirus
- HKEY_CLASSES_ROOT\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{149256D5-E103-4523-BB43-2CFB066839D6}
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd
No comments:
Post a Comment