Tuesday, May 25, 2010

How to remove XJR Antivirus (Uninstall Instructions)

XJR Antivirus is a fake anti-virus program from the same family as AKM Antivirus 2010 Pro. Once installed, it will give false or exaggerated reports of threats on your computer and then will prompt you to pay for a full version of the program to remove the infections and to protect your PC from other malware. The rogue program is promoted through the use of Trojan Horses and other malicious software. Very often, Internet users download such bogus programs from fake online anti-malware scanners and misleading video websites. If you are reading this article, then your computer is probably infected with this fake and very annoying antivirus program. The good news is that it can be completely removed from your computer using legit anti-malware software. Please follow the removal instructions below to remove XJR Antivirus and any related malware for free.



While running, XJRAntivirus will display fake security warnings claiming that somebody is trying to attack your PC or that malicious software may steal your passwords and other sensitive information. Moreover, this scareware will block legit anti-virus and anti-malware programs. It will state that your antivirus program is infected and should be uninstalled or cleaned. Besides, the rogue program blocks other tools and programs as well, such as notepad, task manager, MS Word and etc.



It also displays fake svchost.exe error screen and impersonates Windows Security Center.



Some of the fake security alerts read:

"Security Warning
Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer.
Clear here to clean your PC immediately."


"svchost.exe
svchost.exe has encountered a problem and needs to
close. We are sorry for inconvenience."


"Warning!
Running of application is impossible.
The file C:\Windows\System32\notepad.exe is infected.
Please activate your antivirus program."



As you can see, XJR Antivirus is absolutely needless software that should be removed from your computer as soon as possible. It's nothing more but a scam, so obviously you shouldn't buy it. If you have already bought this fake program, then contact your credit card company and dispute the charges. If you have any questions or additional information about this virus please leave a comment. Good luck and be safe!


XJR Antivirus removal instructions:

Method #1
1. Go to Start->Run or press WinKey+R. Type in "command" and press Enter key.


2. In the command prompt window type "notepad". Notepad will come up.


3. Copy all the text in blue color below and paste into Notepad.

Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

4. Save file as regfix.reg to your Desktop. NOTE: (Save as type: All files)


5. Double-click on regfix.reg file to run it. Click "Yes" for Registry Editor prompt window. Then click OK.
6. Download one of the following anti-malware applications:
7. Install the selected application, update it an run a system scan.
8. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

Method #2
1. Use another computer and download one of the anti-malware applications listed above (Method #1, step 6),
2. Create fix.reg file as said in Method #1 (steps 1-4). Copy an anti-malware application and fix.reg file to USB flash drive or any other removable device and transfer those files to the infected computer.
3. First of all run the fix.reg file. Then install the anti-malware application, update it and run a full system scan.
4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.


Manual removal:

Associated XJR Antivirus files:
  • C:\Program Files\XJR Antivirus
  • C:\Program Files\XJR Antivirus\XJR Antivirus.exe
  • C:\Program Files\adc_w32.dll
  • C:\Program Files\alggui.exe
  • C:\Program Files\nuar.old
  • C:\Program Files\skynet.dat
  • C:\Program Files\svchost.exe
  • C:\Program Files\wp3.dat
  • C:\Program Files\wp4.dat
  • C:\Program Files\wpp.exe
  • %UserProfile%\Local Settings\Temp\win1.tmp
  • %UserProfile%\Local Settings\Temp\win2.tmp
Associated XJR Antivirus registry values:
  • HKEY_CURRENT_USER\Software\XJR Antivirus
  • HKEY_CLASSES_ROOT\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{149256D5-E103-4523-BB43-2CFB066839D6}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd
Share this information with other people: 

No comments:

Post a Comment