How to remove XP Anti-Spyware 2011, Vista Anti-Spyware 2011 or Win7 Anti-Spyware 2011

To remove XP Anti-Spyware 2011 Software (Uninstall XP Anti-Spyware 2011 Software)

• Restart your computer and as soon as your computer turns on hit the F8 key (repeatedly) until a screen comes up
• Choose Start computer in SAFE MODE with network support
• Open Internet Explorer
• Go to Tools => Internet Options => Connections Tab => LAN Settings
• Uncheck "Use a proxy server"
• Recheck "Automatically detect settings"
• Download this free removal tool for XP Anti-Spyware 2011 Software
• Extract it
• Launch
• Click on the delete button

XP Anti-Spyware 2011 Software will be removed from your system in 10s. Restart your computer when it’s finished.

This removal tool for XP Anti-Spyware 2011 may refer to :

• For Windows XP :
  • Remove XP Anti-Virus
  • Remove XP Anti-Virus 2011
  • Remove XP Anti-Spyware
  • Remove XP Anti-Spyware 2011
  • Remove XP Home Security
  • Remove XP Home Security 2011
  • Remove XP Total Security
  • Remove XP Total Security 2011
  • Remove XP Security
  • Remove XP Security 2011
  • Remove XP Internet Security
  • Remove XP Internet Security 2011
• For Windows Vista :
  • Remove Vista Anti-Virus
  • Remove Vista Anti-Virus 2011
  • Remove Vista Anti-Spyware
  • Remove Vista Anti-Spyware 2011
  • Remove Vista Home Security
  • Remove Vista Home Security 2011
  • Remove Vista Total Security
  • Remove Vista Total Security 2011
  • Remove Vista Security
  • Remove Vista Security 2011
  • Remove Vista Internet Security
  • Remove Vista Internet Security 2011
• For Windows Seven :
  • Remove Win 7 Anti-Virus
  • Remove Win 7 Anti-Virus 2011
  • Remove Win 7 Anti-Spyware
  • Remove Win 7 Anti-Spyware 2011
  • Remove Win 7 Home Security
  • Remove Win 7 Home Security 2011
  • Remove Win 7 Total Security
  • Remove Win 7 Total Security 2011
  • Remove Win 7 Security
  • Remove Win 7 Security 2011
  • Remove Win 7 Internet Security
  • Remove Win 7 Internet Security 2011

Processes :

• [3 letters Random].exe

Files :

• %CommonAppData%\[random]
• %AppData%\[random]
• %Temp%\[random]
• %Templates%\[random]
• %AppData%\[3 letters random].exe

Registry

Registry keys created :

• HKEY_CURRENT_USER\Software\Classes\.exe
• HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
• HKEY_CURRENT_USER\Software\Classes\.exe\shell
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
• HKEY_CURRENT_USER\Software\Classes\exefile
• HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon
• HKEY_CURRENT_USER\Software\Classes\exefile\shell
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\open
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command

Registry Values created :

• HKEY_CURRENT_USER\Software\Microsoft\Windows
  
  • Identity = 0x84F78321
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  
  • ctfmon.exe = "%System%\ctfmon.exe"
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
  
  • (Default) = ""%AppData%\[random].exe" /START "%1" %*"
  • IsolatedCommand = ""%1" %*"
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
  
  • (Default) = ""%1" %*"
  • IsolatedCommand = ""%1" %*"
• HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
  
  • (Default) = "%1"
• HKEY_CURRENT_USER\Software\Classes\.exe
  
  • (Default) = "exefile"
  • Content Type = "application/x-msdownload"
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command
  
  • (Default) = ""%AppData%\[random].exe" /START "%1" %*"
  • IsolatedCommand = ""%1" %*"
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command
  
  • (Default) = ""%1" %*"
  • IsolatedCommand = ""%1" %*"
• HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon
  
  • (Default) = "%1"
• HKEY_CURRENT_USER\Software\Classes\exefile
  
  • (Default) = "Application"
  • Content Type = "application/x-msdownload"

Registry values modified :

• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
  
  • (Default) =

Remove XP Anti-Spyware 2011 Software manually :

• Restart your computer in safe mode :
  • Restart your computer and as soon as your computer turns on hit the F8 key (repeatedly) until a screen comes up
  • Choose Start computer in SAFE MODE
• Open the infected account
• Open explorer, paste into the address bar %Temp% then press enter, it will open C:\Documents and Settings\Christian\Local Settings\Temp on my computer
• Remove all .exe files under this path
• Open explorer, paste into the address bar %AppData% then press enter, it will open C:\Documents and Settings\Christian\Local Settings\Temp on my computer
• Remove all .exe files under this path
• Click on the start menu button then click on run
• Type msconfig and press enter
• Go to the Startup tab
• Uncheck ctfmon.exe and click on OK
• Return to run and enter regedit
• Browse to HKEY_CURRENT_USER\Software\Classes\  and remove the keys : .exe and exefile
• It will prevent these malware from running but you should use the removal tool to clean your computer completely from all other folders and registry keys of this malware.
• Restart your computer in normal mode