XP Defender Pro Description

XP Defender Pro is an illegitimate anti-spyware application used by cyber-criminals to swindle users out of their money. The trial version of XP Defender Pro is surreptitiously put into users’ computers by sneaky Trojans. Once inside a PC, XP Defender Pro uses fake system scans, security alerts and pop-ups to scare users into thinking that their systems are infected with harmful malware. Then the user will be prompted to purchase the “full version’ of XP Defender Pro to remove all the detected Trojans, viruses, worms etc. Do not waste your money on this useless application and use a legitimate malware removal tool to rid your system of XP Defender Pro.

Type: Rogue AntiSpyware Programs

Aliases: XP Defense Pro, XP Defense 2010.

How Can You Detect XP Defender Pro?

XP Defender Pro has typically the following processes in memory:

• %UserProfile%\AppData\Local\ave.exe
• ave.exe

XP Defender Pro creates the following registry entries:

• HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application Data\ave.exe” /START “%1? %*
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “%UserProfile%\Local Settings\Application Data\ave.exe” /START “%Program Files%\Mozilla Firefox\firefox.exe” -safe-mode
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1?
• HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application Data\ave.exe” /START “%1? %*
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application Data\ave.exe” /START “%Program Files%\Mozilla Firefox\firefox.exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1?
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application Data\ave.exe” /START “%1? %*
• HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application Data\ave.exe” /START “%1? %*
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application Data\ave.exe” /START “%Program Files%\Internet Explorer\iexplore.exe”

Important Article Disclaimer