Birla Group Company Blog

How to Get Rid of XJR Antivirus Rogue Antispyware? Eliminate and Remove XJR Antivirus Completely

XJR Antivirus is not a legitimate and Real Antispyware Program but itself a spyware, more precisely a new kind of rogue antispyware program from the same family of Antivirus Live. The only difference being the core files are modified a little bit and the name is changed to hide it’s detection by legitimate Antivirus programs installed on your PC.

This program is distributed with the help of trojans. When the trojan is started, it will automatically download and install XJR Antivirus onto your computer without your consent and knowledge and configure it to run when you start Windows.

When XJR Antivirus is started, it will imitate a system scan and detect a lot of various infections that will not be fixed unless you first purchase the program. Important to know, all of these reported infections are fake and don’t actually exist on your computer! So you can safely ignore the scan results.

 While XJR Antivirus is running, it will block the ability to run any programs as a method to scare you into thinking that your computer is infected with malware.

The following warning will be shown :

 Security Warning

Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer.
Clear here to clean your PC immediately. 

 

 What is more, the rogue will flood your computer with warnings and fake security alerts. Some of the alerts:

Internet attack attempt detected:
Somebody is truing to attack your PC: This can result in loss of your personal information and infection other computers connected to your network. Click here to prevent attack.

 

A Fake svchost.exe alert

 

Last but not least, XJR Antivirus will hijack Internet Explorer so that it will randomly show a warning page with the “Internet Explorer Warning – visiting this web site may harm your computer!” header. Of course, all of above warnings and alerts nothing more but a scam and like false scan results should be ignored!

As you can see, XJR Antivirus is a scam that designed with one purpose to trick you into purchasing the so-called full version of the program. Do not fall for these virus creators bait into buying the Rogueware! and if you already have, you should contact your credit card company and dispute the charges.

And now coming back on How to Get Rid of XJR Antivirus, you need a solid program to fix the damages, the rogue has caused. It alters files, folders,permissions and registry keys.

Though some anti-Malware programs like MalwareBytes claim to delete this malicious fake anti-spywares, they cannot correct all the damages it causes

So you need something as good as Reimage, to fix all the damages that was left behind, to delete all the traces completely….to revive your PC from malicious trojans that may still reside and make your PC slow and to stop from getting re-infected.

Reimage is the only repair tool that fixes damaged system files, whereas other regular anti-malware and anti-spyware just deletes the rogues they don’t fix the damage left behind

When you try to fix this rogue, by running legitimate antivirus you encounter that app cannot be executed warning, task manager disabled, registry editing disabled etc..

So, in order to get rid of XJR Antivirus completely, start your PC in safe mode with networking, If you can`t run the IE, then you should repair the proxy settings of Internet Explorer. Run Internet Explorer, Click Tools -> Internet Options. Select Connections Tab and click to Lan Settings button. Uncheck “Use a proxy server” box. Click OK. Click Apply. Click OK. And go to http://reimagepcrepair.com to run a Scan. (Click cached result and refresh if searches are redirected)Reimage is the only PC repair tool, that can correct the damage a virus has caused by replacing the damaged file from fresh 25 million Windows Components Repository bank. (Regular legitimate AntiMalware and AntiSpyware programs just delete the corrupted files)

Reimage not only detects and terminates Adware, Spyware, Trojans, Key-loggers, Identity Theft scripts, Hijackers, Tracking Threats, Rogue Anti-Spyware, Unwanted Software, Phishing and Popups.files- it also fixes ALL the damage they left behind within 30 minutes. It is not just a registry cleaner, anti-spyware, windows repair and an Anti-virus software… it is a full-service, comprehensive “PC-Wash” that retrieves a “Just-Like-New” computer while keeping your personal data secure and protected.

Visit Reimage For a Complete Scan Now to Get Rid of XJR Antivirus Completely

 

What this infection does:

Antivir Solution Pro is a rogue anti-spyware program from the same family as Antivirus Soft and AV Security Suite. This family of rogues is installed through the use of malware and exploit kits that download and install Antivir Solution Pro onto your computer without your permission. When this program is installed it will be configured to start automatically when Windows starts, and once started, will perform a scan of your computer and state that it has found numerous infections. It will not, though, tell you the files that are supposedly infected and will also state that you cannot remove anything until you first purchase the program. This is a complete scam, as the program is scripted to display infections every time it is run. That means if you reinstalled Windows and ran Antivir Solution Pro it would still say that you are infected. It does this to scare you into thinking that your computer has a security problem so that you will then purchase the program. When you purchase the program, though, all you do is waste your money as the program has no useful function for your computer.

Antivir Solution Pro is known to be installed through exploit kits on hacked web sites. Exploit kits are are scripts that are added to hacked legitimate web sites that attempt to install malware onto a visitors computer through the use of known vulnerabilities in the Windows operating system and installed applications. Due to this, and to avoid being infected again after your computer is cleaned, it is important that you make sure that your Windows installation is completely up-to-date with all the latest Microsoft security patches. It is also important to make sure that all your programs, which include Sun Java, Adobe Reader, and Adobe Flash, are updated to their latest versions. A great program that you can use to scan your computer for insecure programs is the Secunia Online Software Inspector. We suggest that all readers scan their computer with this program to make sure your applications are not vulnerable to security exploits in order to add an extra layer of security.

 

Antivir Solution Pro screen shot
For more screen shots of this infection click on the image above.
There are a total of 6 images you can view.

 

When Antivir Solution Pro is running it will state that most programs are infected when you attempt to run them. The text of this fake infection alert is:

Application cannot be executed. The file notepad.exe is infected. Do you want to active your antivirus software now?

It does this for two reasons. The first is to make you think that your legitimate, and clean, programs are infected so that you will then purchase the rogue. The second reason is to block you from running any legitimate security programs that may help you remove this infection.

While Antivir Solution Pro is running it will also show you fake security alerts that attempt to further scare you into thinking you have a infection on your computer. These alerts will state that active malware has been detected or that your computer is under attack. The text of these alerts is:

Windows Security Alert
Windows reports that computer is infected. Antivirus software helps to protect your computer against viruses and other security threats. Click here for the scan your computer. Your system might be at risk now.

Antivirus Software Alert
Infiltration Alert
Your computer is being attacked by an internet virus. It could be a password-stealing attack, a trojan - dropper or similar.

Just like the other false infections alerts, these warnings are all fake and should be ignored. Last, but not least, Antivir Solution Pro will also configure your computer to use a proxy server at 127.0.0.1:5643, which is actually the Antivir Solution Pro program itself. This makes it that when you browse the web using Internet Explorer, the rogue will intercept all your web browser requests and instead display a page that shows a security warning about the site you are visiting. This warning states:

Internet Explorer warning - visiting this site may harm your computer!
Most likely causes:

• The website contains exploits that can launch a malicious code on your computer
• Suspicious network activity
• There might be an active spyware running on your computer

These warnings should be ignored as they are false. If you use a browser other than Internet Explorer you will not see the warnings at all and can browse the Internet like normal.

Without a doubt, Antivir Solution Pro was created solely to trick you into purchasing the program by convincing you that your computer has a security problem. Now that you know what this program does, it goes without saying that you should not purchase this program for any reason. If you already have purchased it, then we suggest you contact your credit card company and dispute the charges. To remove Antivir Solution Pro and any related malware, please follow the steps in the removal guide below.

 

Threat Classification:

• Information on Rogue Programs & Scareware

 

Advanced information:

View Antivir Solution Pro files.
View Antivir Solution Pro Registry Information.

 

Tools Needed for this fix:

• Malwarebytes' Anti-Malware

 

Symptoms that may be in a HijackThis Log:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5643
O4 - HKLM\..\Run: [<random>] %UserProfile%\local settings\application data\<random>\<random>.exe
O4 - HKCU\..\Run: [<random>] %UserProfile%\local settings\application data\<random>\<random>.exe

 

Guide Updates:

07/14/10 - Initial guide creation.
07/15/10 - Updated to include information about Secunia OSI.

 

Automated Removal Instructions for Antivir Solution Pro using Malwarebytes' Anti-Malware:

 

1. Print out these instructions as we may need to close every window that is open later in the fix.
   
   
2. It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If you run into this problem when following the steps in this guide you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.
   
   
3. Reboot your computer into Safe Mode with Networking using the instructions for your version of Windows found in the following tutorial:
   

   How to start Windows in Safe Mode

   When following the steps in the above tutorial, select Safe Mode with Networking rather than just Safe Mode. When the computer reboots into Safe Mode with Networking make sure you login with the username you normally use. When you are at your Windows desktop, please continue with the rest of the steps.
   
   
4. This infection changes your Windows settings to use a proxy server that will not allow you to browse any pages on the Internet with Internet Explorer or update security software. Regardless of the web browser you use, for these instructions we will first need need to fix this problem so that we can download the utilities we need to remove this infection.
   
   Please start Internet Explorer, and when the program is open, click on the Tools menu and then select Internet Options as shown in the image below.