OnlineScannerXP.com
OnlineScannerXP.com is a site promoting damn scam software. Home to fake anti-spyware XP Antivirus Protection, OnlineScannerXP.com offers a friendly warning:
“The page at http://onlinescannerxp.com says:
ATTENTION! You have not completed the virus scan!
Your PC is still infected with spyware!
Please return to XPantivirus.com and download XP antivirus scanner.”
The virus scan OnlineScannerXP.com is so eager to offer you is free, so why not?
How ’bout because this “free” scan will cost you your sanity? OnlineScannerXP.com’s scan comes with false security popups and faked scan results that tell you you’re infected with spyware that doesn’t exist.
Thanks, OnlineScannerXP.com.
Shake your fist at OnlineScannerXP.com, give it the bird.
Now let’s get rid of OnlineScannerXP.com and XP Antivirus Protection.
OnlineScannerXP.com Is Ugly
Remove OnlineScannerXP.com Automatically, with SmitFraud
Don’t have a lot of time? What with YouPorn.com reading The Guardian, my charity work, and more, neither do I. If you don’t know how to manually delete OnlineScannerXP.com files, and don’t want to learn, here’s how you automatically remove OnlineScannerXP.com.
Before you start, print out these instructions—you’re going to have to restart your computer in Safe Mode. Also, back up your PC in case you make a mistake.
- Download SmitFraudFix for free, and save it to your desktop.
- Reboot your PC in Safe Mode.
- To reboot in Safe Mode using Windows XP, restart your PC, and when a progress bar appears at the bottom of the screen, hit F8 once every second. When you see the Windows Start-up menu, highlight Safe Mode and hit Enter. Your desktop will show up, and make whatever repairs necessary. Then reboot your system and allow it to start up as normal.
- To reboot in Safe Mode using Windows Vista, go Start > Run. Type “MSCONFIG” into the Open field, and click OK. From the BOOT.INI tab, check /SAFEBOOT and click Restart).
- Once your desktop loads, double-click SmitfraudFix.exe.
- After the credits roll, you’ll see a menu. Click option number two, “Clean (safe mode recommended)“. Click Enter and delete your files infected with OnlineScannerXP.com.
- SmitFraudFix will clean your PC. When SmitFraudFix is finished, its Disk Cleanup automatically starts.
- Once Disk Cleanup is done, it’ll ask you, “Registry cleaning – Do you want to clean the registry?” Type in “Y” (yes), and click “Enter“. When Disk Cleanup finishes, restart your PC.
- If your system’s wininet.dll is infected, SmitFraudFix asks you if you want to replace the file. If SmitFraud asks, “Replace infected file?” Type “Y” (yes) to answer and click “Enter“.
- Once that’s finished, restart your system.
- After restarting, a Notepad file might popup with a log of the files SmitFraudFix deleted. If it doesn’t popup, you can find the log as a file rapport.txt in Local Disk C:, the root of your hard drive.
- Restart your system again, in Safe Mode. Once it boots up, go to C:\Windows\Temp. Select “Edit“, select “Select All“, and click “DELETE“. Click “Yes” to confirm you want all these files to get trashed in the Recycle Bin.
- Restart your system one more time, in normal mode. Go to Windows Update and download any critical updates for your computer. You’re done.
Remove OnlineScannerXP.com with Your Bare Hands
You dig a work out. Manually removing OnlineScannerXP.com can be hard and time consuming, but apparently you’re into that. Obviously, I can’t guarantee these instructions will completely remove OnlineScannerXP.com from your system, but it’s worth a try. Just make sure you backup your system before you try to remove OnlineScannerXP.com manually.
Before you start, print out these manual OnlineScannerXP.com removal instructions and close all applications, including your web browser.
- Uninstall OnlineScannerXP.com: Select Start menu > Settings > Control Panel. Double-click “Add/Remove Programs“, and search for “OnlineScannerXP.com”. If you find OnlineScannerXP.com, uninstall OnlineScannerXP.com.
- Stop OnlineScannerXP.com processes: Select Start menu > Run. Type taskmgr, then click on the Processes tab for a list of running processes. Search for OnlineScannerXP.com processes, like “OnlineScannerXP.com.exe“, or any OnlineScannerXP.com processes I list below. Right-click “OnlineScannerXP.com.exe“, and click “End task“.
%program_files%\xpantivirus\xpantivirusupdate.exe
xpantivirus.exe
download.exe
%program_files%\xpantivirus\sysbackup\ntoskrnl.exe
install_xp.exe
%program_files%\xpantivirus\sysbackup\ntoskrnl.exe.md5
%program_files%\xpantivirus\sysbackup\explorer.exe.md5
%program_files%\xpantivirus\unins000.exe
xpantivirusupdate.exe
%program_files%\xpantivirus\xpantivirusupdate.exe
%program_files%\xpantivirus\sysbackup\ntoskrnl.exe
%program_files%\xpantivirus\sysbackup\explorer.exe
%program_files%\xpantivirus\xpantivirus.exe
%program_files%\xpantivirus\sysbackup\explorer.exe
%program_files%\xpantivirus\unins000.exe
install_xp.exe
%program_files%\xpantivirus\xpantivirus.exe
- Delete OnlineScannerXP.com files in Windows Vista and XP: Select Start menu > Settings > Search. Click For Files and Folders…. You’ll see a speech bubble asking you, “What do you want to search for?” Select All files and folders. Type the names of OnlineScannerXP.com files into the search box, including any OnlineScannerXP.com file I’ve listed below. Now select Local Hard Drives, and click Search. As soon as you see a bastard OnlineScannerXP.com file, just delete it.
%program_files%\xpantivirus\xpantivirus.url
%program_files%\xpantivirus\xpantivirus_log.txt
%program_files%\xpantivirus\unins000.dat
xpantivirus.lnk
xpantivirus.url
%program_files%\xpantivirus\backup.lst
%program_files%\xpantivirus\helper.sys
%program_files%\xpantivirus\pn.cfg
%program_files%\xpantivirus\ver.dat
%program_files%\xpantivirus\whitelist.cfg
%program_files%\xpantivirus\spyware.dat
%common_programs%\xp antivirus\uninstall xpantivirus.lnk
%common_programs%\xp antivirus\xpantivirus on the web.lnk
%common_programs%\xp antivirus\xpantivirus.lnk
%desktopdirectory%\xpantivirus.lnk
%profile%\application data\microsoft\internet explorer\quick launch\xpantivirus.lnk
- Unregister OnlineScannerXP.com DLL files: Select Start menu > Settings > Run. Type “cmd” in Run’s box, and click OK. To switch directories, type “cd” in the command box, hit the Space key, and type the directory where the OnlineScannerXP.com DLL file is located. If you don’t know which directory the OnlineScannerXP.com DLL file is located in, enter “dir” into the command box to see a directory’s contents. To go back one directory, enter “cd ..” in the command box and hit Enter. Once you find the OnlineScannerXP.com DLL file you want to remove, including any of the DLLs I list below, type “regsvr32 /u MadeUpDLLName.dll” (e.g., “regsvr32 /u OnlineScannerXP.com.dll”) and hit Enter. If you delete a DLL by mistake, type “regsvr32 MadeUpWhoopsName.dll” (e.g., “regsvr32 OnlineScannerXP.com.dll”) into your command box, and hit Enter.
%program_files%\xpantivirus\sysbackup\wininet.dll
%program_files%\xpantivirus\sysbackup\shlwapi.dll
%program_files%\xpantivirus\sysbackup\shlwapi.dll.md5
%program_files%\xpantivirus\sysbackup\wininet.dll.md5
- Unregister OnlineScannerXP.com registry keys: Select Start menu > Run. Type regedit, and click OK. Search for any OnlineScannerXP.com registry keys I list below. To delete these OnlineScannerXP.com registry keys, right-click the OnlineScannerXP.com registry key, select “Modify”, and click “Delete“.
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run xp antivirus
HKEY_CURRENT_USER\software\xp antivirus\options lastscan
HKEY_CURRENT_USER\software\xp antivirus\options afterregisterurl
HKEY_CURRENT_USER\software\xp antivirus\options autoscanonstartup
HKEY_CURRENT_USER\software\xp antivirus\options
HKEY_CURRENT_USER\software\xp antivirus\firstrun
HKEY_CURRENT_USER\software\xp antivirus\options helpurl
HKEY_CURRENT_USER\software\xp antivirus\options labelurl
HKEY_CURRENT_USER\software\xp antivirus\options minimizetotray
HKEY_CURRENT_USER\software\xp antivirus\options offsiteurl
HKEY_CURRENT_USER\software\xp antivirus\options programversion
HKEY_CURRENT_USER\software\xp antivirus\options startwithwindows
HKEY_CURRENT_USER\software\xp antivirus\options totalscans
HKEY_CURRENT_USER\software\xp antivirus\options transactionkey
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter displayname
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter errorcontrol
HKEY_CURRENT_USER\software\xp antivirus\options firstrunminimize
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 inno setup: user
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 installdate
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 installlocation
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\menuorder\start menu\programs\xp antivirus
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run xp antivirus
HKEY_CURRENT_USER\software\xp antivirus\options autoupdate
HKEY_CURRENT_USER\software\xp antivirus\options billingurl
HKEY_CURRENT_USER\software\xp antivirus\options enableantirootkit
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 urlupdateinfo
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 helplink
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 inno setup: app path
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 inno setup: icon group
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 inno setup: setup version
HKEY_CURRENT_USER\software\xp antivirus\options firstrunurl
HKEY_CURRENT_USER\software\xp antivirus\options billingurlapproved
HKEY_CURRENT_USER\software\microsoft\windows\shellnoroam\muicache c:\program files\xpantivirus\xpantivirus.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 publisher
HKEY_CURRENT_USER\software\xp antivirus\options updateurl
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter imagepath
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter start
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter type
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\enum
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\enum count
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 nomodify
HKEY_CURRENT_USER\software\xp antivirus\options aff
HKEY_CURRENT_USER\software\xp antivirus\options registerurl
HKEY_CURRENT_USER\software\xp antivirus\options startminimized
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\enum initstartfailed
HKEY_CURRENT_USER\software\xp antivirus\options enablesysbackup
HKEY_CURRENT_USER\software\xp antivirus
HKEY_CURRENT_USER\software\xp antivirus\options checkhidden
HKEY_CURRENT_USER\software\xp antivirus\options enableadvanced
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 norepair
HKEY_CURRENT_USER\software\xp antivirus\options versionurl
HKEY_CURRENT_USER\software\xp antivirus\register
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9a19966f-ae0e-4699-8cce-9b6f5f1c352c}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 quietuninstallstring
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 uninstallstring
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 urlinfoabout
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\enum nextinstance
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\security
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\security security
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run xp antivirus
- Delete OnlineScannerXP.com directories: Select Start menu > My Computer > Local Disk (C:) > Program Files > Show the contents of this folder. Search for “C:\ProgramFiles\OnlineScannerXP.com“, or any OnlineScannerXP.com directories I list below. Right-click these OnlineScannerXP.com directories. Click “Delete“, “Yes“, and “Yes” again to confirm you want to move the OnlineScannerXP.com folder into the Recycle Bin.
%program_files%\xpantivirus
%common_programs%\xp antivirus
%program_files%\xpantivirus\sysbackup
%program_files%\xpantivirus\quarantine
- Remove OnlineScannerXP.com desktop icons: Drag and drop any OnlineScannerXP.com icons into your Recycle Bin.
- Change your home page: If OnlineScannerXP.com hijacked your home page, select Start menu > Control Panel > Internet Options > General. Under “Home Page” select Use Default. Enter the URL you want as your home page (for example, “http://www.damntrojan.co.uk”), and select “Apply” and “OK“. Open a new browser window to make sure your home page has changed.
You’re done. Hopefully these OnlineScannerXP.com removal instructions got rid of OnlineScannerXP.com for you. Just so we’re clear on things, I can’t guarantee these instructions will completely remove OnlineScannerXP.com from your computer.
If you tried these instructions to get rid of OnlineScannerXP.com and they didn’t work, throw your computer out the window.
Or consult professionals.
OnlineScannerXP.com Might Be Rogue Anti-Spyware
WTF is Rogue Anti-Spyware?
Rogue anti-spyware is a nice way of saying some anti-spyware software may be a fake. Rogue anti-spyware, at best, is anti-spyware software not proven to protect your PC. Rogue anti-spyware, at worst, is installed by a Trojan or browser security holes, gives you false positives in scans, and pops up fake security alerts to scare you into buying it.
Some rogue anti-spyware even is created by spyware and adware folk, or installs spyware onto your PC.
Sound like a scam?
It is.
If you’re infected with fake anti-spyware like OnlineScannerXP.com, you could see a OnlineScannerXP.com popup posing as a security alert. Maybe it looks like this:
Why Rogue Anti-Spyware Sucks
Rogue anti-spyware, like OnlineScannerXP.com, has a few qualities that make it faker than a chest on a Trump chick.
- Fake alerts and false positives: Rogue anti-spyware can drive you crazy with fake security alerts popping up, telling you you’re infected with spyware threats that don’t even exist.
- Copycat images: Rogue anti-spyware sometimes copies the look of real anti-spyware (think of that knock-off Fucci bag you bought your girl friend). More often though, rogue anti-spyware just looks like other fakes.
- High-pressure sales: Rogue anti-spyware will sell you harder than Crazy Gideon pimps an old tape cassette player. Think scare tactics, like fake alerts, and exaggerated “security” scans of your system.
- Poor detection: Besides rogue anti-spyware often plugging in fake threats in security scans, rogue anti-spyware can be sloppy about telling you what you’re really infected with. For instance, rogue anti-spyware might say you’ve got 13 threats, but not what kind of “threats.” Or maybe the rogue says you’re infected with MadeUpParasite, but it doesn’t tell you which files are actually on your computer.
- Weak scans: Rogue anti-spyware might scan your system, but skim over important folders. Though, really, I’d be surprised if it did any scanning at all.
Did OnlineScannerXP.com use these moves to try to get you to buy OnlineScannerXP.com?
OnlineScannerXP.com Could Be a Trojan
WTF Are Trojans?
Remember that college class you took on Greek mythology?
Neither do I.
Trojans get their name from Greek mythology, though — a Trojan is software that acts like a Trojan horse. The same way that Trojan horse looked like a great gift to the Spartans — only it was stuffed full of soldiers — Trojans are software that appear harmless but are really designed to kill your computer.
Trojans often pretend to be a video codec you need to watch porn — really — , maybe a photo attached to email, or some sort of other harmless software. Once you open your gates to a Trojan though, it can spy on you, download more malware, or allow a hacker to do whatever he wants on your machine.
How OnlineScannerXP.com and Trojans Might Infect You
- Websites: When you’re surfing the web, you won’t only get infected when you download some codecs or plugins. Sometimes all you have to do is visit a site and a Trojan secretly downloads itself onto your computer. Scary. Use a browser like Firefox to prevent this — it’s much more secure than Internet Explorer.
- Open ports: If you run any file-sharing applications — and I’m not just talking peer-to-peer music software — you risk opening up your system to infection. It can be as simple as leaving file sharing open on your instant message client. My rule of thumb is to close off every port. Set up a firewall, too, if you don’t already have one.
- Email: Some random person you don’t really remember just forwarded you some hot pictures? Don’t open them. Lots of Trojans are dolled up as harmless looking email attachments that take advantage of security holes in your mail client. Spam blocker software can help, but it’s better just not to open any attachments from people you don’t know.
Popularity: 1% [?]
