G4Games » How To's » Removal Guides » How To: Remove Windows XP Fix Virus / Malware ( Removal Guide )

How To: Remove Windows XP Fix Virus / Malware ( Removal Guide )

by Mihai on July 10, 2011


Windows XP Fix is a rogue malware program that acts as an analysis and optimization software so that it can display fake warning messages concerning your HDD, scaring you into purchasing the full version of Windows XP Fix which is nothing more than a forgery.

Windows XP Fix gets installed on your machine via Trojans that once infect your computer they will start displaying fake warning and windows alert messages regarding the integrity of your hard drive. These messages will eventually suggest you that there is a program called Windows XP Fix that will definitely get rid of these problems for you. By clicking on these alerts, Windows XP Fix will automatically download and install on your computer.

Windows XP Fix will then configure itself so that it will automatically start at windows start-up. When Windows XP Fix runs it will continuously display all sorts of error messages every time you attempt to either execute or delete files.

Windows XP Fix will then suggest that you should scan your computer so that it can determine what the cause of the problem is. The scanning process is also a fake and it will “determine” that you have a large number of errors on your machine. Windows XP Fix will then suggest that you need to buy the full version of the program so that you can fix these system errors. Do not get fooled by this statement as it is nothing more than a way to scare you into paying real money for a fake defragment tool.

How To: Remove Windows XP Fix Virus / Malware ( Removal Guide )

How To: Remove Windows XP Fix Virus / Malware ( Removal Guide )

Windows XP Fix will also make certain files and content in your system folders hidden, further scaring you into believing that there is something wrong with your computer. In an attempt to make it look like there’s something with your computer even further, you will constantly get warning messages depicting all kinds of errors, every time you try to run a program.

*NOTE: Do not delete any files in your Temp folder or use any temp file cleaners while your system is infected with Windows XP Fix. This infection will delete some of your shortcuts and make backups of them in the %Temp%\smtmp folder. Once the temp files are deleted, there is no way to get these files and shortcuts back. In the following guide we will cover how to deal with this situation as well.

Windows XP Fix Removal Guide

  • Download RKill and run it on your computer. This program will scan and kill any processes related to Windows XP Fix. This is a vital step so do not skip it. Also keep in mind that Windows XP Fix might generate fake messages regarding the security of RKill, if so ignore any of these messages and go on with the RKill scanning. In case Windows XP Fix prevents you to run RKill altogether, go to the RKill download page and instead, download a renamed copy of this program. Do NOT reboot your computer after completing this step.
  • Windows XP Fix usually comes hand in hand with the TDSS rootkit infection so the next step would be for you to check out this guide and remove any rootkit infections. If not, you will experience internet search redirects so you will be incapable of using your internet. In case the above TDSS guide did not helped and you are still experiencing redirects, follow this other guideinstead.
  • Download Malwarebytes’ Anti-Malware and install it on your computer. Keep in mind that you will need to check the Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware buttons. After the installation is complete reboot your computer if necessary.
  • Once your computer reboots you will be presented with the main MBAM window. Go to the Scanner tab, check the Perform Full Scan option and then click on the Scan button below. After the scanning process is complete, press OK in the message box.
  • After the scanning process is complete you will be presented with a full list of threats found on your computer. Make sure to check all these threats and then press the Remove Selected button below. Once MBAM finishes removing the infection you might need to reboot your computer.

Now, if you’ve followed the guide accordingly you should be rid of any infection on your computer. However you will need to make all your files visible again. Download Unhide.exe and follow this guide in order to restore your shortcuts from the Temp folder.
You should also follow this Secunia PSI guide in order to determine whether or not your system is still vulnerable to future attacks.


  • Steve

    Sorry Guys – doing all that is still a crapshoot. Right now my computer is toast. Malwarebites, Kaspersky, yada yada yada. Was running Kaspersky in Safe mode and the XP FIX things were still popping up. Halfway through (while Kaspersky found 18 viruses missed by Malwarebites) the computer crashed and will not re-boot. I think the writers of this virus figure they’ll either get your money or wreck your computer.

  • Davep

    Much easier way to fix this which worked on mine.

    Reboot in Safe Mode, run explorer

    navigate to windows/system32/restore

    run rstrui.exe

    select a restore point i day before the infection.

    job done in 5 mins.

  • Malcolm Ware

    The most important thing to stop these infections are to keep Windows, Browsers, Java, Adobe Flash and PDF Reader up to date. Most I’ve seen spread via old versions of Java and Adobe PDF Reader.

    Secunia PSI as mentioned is the key.

Previous post:

Next post: