How to Fix a Ntoskrnl EXE Error

Ntoskrnl.exe errors are caused by a rogue antivirus program.

Ntoskrnl.exe is a file installed and used by XP Antivirus, a rogue antivirus program. XP Antivirus slows your computer, changes your system settings and floods your computer with pop-up warnings. ITo fix Ntoskrnl.exe errors, you will need to remove XP Antivirus from your computer. Note that the removal steps described in this article apply to the Windows Vista and Windows 7 operating systems.

Instructions

End Processes

1. Press "Ctrl" + "Alt" + "Delete" or "Ctrl" + "Shift" + "Escape" to open the Task Manager.

2. Click the "Processes" tab of the Task Manager.

3. Click the "Show Processes From All Users" button.

4. End the following processes. To end a process, right-click the process name (located under the "Image Name" heading) and select "Delete."

   xpantivirusupdate.exe

   ntoskrnl.exe

   ntoskrnl.exe.md5

   explorer.exe.md5

   ntoskrnl.exe

   xpantivirus.exe

5. Close the Task Manager.

Delete Registry Values

1. Click "Start" and type "regedit" into the "Search" box and press "Enter." The Registry Editor opens.

2. Delete each of the following registry values from the left pane of the Registry Editor. To delete a registry value, right-click the registry value and select "Delete."

   HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run xp antivirus

   HKEY_CURRENT_USER\software\xp antivirus\options lastscan

   HKEY_CURRENT_USER\software\xp antivirus\options afterregisterurl

   HKEY_CURRENT_USER\software\xp antivirus\options autoscanonstartup

   HKEY_CURRENT_USER\software\xp antivirus\options

   HKEY_CURRENT_USER\software\xp antivirus\firstrun

   HKEY_CURRENT_USER\software\xp antivirus\options helpurl

   HKEY_CURRENT_USER\software\xp antivirus\options labelurl

   HKEY_CURRENT_USER\software\xp antivirus\options minimizetotray

   HKEY_CURRENT_USER\software\xp antivirus\options offsiteurl

   HKEY_CURRENT_USER\software\xp antivirus\options programversion

   HKEY_CURRENT_USER\software\xp antivirus\options startwithwindows

   HKEY_CURRENT_USER\software\xp antivirus\options totalscans

   HKEY_CURRENT_USER\software\xp antivirus\options transactionkey

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter displayname

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter errorcontrol

   HKEY_CURRENT_USER\software\xp antivirus\options firstrunminimize

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 inno setup: user

   HKEY_CURRENT_USER\software\xp antivirus\options billingurl

   HKEY_CURRENT_USER\software\xp antivirus\options enableantirootkit

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 urlupdateinfo

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 displayname

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 helplink

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 inno setup: app path

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 inno setup: icon group

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 inno setup: setup version

   HKEY_CURRENT_USER\software\xp antivirus\options firstrunurl

   HKEY_CURRENT_USER\software\xp antivirus\options billingurlapproved

   HKEY_CURRENT_USER\software\microsoft\windows\shellnoroam\muicache c:\program files\xpantivirus\xpantivirus.exe

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 publisher

   HKEY_CURRENT_USER\software\xp antivirus\options updateurl

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter imagepath

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter start

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter type

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\enum

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\enum count

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 nomodify

   HKEY_CURRENT_USER\software\xp antivirus\options aff

   HKEY_CURRENT_USER\software\xp antivirus\options registerurl

   HKEY_CURRENT_USER\software\xp antivirus\options startminimized

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\enum initstartfailed

   HKEY_CURRENT_USER\software\xp antivirus\options enablesysbackup

   HKEY_CURRENT_USER\software\xp antivirus

   HKEY_CURRENT_USER\software\xp antivirus\options checkhidden

   HKEY_CURRENT_USER\software\xp antivirus\options enableadvanced

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 norepair

   HKEY_CURRENT_USER\software\xp antivirus\options versionurl

   HKEY_CURRENT_USER\software\xp antivirus\register

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 quietuninstallstring

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 uninstallstring

   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xp antivirus_is1 urlinfoabout

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\enum nextinstance

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\security

   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\xpantivirusfilter\security security

   HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run xp antivirus

3. Close the Registry Editor.

Unregistery DLLs

1. Click "Start" and type "cmd" into the "Search" box and press "Enter." The Command Prompt opens.

2. Type "regsvr32 /u wininet.dll" (without the quotation marks) into the Command Prompt and press "Enter."

3. Type "regsvr32 /u shlwapi.dll" (without the quotation marks) into the Command Prompt and press "Enter."

4. Close the Command Prompt.

Delete Files

1. Click "Start" and click the "Search" box.

2. Search for and delete each of the following files. To delete a file, click on the file name (located in the "Results List") and select "Delete."

   xpantivirusupdate.exe

   ntoskrnl.exe

   ntoskrnl.exe.md5

   explorer.exe.md5

   ntoskrnl.exe

   xpantivirus.exe

   wininet.dll

   shlwapi.dll

3. Restart your computer.

References

• 2-Spyware: Remove SecurityScannerSite.com