How to completely remove XBHI.SYS virus

I will tell you in this post how to fix the issue manually and how to clean it automatically using a special powerful removal tool. You can download the removal program for free here:

Be careful! Full path on computer: %SYSDIR%\DRIVERS\XBHI.SYS

What is XBHI.SYS?

XBHI.SYS is reported and classified as malicious program (malware).
XBHI.SYS actively resists detection and employs a number of techniques to ensure that you cannot remove XBHI.SYS from infected computers.

How XBHI.SYS got on your computer?

Phishing is the most common way for malware to infect computers.
It could be a fake email message that appears to be originated from Microsoft Customer Service, eBay, PayPal, Amazon, or even your bank or insurance company.
Fake emails that appear to come from the police, the FBI and other government entities were also reported.

XBHI.SYS could also infect your computer by exploiting a security vulnerability of your Web browser or one of its plugins.
If this is the case, XBHI.SYS would be injected into a Web page, and could get to your PC when you visited a malicious or hacked Web site.

XBHI.SYS can be distributed with legitimate software that is repackaged by the scammers.
It could be downloaded from warez Web sites or download archives.

How do you know you have XBHI.SYS on my computer?

XBHI.SYS works in background. It does not appear as a window, does not have a shortcut.
XBHI.SYS hides its existence from your eyes.

How to remove XBHI.SYS?

It may not be easy!
Be careful!
Make a full backup of your PC before starting.

Removal guide for XBHI.SYS:

  1. Uninstall XBHI.SYS using Windows uninstallation applet (use Add/Remove Programs or Uninstall Program or Apps & features).
  2. Open Task Manager and terminatel "XBHI.SYS" processes.
  3. Use Windows search to find and remove "XBHI.SYS" files and folders.
  4. Run services.msc and disable a "XBHI.SYS" Windows service.
  5. Execute taskschd.msc to get rid of "XBHI.SYS" scheduled tasks.
  6. Open regedit.exe and delete XBHI.SYS registry keys and values.
  7. Inspect the properties of your desktop and Start menu shortcuts for XBHI.SYS presence and "http://" links.
  8. Open your browser and disable XBHI.SYS plugins. Disable all unknown plugins. Reset the browser settings.
  9. Clean your Recycle bin and temporary files.
  10. Restart your computer and check results.

Autostart registry keys:
HKLM\System\CurrentControlSet\services\xbhi\ImagePath: “system32\drivers\xbhi.sys”
Related Files:
%SYSDIR%\DRIVERS\ASS.SYS
%SYSDIR%\DRIVERS\XBHI.SYS
%SYSDIR%\MBLA.DLL
%SYSDIR%\MOTRPSS.DLL
%WINDIR%\TEMP\WER-51062-0.SYSDATA.XML

File Information XBHI.SYS:

Virustotal = 36/56
MD5 = 8DC4D858BD0C4EC8DDBFA7235CFE802A
File Size: 33792
CompanyName: Microsoft Corporation
FileVersion: 1, 0, 0, 1
LegalCopyright: Copyright 2009


I use UnHackMe for cleaning ads and viruses from my friend's computers, because it is extremely fast and effective.




STEP 1: Download UnHackMe for free

UnHackMe removes Adware/Spyware/Unwanted Programs/Browser Hijackers/Search Redirectors from your PC easily.

Free Download

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10 32 or 64-bit. UnHackMe uses minimum of computer resources.

STEP 2: Double click on UnHackMe_setup.exe

You will see a confirmation screen with verified publisher: Greatis Software. Verified Publisher Greatis Software

Once UnHackMe has installed has installed the first Scan will start automatically

Review the detected threats

STEP 3: Carefully review the detected threats!

Click Remove button or False Positive.

Enjoy!