I ran into a interesting virus today at work. It was another one of those “buy this to get rid of this” type programs which are pretty common but this was one I hadn’t seen before. It was particularly nasty to get rid of so I thought I would make a short post in case any one else has this issue

Here’s a picture of the offending program:

XPAntispyware2010

I tried multiple Anti-Virus scanners both free and commercial but none of them even pretended to get rid of it. After some investigation Google style I came up with the correct registry entries to remove to get rid of this nasty virus.

Stop and remove XP Antispyware 2010 processes with the windows task manager:

av.exe

Keep the task manager open though because it will keep restarting it self and we may need to kill it again.

Locate and delete the folllowing XP registry entries using regedit:

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command  "(Default)" = "av.exe" /START "%1? %*"
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command  "(Default)" = "av.exe" /START "%1? %*"
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "av.exe" /START  "%1? %*"
HKEY_CLASSES_ROOT\secfile\shell\open\command "(Default)" = "av.exe"  /START "%1? %*"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command  "(Default)" = "av.exe" /START "firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command  "(Default)" = "av.exe" /START "firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command  "(Default)" = "av.exe" /START "iexplore.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center  "AntiVirusOverride" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride"  = "1"

If you do not feel comfortable editing your registry you might want to take your computer to a professional but if you are feeling adventurous you can reach the windows registry by typing “regedit” in the run dialog from the start menu.

Obviously if you are not using Firefox you can omit that key.

Delete other XP Antispyware 2010 files:

I used the windows search bar to find the following 2 files and delete them.

av.exe
WRblt8464P

After doing these steps I rebooted and XP Antispyware was gone.

I wish I could say it was that easy but I had one more problem to solve. It seems when I removed the shell .exe registry keys I disabled .exe files completely. I am sure there is a way not to do this but since I had the experience I will share it, in case anyone else makes the same mistake.

So, after I rebooted I tried to run Malware bytes in order to clean up any loose ends and to my dismay I got the following error.

This file does not have a program associated with it for performing this act

If this happens to you never fear its not quite as bad as it sounds.

  1. Press Start>Run and type cmd in the box and press OK:
  2. At the command prompt type cd c:\windows and press return:
  3. Type copy regedit.exe regedit.com and press return:
  4. Type regedit.com and press return:
  5. Navigate to the following key:
    HKEY_CLASSES_ROOT\exefile\shell\open\command
    
  6. Double-click the (Default) value in the right hand pane and delete the current value data,    and then type:
    “%1″ %* exactly as shown including the quotes and asterisk.
  7. Navigate to the following key:
    HKEY_CLASSES_ROOT.exe
    
  8. In the right-hand pane, set (default) to exefile:
  9. Exit the Registry Editor:

Thats it! You .exe files should be back to normal now and you should run a tool like Malware bytes to make sure you don’t have any more infections or left over files from XP Antispyware 2010.

Malware Forensics: Investigating and Analyzing Malicious Code (Paperback)

By (author): Cameron H. Malin, Eoghan Casey, James M. Aquilina


List Price: $73.95 USD
New From: $52.57 USD In Stock
Used from: $43.31 USD In Stock


List Price: $169.00 USD
New From: $122.69 USD In Stock
Used from: $172.07 USD In Stock

DeliciousStumbleUponDiggTwitterFacebookRedditLinkedInEmail
Tags: , , , , , , , , , , ,
11 Responses to “How To Manually Remove XP Antispyware 2010”
  1. kevin says:

    Hey,
    i followed the instructions, but when i type cmd it tells me

    “This file does not have a program associated with it for performing this act”

    so I dont know what to do now.

    Please help.

    Thanks

    [Reply]

  2. purehate says:

    You will have to find a way to rename cmd.exe to cmd.com.

    [Reply]

  3. jeff says:

    Any advice on how to rename to command.com? I am having the same problem, and am stuck.

    [Reply]

    alex Reply:

    Hello Jeff,

    Check out what xpuser says below. If you can get to the start menu and locate the command prompt that should help resolve your issue. If you did find another way around it though we would love to hear what it is.

    Thanks.
    alex

    [Reply]

  4. purehate says:

    Guys, I found a post where a guy has mad a file which automates the registry process.

    http://www.winhelponline.com/exefix_xp.com

    Just download the file and double click on it and it will fix the registry for you.

    Hope that helps :-)

    [Reply]

  5. xpuser says:

    Thanks man, this really helped. Also, just FYI, what I did was a system restore back to a date before the problem started. However, as you warned, no .exe files were able to run. I know you said to change cmd.exe to .com, and some were having trouble with that. I found that if you can locate command prompt in the startup menu, then browse when it gives you a list of programs to use to open, you can then just go into the System32 folder, click on cmd.exe to open it up and you are golden. Then just use cmd.exe to open regedit, and then you can get in and make the changes and it works like before. Hope this helps

    [Reply]

    alex Reply:

    Hello xpuser,

    Awesome. Thanks for leaving this extra feedback as it should help others get rid of this virus.

    Thanks.
    alex

    [Reply]

  6. andrew says:

    I followed the instructions on restoring my registry to be able to run exe files, but it still did not work…I was a little confused on the last part of the instructions. Are you saying I should set type exefile: for the (default)?

    [Reply]

    purehate Reply:

    andrew if you look up a few posts I linked to a .com file which makes the registry entries for you do that .exe files will work. Might be easier for you.

    [Reply]

  7. Gail Geffers says:

    Hey Great Post came across it on Yahoo. I just recently created a new blog Check it out I really need some feedback on it. Thanks!!

    [Reply]

  8. Ana Goncalves says:

    It won’t allow me to delete:

    9 HKEY_LOCAL_MACHINE\Microsoft\Security Center “AntiVirusOverride” = “1″

    9 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1

    And I keep seeing a “special owner” under permissions as well as some new user, who I keep deleting.

    I have tried to manually delete the files from regedit, but some are missing. I have also attempted to restore my computer, but it has not worked. I have been trying everything for the last 2 days now.

    I wonder what else is left?

    [Reply]

  9.  
Leave a Reply

*Type the letter/number combination in the abvoe field before clicking submit.

*