How to Remove the XP Antispyware Virus
XP Antispyware is a spyware that pretends to be a legitimate application. It spreads itself via Trojan horse viruses, and once inside a computer, it generates system messages and alerts showing multiple counts of viruses and spyware found on your hard drive. Then it urges you to buy the XP Antispyware program to remove the found threats. However, both the messages and the product are fake. The spyware targets inexperienced users unfamiliar with this type of spyware. You need to remove it as soon as possible to avoid further damage.
Other People Are Reading
Instructions
-
End System Process
-
1
Press the \"Ctrl,\" \"Shift\" and \"Delete\" keys at the same time to start the Task Manager.
-
2
Click the \"Processes\" tab.
-
-
3
Click \"av.exe\" and the \"End Process\" button.
-
4
Close the Task Manager.
Delete Registry Entries
-
5
Click the \"Start\" menu and select \"Run.\"
-
6
Type \"regedit\" and hit \"Enter\" to start the Registry Editor.
-
7
Browse to and delete the following entries:<br /><br />HKEY_CLASSES_ROOT\\.exe\\shell\\open\\command “(Default)” = “av.exe” /START “%1? %*”<br />HKEY_CLASSES_ROOT\\secfile\\shell\\open\\command “(Default)” = “av.exe” /START “%1? %*”<br />HKEY_CURRENT_USER\\Software\\Classes\\.exe\\shell\\open\\command “(Default)” = “av.exe” /START “%1? %*”<br />HKEY_CURRENT_USER\\Software\\Classes\\secfile\\shell\\open\\command “(Default)” = “av.exe” /START “%1? %*”<br />HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\FIREFOX.EXE\\shell\\open\\command “(Default)” = “av.exe” /START “firefox.exe”<br />HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\FIREFOX.EXE\\shell\\safemode\\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode<br />HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\IEXPLORE.EXE\\shell\\open\\command “(Default)” = “av.exe” /START “iexplore.exe”<br />HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center “AntiVirusOverride” = “1?<br />HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center “FirewallOverride” = “1?
-
8
Close the Registry Editor.
Delete Files
-
9
Go to the \"Start\" menu and select \"Search.\"
-
10
Check the \"All Files and Folders\" option and select the hard drive from the drop-down menu.
-
11
Type \"av.exe\" and hit \"Enter.\" Delete all of the search results.
-
12
Restart your computer.
-
1
Tips & Warnings
Delete only the listed registry entries to avoid damage to the operating system.
References
- Photo Credit Jupiterimages/Pixland/Getty Images
More Like This
Comments
-
Thank you for your help. I tried using MalwareBytes' but it didn't work. I found the threat and said it removed it, but when I rebooted, the virus was still there. I used the steps here and it worked. One difference is that the file name of my virus wasn't av.exe, it was fgs.exe. Same steps but had to look for a different file name. I figured out the name because of the MalwareBytes' scan. Also, I don't have the secfiles in my registry folders. I'm curious about that...
