Do you have pop-ups or your computer infected with trojan or spyware ? Learn how to ask us for help, click here!

How to remove XP Internet Security 2010, XP Guardian, Antivirus XP 2010

XP Internet Security 2010 also known as XP Guardian, XP AntiSpyware 2010, XP Antivirus Pro and Antivirus XP 2010, XP Smart security 2010, XP Defender Pro, Total XP Security is a rogue antispyware program that reports false infections and shows fake security alerts as a method of scaring you into buying the software. The rogue is distributed through the use of trojans. When the trojan is started, it will download and install XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) onto your computer.

During installation, XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) will register itself in the Windows registry to run automatically every time when you start an application (files with “exe” extension). The rogue also uses this method of running to block the ability to run any programs, including security applications.

Once running, XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) will begin to scan your computer and list a large amount of infections. All of these infections are fake, so you can safely ignore them. What is more, while the rogue is running, it will display fake security alerts and notifications with “Spyware infection has been found” or “Tracking software found” header. However, all of these alerts are fake.

Last but not least, XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) will hijack Internet Explorer and Firefox and display fake warnings when you opening a web site.

As you can see, XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) is designed with one purpose to scare you into thinking that your computer in danger as method to trick you into purchasing the full version of the program. If your computer is infected with this malware, then most importantly, do not purchase it! Uninstall the rogue from your PC as soon as possible. Use the removal guide below to remove XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) from the system for free.

Use the following instructions to remove XP Internet Security 2010 (XP Guardian, XP AntiSpyware 2010, XP Antivirus Pro or Antivirus XP 2010) (Uninstall instructions)

Step 1. Repair “running of .exe files”.

Method 1

Click Start, Run. Type command and press Enter. Type notepad and press Enter.
Notepad opens. Copy all the text below into Notepad.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

Save this as fix.reg to your Desktop (remember to select Save as file type: All files in Notepad.)
Double Click fix.reg and click YES for confirm.
Reboot your computer.

Method 2

Click Start, Run. Type command and press Enter. Type notepad and press Enter.
Notepad opens. Copy all the text below into Notepad.

[Version]
Signature="$Chicago$"
Provider=Myantispyware.com

[DefaultInstall]
DelReg=regsec
AddReg=regsec1

[regsec]
HKCU, Software\Classes\.exe
HKCU, Software\Classes\secfile
HKCR, secfile
HKCR, .exe\shell\open\command

[regsec1]
HKCR, exefile\shell\open\command,,,"""%1"" %*"
HKCR, .exe,,,"exefile"
HKCR, .exe,"Content Type",,"application/x-msdownload"

Save this as fix.inf to your Desktop (remember to select Save as file type: All files in Notepad.)
Right click to fix.inf and select Install. Reboot your computer.

Step 2. Remove XP Internet Security 2010, XP Guardian, Antivirus XP 2010 associated malware.

Download MalwareBytes Anti-malware (MBAM). Once downloaded, close all programs and windows on your computer.

Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MalwareBytes Anti-malware onto your computer. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to “Update Malwarebytes’ Anti-Malware” and Launch “Malwarebytes’ Anti-Malware”. Then click Finish.

MalwareBytes Anti-malware will now automatically start and you will see a message stating that you should update the program before performing a scan. If an update is found, it will download and install the latest version.

As MalwareBytes Anti-malware will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main menu. You will see window similar to the one below.

malwarebytes-antimalware1
Malwarebytes Anti-Malware Window

Make sure the “Perform quick scan” option is selected and then click on the Scan button to start scanning your computer for XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) infection. This procedure can take some time, so please be patient.

When the scan is finished a message box will appear that it has completed scanning successfully. Click OK. Now click “Show Results”. You will see a list of infected items similar as shown below.
Note: list of infected items may be different than what is shown in the image below.

mbam
Malwarebytes Anti-malware, list of infected items

Make sure all entries have a checkmark at their far left and click “Remove Selected” button to remove XP Internet Security 2010 (XP Guardian or Antivirus XP 2010). MalwareBytes Anti-malware will now remove all of associated XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) files and registry keys and add them to the programs’ quarantine. When MalwareBytes Anti-malware has finished removing the infection, a log will open in Notepad and you may be prompted to Restart.

Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.

Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.

XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) creates the following files and folders

%AppData%\av.exe
%AppData%\WRblt8464P

XP Internet Security 2010 (XP Guardian or Antivirus XP 2010) creates the following registry keys and values

HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\.exe\shell
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start\command
HKEY_CURRENT_USER\Software\Classes\secfile
HKEY_CURRENT_USER\Software\Classes\secfile\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\secfile\shell
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command
HKEY_CURRENT_USER\Software\Classes\secfile\shell\runas
HKEY_CURRENT_USER\Software\Classes\secfile\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\secfile\shell\start
HKEY_CURRENT_USER\Software\Classes\secfile\shell\start\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | @ = “”%AppData%\av.exe” /START “%1″ %*”
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | IsolatedCommand = “”%1″ %*”
HKEY_CURRENT_USER\Software\Classes\.exe | @ = “secfile”
HKEY_CURRENT_USER\Software\Classes\.exe | Content Type = “application/x-msdownload”
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command | @ = “”%AppData%\av.exe” /START “%1″ %*”
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command | IsolatedCommand = “”%1″ %*”

January 28, 2010 on 2:49 am | In Rogue Anti Spyware, Tutorials - HowTo | 705 Comments |


705 Comments »

RSS feed for comments on this post.

  1. My PC infected with XP guardian 2010 today, I was search “XP guardian 2010″ on big G, found this post on #1, after views other post, I use your instructions, does worked for me.
    is this Spyware new? that really does hijack my IE7, I can’t acces internet via IE when was infections, but now is Okay, is really safe after your method?

    Comment by Story — January 30, 2010 #

  2. This is what i´m looking for… tells me exactly what i have to do. Thanks.

    Comment by Jose Castillo — January 30, 2010 #

  3. Thank you very much. I’ve never dealt with an easier site to use. I had similar problems last year and it took hours to fix the problem. This time it took 20 minutes. I can’t thank you enough.

    Comment by academicus — January 30, 2010 #

  4. Story, yes it is safe for use :)
    You also can scan you computer with an online scanner.

    Comment by Patrik — January 30, 2010 #

  5. Hi, Patrik, thank you for your help.
    I got Norton 360 on duty, but don’t know why unable to block this virus.

    Comment by Story — January 30, 2010 #

  6. Look no further, worked great! Thanks.
    Make sure you complete step 1 before trying to download Malwarebytes.
    Cheers!

    Comment by Chris UK — January 30, 2010 #

  7. Done. Exactly what you said. It is really help and clear instruction. 5 Stars solution.

    Comment by Victor — January 30, 2010 #

  8. I completed step one and rebooted but cannot access internet (malware crap only allows me to see my homepage and then blocks me from moving to any other site) How do I get the download??

    Thanks

    Comment by john — January 30, 2010 #

  9. Beautiful. You guys are awesome. Worked like a charm (as far as I know so far). Thanks a lot!

    Comment by Tim Aldred — January 31, 2010 #

  10. john, probably your PC is infected with another trojan. Ask for help in our Spyware removal forum.

    Comment by Patrik — January 31, 2010 #

  11. I followed these instructions and when I reboot all of my .exe files are disabled and I can’t run the malware.exe file?

    Comment by Patrick — January 31, 2010 #

  12. Patrick, try run .reg file once again. Then try run Malwarebytes one again.

    Comment by Patrik — January 31, 2010 #

  13. tried it again and it works this time, thanks Patrik

    Comment by Patrick — January 31, 2010 #

  14. Thanks a lot for this, just took a while to scan. (full scan about 2hrs for me).

    Comment by D — January 31, 2010 #

  15. Thank you soooo much! Worked great!!!

    Comment by Jane — January 31, 2010 #

  16. Thanks, really easy to follow instructions and advice.

    Comment by Phil — January 31, 2010 #

  17. Thank you a lot! I used the command and it works perfectly! I´m so happy! thank you again! :)

    Comment by mizuno — January 31, 2010 #

  18. Wow! Thanks. The kids computer got infected with this. I found and manually deleted AV.exe with no trouble. Then I ran SuperAnt and MBAM to clean up. But then the EXE files were disabled. I tried to do a repair install of WinXP with no luck. Then I found this site and ran the fix.reg thing. Thanks, everything is good now.

    Comment by Gordon — January 31, 2010 #

  19. I’m not very good with computers at all and was able to follow the instructions relatively easy.

    Thank you for the step by step guide.

    Comment by Rosie — January 31, 2010 #

  20. can i delete fix.reg off my desktop after i finish running MBAM?

    Comment by M — January 31, 2010 #

  21. Did what you said — took about 20 mins doing the quick scan. Seems like it worked great. I just want to know who the hell gets a kick out of making crap like this to mess with peoples computers. Oh well.

    Thanks!

    Comment by Stephen — January 31, 2010 #

  22. The instructions were great. The whole process took about 15 minutes for me with the quick scan. Thank you so much!

    Comment by Mike — February 1, 2010 #

  23. Super!!! worked perfectly thanks!

    Comment by Luke — February 1, 2010 #

  24. M, yes of course.

    Comment by Patrik — February 1, 2010 #

  25. Hmmm, seems everyone got infected since January 30, 2010. Thanks to this site for rescuing my ancient PC! AVG’s doing a lousy job.

    Comment by Scout Finch — February 1, 2010 #

  26. Thanks guys, this worked great.

    A quick tip, if you don’t update, although it finds infections, it won’t kill av.exe. You HAVE TO UPDATE!

    Comment by Ed Richards — February 1, 2010 #

  27. THANK YOU!!!! that damn xp guardian is evil!, and its finally gone easy and simple instructions. got rid of it easily.

    Comment by KJL — February 1, 2010 #

  28. Thanks, superb help and easy to follow instructions.Cheers

    Comment by smawby — February 1, 2010 #

  29. Hey thanks for that, worked a treat :)

    although the fix.reg file didn’t work but, editing the registry direct and removing the keys mentioned and altering the necessary values did.

    oh well so much for norton internet security!

    Comment by Rob — February 1, 2010 #

  30. I watched xp guardian throw a false windows update window and install itself when I went to a fake site(thanks google) It also inserted itself into security center and had a microsoft logo on it…

    Comment by will — February 2, 2010 #

  31. i got my sister’s laptop infected with this stupid fake av but i cant open internet explorer and mozilla firefox so how am i supposed to download the malware things ? IM SO DESPERATE AND I DONT WANT HER TO FORMAT HER LAPTOP . waste of money i tell u .

    Comment by Raden — February 2, 2010 #

  32. oh yea btw , i cant open regedit and any other .exe files . i tried fix.reg thing still didnt work . i tried rkill still doesnt work . AARGGHH !!!

    Comment by Raden — February 2, 2010 #

  33. When I try to run ANYTHING on my computer, it says \the handle is invalid\ PLEASE HELP!! I’m not sure what’s going on with my comp. I can’t even get online, I’m online through my cell phone, which doesn’t help too much!

    Comment by josh — February 2, 2010 #

  34. I’m not sure if I’m doing something wrong, but when I try to run the .reg it says “cannot import the file is not a registry script. You can only import binary files from within registry editor” — is there anything I’m doing wrong?

    Comment by chris — February 2, 2010 #

  35. My pc got infected with XP Internet Security 2010 yesterday (Tuesday 2nd)… I followed the instructions on another webdite and everything turned out well after 2 hours of fighting it… but today, when I turned my pc back on.. pff.. another pop up.. but this time from XP Guardian 2010… I got to this website and followed all the instructions here (similar to what I found yesterday) and now everything is apparently back to normal… I don’t know how this got infected in the first place, but I sure hope this is the last time I deal with it. I’m tired of this.

    I’ll post again if I find another pop up… how does one get infected by this?

    Comment by Shirley — February 2, 2010 #

  36. chris, check twice registry fix. It should have “Windows Registry Editor Version 5.00″ header (first line)

    Comment by Patrik — February 3, 2010 #

  37. Ok.. nothing has happened today… no more virus.. only one alert of a malicious code and NOD32 erased it.

    Comment by Shirley — February 3, 2010 #

  38. Thank you!!! This worked great and only took abouit five minutes to do!

    Comment by Tina — February 3, 2010 #

  39. Oh my god, 1 word LEGEND :)

    I’m not the brightest when comes to computers and this was easy and quick.

    Thank you very much indeed :)

    Comment by Steven — February 4, 2010 #

  40. I have tried but I am stuck on step one, when I doubleclick on fix.reg I get “Windows Cannot find C:Documents and Settings\…..\Desktop\fix.reg”, I also tried to open the file via the registry editor via Run ->REGEDIT but the editor does not open, I’m stuck, please Patrick help!

    Comment by Alan — February 4, 2010 #

  41. Haven’t tried this yet. Went to another website and installed Spydoctor thingy. It found the infections, but wanted me to purchase the full edition to remove them.

    Is this malwarebytes-anti-malware software 100% free?

    Comment by Chris B — February 4, 2010 #

  42. very very very helpful, looked at other sites but well complicated to understand and wanted me to buy a full purchase of spyware doctor, these instructions of yours were a godsend even a dope like me could understand

    Comment by shell — February 4, 2010 #

  43. Thank you, this helped me a lot.
    Had to do a couple manual fixes after all was done: had to reenable firewall service and set startup to automatic (under windows services). Then had to modify security center so that it would check firewall again (it was set as to not check firewall)

    Comment by Matteo — February 4, 2010 #

  44. It worked and I think everything is gone ….but how do I change from running of .exe files?

    Comment by Toya — February 4, 2010 #

  45. Alan, run regedit as notepad in above guide. Then manually remove infected keys (look contents of fix.reg) and restore default value of HKEY_CLASSES_ROOT\.exe

    Comment by Patrik — February 5, 2010 #

  46. Chris, yes you can use Malwarebytes to remove malware for free.

    Comment by Patrik — February 5, 2010 #

  47. Hi….My laptop got infected with XP security 2010 today. ANd then I was not able to connect to internet and started receiving various alerts and auto scan etc etc. I re-booted my laptop…post which its not starting in normal mode. I can start it only in safe mode. Can I run the above command in safe mode? Also, since Iam not able to connect to Internet how can I proceed with Step 2??

    Comment by rk — February 5, 2010 #

  48. Patrik, thanks for the helpful advice it worked like a champ.

    Comment by Jim — February 5, 2010 #

  49. rk, yes you can run above commands in Safe mode.

    Comment by Patrik — February 5, 2010 #

  50. thanks it worked

    Comment by Jason — February 5, 2010 #

  51. Performed the above instructions today, and XP Guardian is no more!

    Many Thanks Patrik and co.

    Comment by Chris B — February 5, 2010 #

  52. How do I undo Step 1 Repair “running of .exe files”?

    Comment by Toya — February 5, 2010 #

  53. amazing. Saved me tons of time and money. No data doctors required. Thanks alot.

    Comment by Tmoney — February 5, 2010 #

  54. How do I undo Step 1. Repair “running of .exe files”? Please help I would like my computer to run as normal

    Comment by Toya — February 5, 2010 #

  55. got xp internet security (no mention of 2010) and am running scan now. 1 item of note.
    The link in the instructions take me to download spyhunter. realized it was wrong when it asked for payment. went straight to malwarebytes.com for the proper download.

    Scanning and hopefull. at a minimum, the fix.reg portion was helpfull to get a browser open.
    Thank you

    Comment by Scott — February 5, 2010 #

  56. Toya, why you need to make it ?

    Comment by Patrik — February 6, 2010 #

  57. Please answer rk’s last question from yesterday. I also can’t access the internet at all thanks to XP Guardian (typing this is on a computer in a library) so how can I download anything and proceed with Step 2?

    Comment by Big Bad John — February 6, 2010 #

  58. I can not run operate my computer as normal. I am unable to run anything without the “open with” box opening. I don’t want to be in the .exe mode forever!

    Comment by Toya — February 6, 2010 #

  59. Thanks a lot, I just do the mentioned step and remove “XP Internet Security 2010 (XP Guardian or Antivirus XP 2010″ from my system.

    Now i m able to work in both browser Internet explorer and Mozilla.

    Comment by Newweb — February 6, 2010 #

  60. Toya, looks like you have not done “first step”. Try run fix.reg once again.

    Comment by Patrik — February 6, 2010 #

  61. I tried it, but the fix did not ask to reboot my PC… did i do something wrong?

    Also, I had Malwarebytes on my PC, it found nothing – I’m doing it again to see if anything shows up…

    Comment by Scoop — February 6, 2010 #

  62. hats of to you…your instructions were clear, lucid and most of all very effective…I was puzzled with this problem for the last two days..your solution was very handy..thank you very much

    Comment by YP — February 6, 2010 #

  63. Look like i got the malicious av.exe thing as well from a dubious site i entered by accident. I had Malwareantibytes already on my computer but i couldnt run it any more… AVG didnt find any thing. Couldnt run IE and Firefox and get mention everytime i open an .exe file. Chrome is imune though it seems. Did step 1 and now i can at least run malware again. I updated and selected ‘full scan’ might as well let it scan everything. Now its doing that. I ll report again if things don’t work out.

    Comment by Joey — February 6, 2010 #

  64. update….. Looks like it worked!

    Comment by Scoop — February 6, 2010 #

  65. I think it worked.
    I executed step 1, already had malware. Updated it. I initially started with full scan but this lasted really long so i switched. Lasted 10 min or something. Found 8 infections not sure if all were related to the av.exe. I deleted them all and now it seems to be gone when i open IE or Firefox or an .exe file so thats good.
    Tx!!

    Comment by Joey — February 6, 2010 #

  66. Sorry for the spam i forgot.
    What to do with the fix.reg symbol on my desktop can i safely delete it/ relocate it or should i leave it there??

    Comment by Joey — February 6, 2010 #

  67. Hi Patrick , if I just buy and install webroot with Antivirus, and do a full sweep… Will this fix the fake ware/ Mal-ware?? And will Webroot also fix my registry problems?? I have that program on my desktop, just not on my Toshiba NB 205. all that I have on my netbook now, is the Norton 360, which failed to detect ANY malware. Please help me! Thank You, and I enjoyed reading other pple comment about you. ^_^

    Comment by LoReNzO — February 6, 2010 #

  68. John, got to step 1, reboot your PC. If Internet is unavailable, try reboot your PC in Safe mode with networking. In this mode try download Malwarebytes. Also you can download Malwarebytes to another PC and copy it to infected computer using a flash disk or cd disk.

    Comment by Patrik — February 7, 2010 #

  69. Joey, yes remove this file.

    Comment by Patrik — February 7, 2010 #

  70. LoReNzO, probably yes.

    Comment by Patrik — February 7, 2010 #

  71. Thanks Patrick! I was able to remove the malware , with Webroot Software, but now I cannot open any .exe file. Do you recommend a good web site or procedure to roll back the registry or maybe help me to do a Restore to an earlier date b/c I cannot even do a system restore now… b/c it does not open in the conrol panel when I click restore… Says Windows cannot open the dll file, … And now my webroot software won’t open b/c it’s a .exe file. This all had happened earlier tonight after I ran a complete sweep with Webroot 6.1.0 (build 145). And I re- started the computer after and it removed the mal-ware… but now all the executable file won’t work…lol… And I’ m takin a break from it tonight and watch some TV… Maybe tommorow I’ll mess with it again… Just can’t wait to get the OS back. One things for sure this Virus is a Bitch!

    Comment by LoReNzO — February 7, 2010 #

  72. LoReNzO, go to Step 1. Repair “running of .exe files”.

    Comment by Patrik — February 7, 2010 #

  73. When I load my laptop I cannot open a internet browser to download malwarebytes the tabs on the bottom of the screen ie “start button ” does not appear just the xp guardian pop ups and my virgin antivirus – I have tried to transfer files over with a pen drive but it does not recognize my flash drive –my named accound is infected but the guest account on my laptop is fine, I can access the internet and there is no xp guardian why is this? Can I complete step 1 and step2 on this? can someone help Thx in advance

    Comment by M — February 7, 2010 #

  74. Hello everyone.
    quick question when it says ‘reboot your computer’ does it mean just restarting or full rebooting? please help asap

    Comment by aaa — February 7, 2010 #

  75. Click Start, Turn Off Computer, Restart.

    Comment by Patrik — February 7, 2010 #

  76. Thanks Patrick.

    Another question do you think the software Spyware Dotor is good?

    And this software that we have downloaded is it a tiral version or 1 year?

    Comment by aaa — February 7, 2010 #

  77. im stuck
    i’ve done until rebooting…but just when i’m about to turn off, a screen pops up saying the program can’t be ended. click end now ( but some files won’t be saved) it says something like that.

    now what do i do?

    i did end now, then did step 2 right tillt the end…but when i restarted after scannin, deleting all the infections….the xp guardian is still not gone

    Comment by aaa — February 7, 2010 #

  78. Please open a new topic in our Spyware removal forum.

    Comment by Patrik — February 7, 2010 #

  79. how do i complete step 1 and step 2 when i cannot open command for the the notepad or internet browser thanks

    Comment by M — February 7, 2010 #

  80. I just removed virus XP guardian 2010 today by following the above steps ..Thanks it worked !

    Comment by fana — February 7, 2010 #

  81. god bless this website – its been over 72 hours and i finally solved it due to not being able to access my desktop! can i just delete the fix.reg file and uninstall the antimalware now? thanks for any advice

    Comment by MO — February 7, 2010 #

  82. It really does work. If you follow the instructions correctly, it will remove the virus. Thanks a million and no more new porn sites for me. My usually 2 will do. :-)

    Comment by Marvin — February 7, 2010 #

  83. Thank you for the help. The first step was not working for me but i rebooted my lappy anyway & continued on & it seems to have worked. I found that if I kept clicking the FireFox icon loads that eventually it opened even though it kept saying it had encountered. also I found that my Chrome browser was not affected by this spyware. Thas how i was able to find this page & fix the problem.

    Comment by Jay — February 8, 2010 #

  84. Thank you very much for helping.
    You are the BEST :)))

    Comment by prodigy — February 8, 2010 #

  85. thnx a lot man

    Comment by alan — February 8, 2010 #

  86. Excuse me, after i’ve done all the instructions, i cannot open .exe files like firefox, cmd.exe or internet explorer and so on. What do i have to do, please i do need help.

    Comment by Sékou — February 9, 2010 #

  87. One other thing, i gotta say that till this moment i don’t see xp guardian anymore, so that works but i must open my program files to.

    Comment by Sékou — February 9, 2010 #

  88. Worked perfectly and in <10 minutes. Thank you very much!

    Comment by Aaron — February 9, 2010 #

  89. I was successful at removing XP Internet Security, but now I can’t open any applications because the file associations were deleted. The system asks me to choose a program to open the file (which it does on everything I try to open) when I double click on fix.exe. What program should I use? I also can’t get into msconfig because there’s no file association with that either. Thanks for your help!

    Comment by Ken — February 9, 2010 #

  90. Sékou and Ken, try run fix.reg once again.

    Comment by Patrik — February 10, 2010 #

  91. If you are having problems removing this popup malware, another suggestion is to restore your registry to a point just before you got it. Say a couple of days ago.
    RUN/Programs/Accessories/Systemtools/SystemRestore

    Comment by Sharon Forgue — February 10, 2010 #

  92. OMG…you guys are awesome!!!!!! Worked perfectly. I have Mcafee installed and it did nothing to protect my computer!

    Comment by Marjorie — February 10, 2010 #

  93. patrik – after removing xp guardian thanks to this website i have been infected again (i know!!) when i double clicked exefix.reg i have an error message “Not all data was successfully written to the registry. Some keys are open by the system or other processes” please help!

    Comment by ambia — February 10, 2010 #

  94. ambia, try stop av.exe process (core component of the rogue) using the following steps:
    Download OTM by OldTimer from here, but before saving, in the Save dialog, rename otm.exe to otm.com and save it to your desktop.
    Run OTM, copy,then paste the following text in “Paste Instructions for Items to be Moved” window (under the yellow bar):
    :processes
    av.exe

    Click the red Moveit! button. Close OTM.
    Now try run fix.reg once again.

    Comment by Patrik — February 11, 2010 #

  95. When I run the fix.reg it says the admin. will not allow it how do I fix this.

    Comment by Sean — February 11, 2010 #

  96. hi Patrick,
    i am new on that problem.
    i run several times fix.reg and reboot also several times but now when i try your link to go to download thé software a pop up appears saying IE meet a problem and must close.
    So i cant download it!!

    do you have an idea for me pleaaaase?
    thx you so much

    Comment by Greg — February 11, 2010 #

  97. Hi Guys, this worked a treat on my wife’s laptop that was infected with “XP Guardian 2010″ I just followed your instructions and it’s all OK, touch wood!!!!! One thing though I tried running the reg file on my own PC desktop just because Ifound your site on my machine and I created it in my notepad but it does not run on my machine. So somewhere my PERMISSIONS are set to stop *.reg files from running, Any ideas what it would be, as I have tried running a .reg file before.
    Many thanks Ron

    Comment by RonH — February 11, 2010 #

  98. my computer will no longer boot up in safe or normal in save it stops and shows what is was loading in normal it is just blank screen. Please help

    Comment by Sean — February 11, 2010 #

  99. fantastic! worked perfectly!

    Comment by rob — February 11, 2010 #

  100. Hello my computer is infected with xp guardian I need help I want to know for step 1 when you said “copy and paste the text below” is that text from my computer ?

    Comment by henry — February 11, 2010 #

  101. Worked A Treat
    Instructions are clear and concise

    Comment by Steve — February 11, 2010 #

  102. Thank you! I have no idea how I got this persistent bug, but following your steps allowed me to get rid of it! Everything is back up and working fine. Thank you!

    Comment by Steve — February 11, 2010 #

  103. Sean, download HijackThis from here, but before saving, rename HijackThis.exe to HijackThis.com and save it to your desktop.
    Run HijackThis. Click “Do a system scan only” button.
    Now select the following entry by placing a tick in the left hand check box, if present:
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    Once you have selected this entry, close all running programs then click once on the “fix checked” button.
    Reboot your computer.
    Try run fix.reg once again.

    Comment by Patrik — February 11, 2010 #

  104. Greg, boot your PC in Safe mode with networking and try download Malwarebytes once again.

    Comment by Patrik — February 11, 2010 #

  105. I am sorry about the long comment that follows. I just wanted to thank you so much for your superb advice.

    I know absolutely nothing about computers, but I was able to follow your instructions and get rid of (the incredibly annoying and persistent) XP Internet Security 2010 trojan within half an hour.

    I had already phoned some computer consultants (who were going to charge £50+ per hour and could not deal with my problem for several days).

    The IT department at my work just told me that (1) they couldn’t connect my computer to their network, for fear of further infection; (2) they couldn’t download any antivirus programme onto a memory stick etc. due to breach of copyright; and (3) my only solution would be to buy Macafee or a similar anti-virus CD.

    I was worried about following online instructions, in case I was unwittingly downloading more viruses or making things worse, but following your instructions made my computer usable almost immediately and for free. I cannot tell you how grateful I am.

    Thank you so much.

    Comment by Anne — February 12, 2010 #

  106. Patrik,

    I hope that you maybe able to help me as my laptop has been infected by the XP Guardian 2010 ALERT virus. A few weeks ago, it was infected by a similarly-named virus, which i thought i had removed by doing a system restore, only for it to return a few days later, but this time as the XP Guardian 2010 ALERT virus. It then stopped me from doing any more sytem restores and i was not able to connect to the internet either, so i went on line on another laptop and followed your advice about using Google Chrome to download the anti-malaware software and ran the san and got rid of all the infections, which seemed to have worked for a week, but now it is back again and this time i not only cannot use the internet, but it is also stopping me from running both Goggle Chrome and the downloaded anti-Malaware scan on my desktop. What can i do?

    Comment by Richard — February 12, 2010 #

  107. Ron, Malwarebytes should fix it. If still having this trouble, then ask for help in our Spyware removal forum.

    Comment by Patrik — February 12, 2010 #

  108. Sean, try boot your PC in Last good configuration.

    Comment by Patrik — February 12, 2010 #

  109. henry, this text have gray color.

    Comment by Patrik — February 12, 2010 #

  110. Richard,
    1. run fix.reg, then Malwarebytes.
    2. if 1, does not work, try boot your PC in Safe mode, then run Malwarebytes.

    Comment by Patrik — February 12, 2010 #

  111. Thank you very much for this. Worked like a charm.

    Comment by Sean — February 12, 2010 #

  112. thanks for that Patrick – that seems to have worked, but i did this last time and it still came back, so wont it just return again in a week’s time? Is there anything else I should be doing to prevent it coming back? I did a full scan, but it did not pick anything else up?

    Comment by Richard — February 12, 2010 #

  113. Hi,
    I’m no expert but by following the instructions carefully I got rid of this f…@!#*!
    After the purge process, I checked with Windows defender and all seems clean. Many Thanks!

    Comment by Phil — February 12, 2010 #

  114. Great thanks! people like yourselves who provide solutions such as these are a credit to the internet great walk through!

    Comment by kamran — February 12, 2010 #

  115. Richard, you should protect your PC.
    1. use good antivirus and antispyware.
    2. use firewall
    3. use an alternate browser.
    4. be careful when opening attachments and downloading files.

    Comment by Patrik — February 13, 2010 #

  116. Patrik, thanks for your advice, but can i just clear up a couple of things with you re protecting my PC …

    1/I have McAfee, but that seems to have done nothing to protect me at all re this virus?? Can you recommend some good, possibly free, antivirus and antispyware for me to download to help protect me from viruses such as these?
    2/When you say “use firewall”, my McAfee tells me that I have firewall protection, which obviously has not helped me re this last virus? Anything else that I can do then re this …?
    3/When you suggest using “alternate browser”, what do you mean?
    4/How should i be careful when opening attachments and downlaoding files, i normally just save them to my desktop?

    Comment by Richard — February 13, 2010 #

  117. Exactly what I was looking for, this virus has been giving me hell for a week now. Thank you so much!

    Comment by James — February 13, 2010 #

  118. Kudos – worked perfectly…thanks!!!

    Comment by john — February 13, 2010 #

  119. MalwareBytes will simply not install. And I can’t seem to get into Safe Mode. Like the other times I’ve gotten this thing, it grows into a festering mess until no option is left but to refresh.

    I’ve been getting this virus for about 6 months. It’s only changed it’s name. I’ve gotten it on 3 different computers. All three I’ve had to completely dump and refresh. My fourth computer (new laptop) has held strong (Norton Symantec). But this latest incarnation of the virus checked right past Norton on my desktop and a refresh is in my near future once again.

    Comment by Gary — February 13, 2010 #

  120. I followed these instructions and when I reboot all of my .exe files are disabled and I can’t run the malware.exe file.

    I have run the .reg file over and over and rebooted over and over. Malwarebytes install will still not run.

    Comment by Gary — February 13, 2010 #

  121. *UPDATE*

    I got mbam-setup.exe to work by changing it to mbam-setup.com. The virus appears to be gone (at this point), however my programs are unable to load due to the .exe problem. I seem to have Toya’s issue. I am unable to run anything without the “open with” box opening.

    I have run the fix.reg a couple times. Still working it…

    Comment by Gary — February 13, 2010 #

  122. A file association fix cleaned it right up. Problems solved. If your .exe still aren’t letting you run programs try this site to associate the .exe back to defaults.

    dougknox.com/xp/file_assoc.htm

    This site helped me greatly Patrik. Hopefully I have the fixes and the “know how” for when this virus creeps back into my life.

    Comment by Gary — February 13, 2010 #

  123. 3/When you suggest using “alternate browser”, what do you mean?

    Firefox, Opera …
    McAfee is good AV, but you need use an antispyware program like Malwarebytes, SpyBot or SuperAntispyware.

    Comment by Patrik — February 14, 2010 #

  124. Gary,make a new reg file with following contents:
    Windows Registry Editor Version 5.00
    [HKEY_CLASSES_ROOT\exefile\shell\open\command]
    @="\"%1\" %*"

    Double click the fix to merge it with Windows registry.

    Comment by Patrik — February 14, 2010 #

  125. Many thanks for the info Patrick it has taken a couple of attempts today but at the mo all is well
    will keep you up to date with this, one again thank you

    Comment by richie — February 14, 2010 #

  126. Thanks. Followed instructions and worked like a charm!!!

    Comment by Tim — February 14, 2010 #

  127. Thanks for all the help! This was a pain in the rear, but I’m finally cleaned up.

    I have NO idea how this thing got into my computer. I think the question needs to be asked “how the heck did this thing get through so many softwares that are supposed to protect computers? Is it just a brand new virus/malware? I have AVG installed, windows firewall activated, and Spybot TeaTimer scanning my computer as I use it. It just seems very peculiar that something would be able to beat ALL THREE lines of defense … withouot me being made aware that at least something was out-of-sorts.

    Anyone have any idea how this thing is being so successful??

    Comment by ian — February 14, 2010 #

  128. ian, probably it infected your pc through an exploit in your browser.

    Comment by Patrik — February 14, 2010 #

  129. Got this stupid thing last night – have NO idea how – Happy Valentine’s Day to me, huh? Anyway, this helped SOOOOOO much! I haven’t had a virus or whatever this was in years – scared the crap out of me and I was terrified I’d have to reformat! Followed your instructions (had to download the files from another computer to a USB stick, but after a few hours, I was free of this thing! I have the same question as ian above – How did we get this? I have Zone Alarm (free) firewall, and Avast A/V installed. Avast is usually pretty good about catching this stuff, but dropped the ball this time. What’s up with that? Is there something better I should be using?

    Thanks again!

    Comment by Deborah — February 14, 2010 #

  130. hi have tried the details above when i get to the double click on fix log box comes up with application cannot be executed, the file is infected please activat software it did do this on trying to open the text box but i did close the box soi was able to save to desktop, have tried the hijack log but there was no HijackThis.com and save it to your desktop.
    Run HijackThis. Click “Do a system scan only” button.
    Now select the following entry by placing a tick in the left hand check box, if present:
    O7 – HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    no seven on mine, i have run mwb once and it did detect and removed some i am curretmly runnina full scan with 14 detected so far. do i keep runnin mwab or do i need to remove from registry to. thank you

    Comment by claire — February 14, 2010 #

  131. Worked great! Thanks.

    Comment by Chuck — February 14, 2010 #

  132. I have completed the first step as stated on to remove this however it doesnt seem to make a difference. I stiil cannot access anything through IE! I can’t even get to the malware site on my desktop! What do I do now???????

    Comment by Heather — February 14, 2010 #

  133. BTW I am accessing everything through my laptop because nothing works on my desktop.

    Comment by Heather — February 14, 2010 #

  134. My system was infected today and caused some panic.

    I have Spybot-Search&Display. The process is so simple.

    1.Go to safer-networking org website
    2.Select language
    3.Click on the download icon on top right of the page.
    4. Download from any source
    5. Install and run
    6. Do follow up ie; clear registry as you can select the option.
    7. Restart system.

    It should be safe.

    Alternatively you can try Smitfraudfix. I have used both of these.

    Please anyone tell whether this virus results in sharing our system information automatically

    Comment by PJ — February 14, 2010 #

  135. My registry editor was disabled so I enabled it and rebooted. Now it is stuck in an endless reboot.

    Comment by Nikhil — February 15, 2010 #

  136. It gives me 5 options, those when computer is not properly shut down.

    SafeMode
    “” with Net
    “” with Cmd
    Last Known Good
    Normally

    None of those work
    Halfway in the boot up it stops and comes back

    Comment by Nikhil — February 15, 2010 #

  137. Now it has opened but Registry Editing has been disabled

    Comment by Nikhil — February 15, 2010 #

  138. Looks like XP Guardian has disabled Registry Editing and I am unable to enable it

    Comment by Nikhil — February 15, 2010 #

  139. Heather, download Malwarebytes to your current PC, then move it to infected computer using a flash or cd disk. Then go to step 1.

    Comment by Patrik — February 15, 2010 #

  140. Nikhil, you can`t merge fix.reg to Windows registry ?

    Comment by Patrik — February 15, 2010 #

  141. thanks!!!

    Comment by awimbawe — February 15, 2010 #

  142. Yes, when I click on it, it says “Registry Editing has been disabled by your adminstrator”

    I am the admin and I have also changed “Prevent Registry Editing”‘s status from “Not Configured” to “Disabled”

    It won’t still work.

    Comment by Nikhil — February 15, 2010 #

  143. My system was infected and caused some panic.

    I have Spybot-Search&Display. The process is so simple.

    1.Go to safer-networking org website
    2.Select language
    3.Click on the download icon on top right of the page.
    4. Download from any source
    5. Install and run
    6. Do follow up ie; clear registry as you can select the option.
    7. Restart system.

    It should be safe.

    Alternatively you can try Smitfraudfix. I have used both of these.

    Please anyone tell whether this virus results in sharing our system information automatically

    Comment by PJ — February 15, 2010 #

  144. Un grand merci à vous !

    Comment by Tristan — February 15, 2010 #

  145. followed your instructions and have my computer back . saved me money on store repairs. your a life saver and money saver. thank you.

    Comment by Paul — February 15, 2010 #

  146. Thankyou very very much for providing this page of info. Followed your instructions exactly and fixed my friend’s PC within minutes. Very simple! I take my hat off to you.

    Comment by Steph — February 16, 2010 #

  147. Hi.
    I’ve got this bug yesterday, and I did both steps and it got removed (or it looks like it’s gone, anyway). But everytime I restart, it comes back when I open IE, even if it’s just Google. I can access IE if I shut down AV.exe, but I’d like to remove this thing completely. What can I do, when this doesn’t work? Is restoring really the only solution?

    Comment by Sophie — February 16, 2010 #

  148. Nikhil, open a new topic in our Spyware removal forum.

    Comment by Patrik — February 16, 2010 #

  149. My PC was infected by the XP Guardian virus.
    I have run the fix.reg and rebooted.
    Then I downloaded mbam-setup.exe and run it and restarted. Be aware not to run this program on the Windows

    desktop, for that didn’t work, but run it with the DOS-prompt C: (out of Windows) and it worked.
    The virus was gone. However my programs were unable to load due to the .exe problem. I was unable to run

    anything without the “open with” box opening.
    Also running the fix.reg again and reboot didn’t help.
    Then I read the notes of Gary and dowdloaded the xp_exe_fix.reg file from the site

    dougknox.com/xp/file_assoc.htm and unzipped it.
    After run this reg-file, all file associations were repaired and everything worked as before.
    Many thanks to Gary and Patrik.

    Comment by Alf — February 16, 2010 #

  150. Sophie, please open a new topic in our Spyware removal forum.

    Comment by Patrik — February 16, 2010 #

  151. Hi

    Had this virus on my wife’s laptop (XP cyrillic language version). Followed Patrik’s instructions exactly, and worked fine.

    Updated Malwarebytes’ Anti-malware to latest version, and a quick scan found av.exe (ROGUE.Win7Antispyware2010) in [user]\Local Settings\Application Data\ and also found a.exe (Trojan.Hegeny) on the desktop. It also rectified three registry data items AntivirusDisableNotify, FirewallDisableNotify and UpdatesDisableNotify.

    Whole clear-up took less than an hour. Now performing full-scans with Malwarebytes then Avast.

    Her laptop uses IE7. Should I download Firefox and suggest she uses this instead?

    Many thanks! Lamp

    Comment by Lamplighter — February 16, 2010 #

  152. I went to TVShack.net & got Guardian XP 2010 Virus. Disabled my entire computer. I had to trick my way onto the interent b/c it disabled Internet Explorer. I called my Anti-virus/Anti-Spyware provider, Norton, & they wanted between $100 & $160 to fix. The information on this website is invaluble. Thanks so much.

    Edward
    -Staten Island, NY

    Comment by Edward, Staten Island — February 16, 2010 #

  153. I’ve followed the steps and now my pc work fine thanks for everything

    Comment by Vince — February 16, 2010 #

  154. seriously, this site has just saved me so much frustration it is unbelievable. thanks for all the priceless info you guys provide bc i am not computer savvy at all.

    Comment by Joe — February 16, 2010 #

  155. Thanks, it worked, 16-02-2010 I was infected by XP Guardian 2010. With your instructions is everything repared.

    Comment by Ton — February 17, 2010 #

  156. Ran MBM before I found your site. It removed XP Guardian but I couldn’t open any programs (.exe). Found your site and ran the registry fix but I get a message…”not all data was successfully written to the registry. Some keys are open by the system or other processes”. I clicked ok, rebooted and can open programs but not sure if I’m totally fixed now. Reran the fix and same result.

    Comment by Jeff — February 17, 2010 #

  157. sorry. meant “ran Malewarebytes…”

    Comment by Jeff — February 17, 2010 #

  158. Jeff, try disable you antivirus and antispyware and run the fix once again.

    Comment by Patrik — February 17, 2010 #

  159. like so many before me, thank you VERY (x 100000) MUCH, Patrik!!

    i was nervous about ‘doing’ my own reg file, but your instructions were clear and concise, exactly what a novice like me needed!

    Comment by Oliver — February 18, 2010 #

  160. I’ve been updating my computer everytime, very careful, using firefox 3.5.7, however i got hit today when i visited pirate bay, i just was randomly searching for stuff, wasnt downloading, seeing if it was available. I searched vista basic and next thing i know i got the virus, it even disabled my antivirus (avira) ..

    Seesh.. damn holes.. i thought this computer was updated to 3.6 evidently it wasnt.. now i got to back up and restore.. ugh! its a new varient, wont let malwarebytes run, even after taking out the registry

    now to issue a bug report to mozilla.

    Comment by tgg — February 18, 2010 #

  161. Patrik, thank you so very much. You are not only a computer and tech genius, you have a heart of gold and give unconditionally.

    Thank you not only for the fix – which worked beautifully but for you! :-)

    BTW.. I must have gotten to this quickly There were only 4 bad files found by Malwarebytes. It’s a horrible trojan malware but thankfully I knew it was lying malware from the start, so didn’t move around to much and closed all open windows and closed Firefox, reopened it with only enough tabs to search for how to remove it!

    So very grateful I found your site.

    Thank you again!
    ~Amy~

    Comment by Amy — February 18, 2010 #

  162. Changing mbam-setup.exe to mbam-setup.com – HOTTTTTTTTTTT.

    Comment by Ryan Rodemoyer — February 18, 2010 #

  163. Patrik – thanks that worked! Appreciate all the help – your fix got me totally back up and running.

    Comment by Jeff — February 18, 2010 #

  164. Help! I do step # 1 but malwarebytes comes up with errors and file corruption and won’t load! I need help Pleaseeeeee

    Comment by AJ — February 18, 2010 #

  165. It says my file source is corrupted. I followed the directions and its not working…Please help me.

    Comment by AJ — February 18, 2010 #

  166. AJ, if Malwarebytes won`t run, follow these instructions.

    Comment by Patrik — February 19, 2010 #

  167. Hey I can get my laptop in safe mode, but cannot connect to the internet, I also cannot do system restore or factory restore, any ideas?

    Comment by Reeshimah — February 19, 2010 #

  168. Reeshimah, you have done first step ?
    And you tried to use Safe mode with networking to download Malwarebytes ?

    Comment by Patrik — February 19, 2010 #

  169. I appreciate the help offered on this website, but it won’t work for me, and have not located help for my issue elsewhere.

    For some reason when I try to edit the registry I get a warning/error dialogue box that pops up and tells me that Registry Editing has been Disabled by the Administrator.

    The problem is I am the administrator and I have configured the system profiles to not enable prevention of registry editing.

    Talk about frustrating. Any help is appreciated. XP Guardian is a major pain – I feel like I’m being extorted here.

    Comment by Andy — February 19, 2010 #

  170. Wow! very easy to folow, thanks for making this so simple!

    Comment by Chris — February 19, 2010 #

  171. I followed the steps and Malwarebytes don’t find anything anymore, but my browsers are still crashing, I run the fix.reg one more time and nothing… am I doing something wrong?

    Comment by Jorge — February 19, 2010 #

  172. I did everything mentioned here, finally got MBAM to work, got the log, the message that everything is fine now, and I restart my of and it’s there again. I have been trying to solve this for 3 hours now… Please help if you have any other way to get rid if this thing, I’ve tried everything here..

    Comment by Juliette — February 19, 2010 #

  173. My pc, my iPod touch turned the word into ‘of’ , sorry.
    Btw
    I also tried the safe mode and everything,I am now running the full scan by MBAM and it found 1 infected item so far. Meanwhile paladin has installed itself again pretending to be avg antivirus performing a scan.then turning into paladin I now have some adult stuff icon links on my desktop and two paladin links.

    Comment by Juliette — February 19, 2010 #

  174. Ok so I did step 1 and it says something about not being binary or something like that. Then I go and restart the computer it dosen’t show anything other than my desktop (with no icons or anything) and that annoying fucking virus. Someone please help me if you can.

    Comment by Eli — February 19, 2010 #

  175. got to say a big huge thankyou to u guys, it sure works, where would people be like me be without u guys… thanks

    Comment by ceri — February 20, 2010 #

  176. Andy, you have tried enable it back ?

    Comment by Patrik — February 20, 2010 #

  177. Jorge and Juliette, open a new topic in our Spyware removal forum.

    Comment by Patrik — February 20, 2010 #

  178. Eli, Once windows loaded, press CTRL + ALT + DEL. Task manager opens. Click File->new task. Type explorer.exe and press Enter.
    Now try run Malwarebytes.

    Comment by Patrik — February 20, 2010 #

  179. Thank You Very Much!!!
    Any tips for to ensure this does not happen again?

    Comment by Daniel H — February 20, 2010 #

  180. Yes, Patrik. As far as going into gpedit.msc and disabling “prevent editing of registry” per instructions elsewhere on the internet. But still no luck. Once I actually got the reg fix file to run but as soon as I rebooted it was all still there. Looks like I’m gonna back up my computer and format now… Tired of dealing with this. If I could I’d probably kill the mofos who write this stuff…

    Comment by Andy — February 20, 2010 #

  181. I got to the point where I could not do/open anything… until I changed “mbam-setup.exe” to “.com” That got it open! Amazing, simple “trick”. However, the quick scan was not checked and it’ll be running for a while. Thanks.

    Comment by Belinda — February 20, 2010 #

  182. To solve the “binary” issue in step one: save the notepad file as:
    File Name: fix.reg
    Save type as: All files
    Encoding: Unicode

    I was getting the same error because my encoding was set to “ANSI”. Change that and it should work.
    Bill

    Comment by Bill — February 20, 2010 #

  183. Got this internet security 2010 virus and all its cohorts and had to use a stick from another computer loaded with “stopzilla” in order to stop it. Now I can go online but this “stopzi–a” program wants cash to delete all the viruses. Do I need to delete this “godzilla” program before I follow steps above or do i just need to try to download mbam?? now that i can actually go online i am afraid to do anything but I am worried about this “stopzilla” thing just sitting there with a bunch of viruses lassoed in a bundle on my computer waiting for ransom to be paid. thanks!

    Comment by donna — February 20, 2010 #

  184. Thank you, great website and easy instructions, will save this page for any future problems i may have. Once again A BIG THANK YOU!!!

    Comment by Andy H — February 20, 2010 #

  185. Ever since copying the windows registry info into notepad and restarting my computer, I can no longer load up any web pages. I copied the anti-Malware program from another computer and it seemed to do the trick, no more xp guardian! It worked! However, it will still not load up any web pages for me. Just acts like I have no internet connection, even though the wireless is working fine and always has. Any ideas?

    Comment by sonny — February 20, 2010 #

  186. Hello Patrick. I am so greatful to have fixed the roblem with my Toshiba NB205 Virus. Thanx to you, I have a working laptop now. I would like to ask you though, “How did you come up with the text code, to fix the .exe files???” Are you a service technician?? And will this fix.reg also work for future reg problems. Thanz so much !

    Comment by LoReNzO — February 20, 2010 #

  187. I made an error in the text. I typed
    [-HKEY_CLASSES_ROOT\.exe} now I can not run any .exe files or regedit to fix the error. How can I correct this?

    Comment by John — February 20, 2010 #

  188. Patrick,
    I have Eli’s problem re: the binary code issue when trying to run the fix.reg, when I hit the control/alt/delete command for windows and type in “explorer.exe” it sent me to “my documents.” Any other thoughts?
    Thanks!

    Comment by jolie — February 20, 2010 #

  189. This works great, thanks! Only problem now is I can no longer access the internet. After re-setting my computer on step 1, internet will no longer work. Not sure why. Do I need to change back something to get things working again?

    Comment by carolyn — February 20, 2010 #

  190. I fined the issue with a exefix_xp.com utility. Everything worked. Thanks.

    Comment by John — February 20, 2010 #

  191. 1-2-3 Solution that works correctly. Thanks so much.

    Comment by Dj Hyperhouse — February 20, 2010 #

  192. Hey, I run fix.reg, then I reboot, then I run MBAM but it doesn’t find anything. I can go on like my computer is fine but it randomly happens again and I can’t go on the Internet until I run fix.reg again and reboot. then I try mbam but it still finds nothing. Why won’t it find the problem so I can remove it!?

    Comment by Zeke — February 21, 2010 #

  193. Thank you so much Patrik. I followed your directions for step 1, but after rebooting, had to rename the Malewarebytes .exe extension to .bat in order to get it to install. After installing and running the Quick Scan, it found and removed 4 infected files, including AV.exe. After rebooting, however, I had the same problem several others had with .exe files not working. So I downloaded the zip file from dougknox.com/xp/file_assoc.htm (recommended by Gary on Feb 13) and running the registry fix and rebooting again, everything seems to be working now. I spent about 2 hours in total trying to fix this… but it probably would have taken me days more if I hadn’t found your site. Thank you thank you thank you.

    Comment by Dave — February 21, 2010 #

  194. Once I actually got the reg fix file to run but as soon as I rebooted it was all still there.

    But you have merged fix.reg with Windows registry ?

    Comment by Patrik — February 21, 2010 #

  195. Donna, you have tried to uninstall Stopzilla using AddRemove programs panel in Control panel ?

    Comment by Patrik — February 21, 2010 #

  196. Sonny, try use WinSock XP Fix.

    Comment by Patrik — February 21, 2010 #

  197. LoReNzO, the fix.reg only works with current trouble. If you need good protection, use an antivirus + an antispyware and an alternate browser (Firefox, Opera, …).

    Comment by Patrik — February 21, 2010 #

  198. John, now no icons and taskbar too ?

    Comment by Patrik — February 21, 2010 #

  199. Jolie, read above comment by Bill (February 20, 2010).

    Comment by Patrik — February 21, 2010 #

  200. Zeke, open a new topic in our Spyware removal forum.

    Comment by Patrik — February 21, 2010 #

  201. I picked up this little piece of malware while searching for local comedy clubs. Fortunately for me I have Google Chrome installed as well as IE and Firefox. Chrome allowed me to surf the web and find your solution, which I would like to add worked great. Instructions were clear and concise. You guys so ROCK!!!

    Comment by Neal — February 21, 2010 #

  202. I have Kaspersky Anti-Virus 2010 on my laptop… and XP Internet Security made it past that.
    My Security Center in my Control Panel showed that both the Firewall and Internet Security were turned off… and whenever I clicked on either it brought up the XP Internet Security Icon in my taskbar (it was constantly feeding me false information, and that I had 29 threats). Thinking that this was Windows software, because my laptop hand some Windows Updates before I turned it off the night before… I bought the XP Internet Security Key to remove these threats. My computer seemed to be running fine for a few hours… and then I decided to check my email for confirmation for buying the program and never recieved any. I clicked on the taskbar icon for XP Internet Security… clicked on contact us… and then my Kaspersky Lab popped up with an alert that a trojan I believe was named Win32.FraudPack was a threat and needed to be blocked and deleted. I did so… and my laptop then froze. When I restarted, none of my taskbar icons came up… I could not do anything without and error message. I installed the fix.reg and was able to get back into everthing and I am currently running a full scan using MBAM. I hope that this completely removes this XP Internet Securty spyware. My issue now is that since I did purchase XP Internet Security (2 year Key)… and I used my debit card to do so… What should I do to block those charges and should I get a new debit card to block any other charges from the authors of this program?? My bank is a local one and my hands are tied until tomorrow morning since they don’t have 24 hour service… please answer and thank you!!

    Comment by productofnoise — February 21, 2010 #

  203. Call or go to your bank and tell them what has happened.

    Comment by Patrik — February 21, 2010 #

  204. Thank you, Patrik…
    My plan was to go to the bank first thing tomorrow morning and stopping payment ASAP…
    I am also going to close that debit card and order another one…
    I made the mistake of doing a full scan instead of the quick scan…
    and its been going on for well past 2 and a half hours…
    Will I still be able to delete everything associated with XP Internet Security by doing the full scan and will it still be free??
    Thanks again for the helpful info…

    Comment by productofnoise — February 21, 2010 #

  205. This XP Guardian is a pain in my butt! I’ve downloaded malwarebytes to my desktop, but now it’s saying that Windows cannot open this file: mbam-setup.exe. What’s my next step?

    Thanks

    Comment by chad — February 21, 2010 #

  206. I finally got it to setup, but now I can’t run Malwarebytes…Please Help!

    Comment by chad — February 21, 2010 #

  207. thank you so much for this! i would’ve been totally lost without this helpful information!

    Comment by Megan — February 21, 2010 #

  208. In searching for av.exe in the registry after doing the above fixes, I still find this setting referencing av.exe. What should I do with it?

    Many thanks

    Key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command

    Value:
    “C:\Documents and Settings\Craig\Local Settings\Application Data\av.exe” /START “C:\Program Files\Internet Explorer\iexplore.exe”

    Comment by craig — February 21, 2010 #

  209. THANK YOU!!
    This got the annoying virus away so quickly!
    it had the easiest step by step and works perfectly.

    Comment by jaew — February 21, 2010 #

  210. It wont work xp stupid prtection blocks all internet acess so i cant get to the sight

    Comment by Jared — February 21, 2010 #

  211. Thank you. Hopefully there is a special place in heaven for folks like you, along with a place in hell for those that create these things.

    I have Malwarebytes on my computer from a clean up last week, and this virus prevented it from running. The reg.fix step got it to work, and it is scanning to rid me of this pest now.

    Spybot and Symantec and firewalls – blew right past them. Ran both a Spybot and a Symantic scan, showed nothing while the false warnings were popping up repeatedly.

    Saw above a reference above to ThePirateBay…think that’s where I got hit, not downloading just looking over a page and WHAM

    Comment by Carl — February 22, 2010 #

  212. Hi Patrick
    I got infected with XP Guardian yesterday and tried to follow your steps but could not do run,Command as it said it was not allowed.
    I then tried the Mcafee scans and it said it had found a problem and would delete but now my computer just wont restart.
    It will come on and go through the windows 2000 page then just as it is about to log in it will switch itself off and start again.
    Can you help please?????

    Comment by Kayvan — February 22, 2010 #

  213. productofnoise, “full scan” is ok too :)

    Comment by Patrik — February 22, 2010 #

  214. Chad, if you have done first step and still Malwarebytes won`t run, then ask for help in our Spyware removal forum.

    Comment by Patrik — February 22, 2010 #

  215. craig, if Malwarebytes have not fixed it, then manually open HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command key, and change “@” value to C:\Program Files\Internet Explorer\iexplore.exe

    Comment by Patrik — February 22, 2010 #

  216. Jared, download Malwarebytes to another PC, then move this file to your computer using a flash or cd disk.

    Comment by Patrik — February 22, 2010 #

  217. Kayvan, you have tried to boot computer in Last good configuration ?

    Comment by Patrik — February 22, 2010 #

  218. It isn’t a big help, but for some “versions” of this virus, if you rename the install file AND the actual file you run of mbam to “IEXPLORE.EXE” it will let you run it, instead of posting a false hijacked file. I had to do this to mine to get it to run.

    Also, just random note, if people are manually closing processes and the Ctrl+alt+del is not working, ctrl+shit+escape should still work.

    Comment by Ally — February 22, 2010 #

  219. Hi Patrick
    I just switch it on and it gets so far but keeps switching off and on.
    How would i go about booting it in last good configuration?

    Comment by Kayvan — February 22, 2010 #

  220. Just throwing out a huge THANK YOU for this guide. It worked perfectly! That is a nasty little virus.

    Comment by Chad — February 22, 2010 #

  221. Was able to get rid of it with the instructions above. However, it should be noted that you’ll need to use that reg fix once for each profile on the machine… otherwise other users won’t be able to open any executables.

    Comment by Ryan R — February 22, 2010 #

  222. Does anyone know where this thing originated from or what sites it may come from?

    Comment by Kelly — February 22, 2010 #

  223. Mate you are an absolute legend, the second time I got infected with this, first time cost me £30 to fix, because I didn’t know of this site. This has gone straight into my bookmarks just incase, and have saved the fix.reg file onto 2 USB sticks :)

    I LOVE YOU!

    Comment by Louis — February 22, 2010 #

  224. our central pc contracted this virus and my son thought it was legit and went ahead and paid the money…my question is, does this thing go away…or does it pop up again in 24hrs asking for payment again?

    Comment by Ritchie — February 22, 2010 #

  225. Help! I tried the run fix.reg which I was able to get on my desk top however when I clucked on it, an admistrator window popped ip saying I have no admin rights? With my name and someone else’ s I didn’t recognize? I then tried to download the Hijack this. But it doesn’t let me do a run as? I dint even see a run as option?

    I have norton my laptop and I’m not sure how I got this viroid if I’m protected? How does that happen?

    Comment by Luz — February 22, 2010 #

  226. Thank you Patrick.
    I tried the above and had trouble downloading Malware and its updates.
    The simplest procedure seems to be to restore your computer to a healthy point in time and THEN download the software necessary to clean out the cretinous crap.
    If these guys aim to collect money surely they are traceable

    Comment by Kevin Cole — February 23, 2010 #

  227. There should be a class law suit against this bitch XP Guardian 2010 and get them into jail.

    Comment by York — February 23, 2010 #

  228. Kayvan, follow the instruction: How to reboot computer in Safe mode with one different, you need select “Last good configuration” in boot menu.

    Comment by Patrik — February 23, 2010 #

  229. Ritchie, if you have purchased the rogue, then:
    1. contact your credit card company and tell them what has happened, ask for chargeback
    2. Use above steps to remove the fake antispyware from your PC

    Comment by Patrik — February 23, 2010 #

  230. Luz, ask for help in our Spyware removal forum.

    Comment by Patrik — February 23, 2010 #

  231. Patrik do you know of any of the “legit” sites that have passed on the Trojans that cause this mess?

    Comment by Kelly — February 23, 2010 #

  232. Hi, just wanted to say thank you so much for these instructions. This worked perfectly and saved my work computer from being eaten up by rogue monsters which would have disastrous. Crisis averted! Thanks again. :)

    Comment by Lindsay — February 23, 2010 #

  233. Patrik do you know of any of the “legit” sites that have passed on the Trojans that cause this mess?

    Comment by Kelly — February 23, 2010 #

  234. I was hit with this severely a few days ago. I installed/ran the fix.reg and the Maleware application, which seemed to remove it.

    It came back.. There is an icon for it in the control panel that wasn’t caught or removed.

    I set the system restore to a month ago. The control panel icon is still there. Should I just keep restoring back to earlier dates?

    Suggestions?

    Comment by Shelly — February 23, 2010 #

  235. Thank you

    Followed each instruction carefully, and got rid of this nasty little sucka! something seemed really fishy with the whole thing right from the ‘beware people stealing your credit card details’ stuff – yeah there is…..you!!

    Thank you!!!

    Comment by Matt — February 23, 2010 #

  236. Hi, every time I try step 1, and I try to reopen the saved fix.reg, it just opens it up displayed in notepad… no yes button to click or anything. What am I doing wrong? I saved as,
    File name: fix.reg
    File type: All Files
    And the last part I tried all of them… please help!

    Comment by Nick — February 23, 2010 #

  237. managed to get rid of the virus by following instructions, (spent the whole day trying to remove it earlier but failed as McAfee wouldn’t remove it!) but this worked. thanks a bunch! :)

    Comment by jiya — February 23, 2010 #

  238. Wow! Thank you! Quick and easy to understand! My popups stopped immediately after I rebooted! Now running malware! Thank you thank you thank you!!!!!

    Comment by Pam — February 23, 2010 #

  239. Patrik, I ran step one, but when i tried to reboot I cannot get explorer to start. any program I try to start, it asks what program to use to open it. Tried running fix several times to no avail. Last configuration also failed. cannot open regedit in run box. Please help.

    Comment by Omer — February 23, 2010 #

  240. I completed the first step, rebooted my computer, and am now able to open of firefox. I downloaded the MBAM spyware, and I have mbam-setup on my desktop. However, when I try and double click to open it, nothing happens. Anything I can do?

    Comment by Chris — February 23, 2010 #

  241. Thank you for the information.

    Comment by Thanks — February 23, 2010 #

  242. Is anyone interested in suing the company who produces such thing? Some actions are needed.

    Comment by Sue the Company — February 24, 2010 #

  243. Shellby, what is caption (label) of the control panel icon ?

    Comment by Patrik — February 24, 2010 #

  244. Nick, right click to fix.reg and select Merge.

    Comment by Patrik — February 24, 2010 #

  245. Omer, look like first step is incomplete. Please try it once again.

    Comment by Patrik — February 24, 2010 #

  246. Chris, probably a trojan blocks Malwarebytes from running. Try run it from Safe mode, or rename installer before running.

    Comment by Patrik — February 24, 2010 #

  247. THANK YOU SOOOOOO MUCH FOR THIS I LOVE YOU IT DIFF WORKS!!!!!

    Comment by Sean — February 24, 2010 #

  248. Thanks Patrick managed to open and save files that i needed.
    You are a star cheers

    Comment by Kayvan — February 24, 2010 #

  249. Great fix.reg was able to run malwarebytes after. Thanks for the hard work and effort that went in to making this possible.

    Comment by Cameron — February 24, 2010 #

  250. Patrick It has the four color shield (that resided on my taskbar and in the popups) and says Security Center

    Comment by Shelly — February 24, 2010 #

  251. Hello ! Thanks for the nice guide ! u guys do a great work on these virus removal stuffs

    Comment by Laurent — February 24, 2010 #

  252. When I double click FixExe I get the message \Registry editing has been disabled by your administrator.\

    Comment by Rob — February 24, 2010 #

  253. Shelly, Security Center is legitimate Windows component :)
    or it suggests you to purchase a rogue antispyware ?

    Comment by Patrik — February 24, 2010 #

  254. Rob, download OTM by OldTimer from here. Run OTM, copy,then paste the following text in “Paste Instructions for Items to be Moved” window (under the yellow bar):
    :reg
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "DisableRegistryTools"=-

    Click the red Moveit! button. When the tool is finished, close OTM and try run fix.reg once again.

    Comment by Patrik — February 24, 2010 #

  255. Patrik, I downloaded OTM, copy/pasted the following under the yellow bar and clicked the Moveit! button.
    :reg
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    “DisableRegistryTools”=-

    I am still getting the message “Registry editing has been disabled by your administrator” when I attempt to run fix.reg

    Comment by Rob — February 24, 2010 #

  256. Patrik: A week or so ago my computer became infected with XP Internet Security 2010. It advanced from frequent popups saying I was infected, etc., etc. Neither SpyHunter nor AVG could detect it. It advanced to the point where I couldn’t get online, and then couldn’t launch any program.

    Found your website and downloaded MBAM on my wife’s computer and followed all the instructions. That all worked marvelously, and I was back in business. But, the virus was still there: kept getting occassional popups of its warning screen. Ran fis.reg and mbam several times to no avail. But the ran AVG and it found several items and cleaned them out. Seems OK now,except that I still can’t get online. Click on Internet Explorer icon, an “Open With” box comes up. Click there on Internet Explorer, and I get a page from Windows explorer.

    Did a little exploring on my own and found this as the first line of a file called IEXPLOR.EXE.exp.log:
    ######## EXCEPTION: 0xC0000005 at address: 0x7E8BA64A: ACCESS VIOLATION read attempt to address 0×00000000

    I think that’s trying to tell me something, but I don’t know what. Got any suggestions?

    ChuckB

    Comment by ChuckB — February 24, 2010 #

  257. Patrick,

    I did do everything you said here however I am still having issues

    1: I am still getting redirected by IE to different websites than what I asked for.

    In my registry, I searched for AV.exe files and noticed a bunch of entries under:
    HKEY_CURRENT_USER, Software, Microsoft, Search Assistant, ACMru,
    ( two folders – 5603 and 5604

    3: Also I can only log into Safe Mode. I keep getting the blue screen with a “page fault in non paged area” error

    Any suggestions?

    Thanks

    Comment by April — February 24, 2010 #

  258. Hello Patrik! I followed all your instructions yesterday and today the XP Internet Security popped up again. How can I fix this?

    Comment by Mel — February 24, 2010 #

  259. Thanks for easy instructions on this weird virus, had I known before I would have saved a lot of headache with my laptop too. Looks like things are ok.

    Comment by lois — February 24, 2010 #

  260. Hi. I did the manual steps because I couldn’t get online. It seemed to work but I made some mistake somewhere. I believe I made an error when I deleted the registry codes. Now I can’t open any applications. When I try to open an application I get the error message that says \this file does not have a program associated with if for performing this action. Create an association in the Folder Options control panel\. How do I fix it? Someone help please!

    Comment by Ariel — February 24, 2010 #

  261. Thanks for this Patrik. Got this nasty little bug just from browsing to the PB main page (didn’t click on anything!). Sad thing is, I run Sophos Enterprise AV & Firewall and while it did quarantine av.exe it would only give me the option of authorising it! A full scan turned up nothing! Useless. At least the firewall blocked it. Once I completed your method, I followed up by running a Windows update and all seems well now. Thanks again mate.

    Comment by Adzam — February 24, 2010 #

  262. Patrick – ah, well, interesting that it looks the same as the rogue invader. Glad to know it’s legit. Thank you!

    Comment by Shelly — February 24, 2010 #

  263. I am not able to run fix.reg. After I opened fix.reg and clicked Yes, it says: ”

    Cannot import C:\Documents and Settings\Desktop\fxi.reg: The specified file is not a registry script. You can only import binary registry files from within the registry editor.”

    What should I do? How do I know whether I am using Windows Registry Editor Version 5.00?

    Thanks.

    Comment by Drew — February 24, 2010 #

  264. great fix. thank you

    Comment by Manjula koneru — February 24, 2010 #

  265. I followed the above instructions but now i am unable to access any of my programmes, it says that i do not have administrator privileges, any help would be appreciated thanks pete

    Comment by pete — February 25, 2010 #

  266. Rob, open a new topic in our Spyware removal forum.

    Comment by Patrik — February 25, 2010 #

  267. ChuckB, run Registry Editor. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command key, and change “@” value to C:\Program Files\Internet Explorer\iexplore.exe
    Note: where C is your system drive (it contains Windows folder).
    If this step above does note help, then ask for help in our Spyware removal forum.

    Comment by Patrik — February 25, 2010 #

  268. April and Mel, open a new topic in our Spyware removal forum.

    Comment by Patrik — February 25, 2010 #

  269. Ariel, repeat first step.

    Comment by Patrik — February 25, 2010 #

  270. Drew, check twice contents of fix.reg. It should have “Windows Registry Editor Version 5.00″ as first line.

    Comment by Patrik — February 25, 2010 #

  271. Pete, post here a full message that computer shows you.

    Comment by Patrik — February 25, 2010 #

  272. Hi all, I went through all the steps and it worked – but when I go to shut down, it’s saying I’ve got updates. Is that the virus’s fake updates, or do I actually have updates? Does the virus pigback on real updates? Thanks!

    Comment by Matt — February 25, 2010 #

  273. Hey sorry but I’m not really good computer. On step #1 what does it mean “Double Click fix.reg and click YES for confirm.” I saved the notebook file but I’M confused what the double click thing means.

    Comment by Wyatt — February 25, 2010 #

  274. Never mind I got it figured out. Thank you so much for doing all this.

    Comment by Wyatt — February 25, 2010 #

  275. I’ve been infected with XP Internet Security 2010.
    I’ve done this:
    -done fix.reg which stopped XP IS from continually popping up
    -found av.exe and deleted it
    -downloaded Malwarebytes and installed
    -I also downloaded Spyware Dr and installed
    -looked for secfile in registry and it’s not there under USER or ROOT.

    Results
    -the malware will not let me update Malwarebytes
    -I cannot boot into Safe mode, the screen keeps freezing at the driver load
    -system will not let me access Malwarebytes website (had to get download through cnet website)
    -system wil not let me update Spyware Dr
    -when doing a normal boot, internet connection in Network Connections takes about 2 minutes to connect
    -still redirects me from Google search to various sales websites and difficult to get out of them

    Comment by Rob W — February 25, 2010 #

  276. Patrik,

    Thank you for response. I checked the contents of fix.reg. This is no “Windows Registry Editor Version 5.00″. All I can see are what I pasted in:

    [-HKEY_CURRENT_USER\Software\Classes\.exe]
    [-HKEY_CURRENT_USER\Software\Classes\secfile]
    [-HKEY_CLASSES_ROOT\secfile]
    [-HKEY_CLASSES_ROOT\.exe\shell\open\command]

    [HKEY_CLASSES_ROOT\exefile\shell\open\command]
    @=”\”%1\” %*”

    [HKEY_CLASSES_ROOT\.exe]
    @=”exefile”
    “Content Type”=”application/x-msdownload”

    Comment by Drew — February 25, 2010 #

  277. My daughter got this virus on her computer and I used these instructions and it seems to be gone. Thank you for making me a hero =)

    One thing though. Now when I go to get online by clicking internet explorer, it brings me to the open with screen. I click internet explorer there and it brings me to C:\Documents and Settings\home
    I am not ssure yet is the same thing will happen with other programs as well, but I assume so.

    What can I do to get this back to normal where I just click on explorer and it comes right up.
    Thanks,
    Dot

    Comment by Dot — February 25, 2010 #

  278. hi all, for some reason i cant complete step 1. When I hit the yes button on the fix icon on my desktop it says it cannot import the file because not all of the data was successfully written to the registry, and that some keys are open by the system or other processes. Help would be appreciated greatly, thanks.

    Comment by dak — February 25, 2010 #

  279. none of the files or resistry are present on my computer, but the virus is still present. malwarebytes will not download correctly at all. is there any way to fix this?

    Comment by charles — February 25, 2010 #

  280. i tried doing this and step one went well but step 2 killed my computer after it was completed and the computer reseted…I can’t log on to my computer pass the welcome menu

    Comment by Daison — February 25, 2010 #

  281. none of my icons will show up now…just the background picture

    Comment by Daison — February 25, 2010 #

  282. you hear the welcome music…then an noice like an error then this dialogue box pops up:

    ————————————————–Microsoct Visual C++ Runtime Library
    ————————————————–Runtime Error!
    Program: …es\common files\roxio shared\etc,etc

    This request the runtime to terminate in an unusual way. Please contact the application support team for more information.

    after this i can just see my background picture and no icons, nothing else, please help!!!

    Comment by Daison — February 25, 2010 #

  283. Patrik: It worked like a charm!!! Thank you so much. You’re terrific!!

    ChuckB

    Comment by ChuckB — February 25, 2010 #

  284. Keep getting Registry Error

    “Cannot import C:/documents…../fix.reg: Error accessing the registry”.

    I looked at previous comments. Have checked first line of fix.reg. Everything seems to be in order. Just keep getting “error accessing the registry”.

    Thanks in advance for your help.

    Comment by Brian — February 25, 2010 #

  285. Thanks for the help!

    Comment by jk — February 26, 2010 #

  286. my malware says nothings wrong,
    and cant update.

    yet the virus is still there.
    WHAAAT DOO I DOOO!

    Comment by emmaaaa — February 26, 2010 #

  287. Wyatt, use another way. Click right mouse button to fix.reg ans select Merge.

    Comment by Patrik — February 26, 2010 #

  288. Rob, looks like your computer also infected with TDSS trojan. Download TDSSKiller from here and unzip to your desktop.
    Open tdsskiller folder and run TDSSKiller. Follow the prompts.
    Once finished, run Malwarebytes Anti-malware once again.

    Comment by Patrik — February 26, 2010 #

  289. Drew, please make a new fix.reg. It SHOULD HAVE “Windows Registry Editor Version 5.00″ in first line.

    Comment by Patrik — February 26, 2010 #

  290. Dot, open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — February 26, 2010 #

  291. Dak, try make first step in Safe mode.

    Comment by Patrik — February 26, 2010 #

  292. and ive repeated the process many times.
    everything works.
    up untill i do the quick scan with the malware program..
    it just says nothings wrong…

    Comment by emmaaaa — February 26, 2010 #

  293. Patrick,

    I tried running the fix.reg in step 1, but when I reboot the antivirus 2010 virus still will not allow me to get past it to download malwarebytes. I posted on the spyware removal forum, but any other help would be greatly appreciated!

    Thank you!

    Comment by Phydous — February 26, 2010 #

  294. now the toolbar is gone and everything!!!!!!!! WHAT DO I DO!

    Comment by emmaaaa — February 26, 2010 #

  295. Charles and Emmaaaa, please ask for help in our Spyware removal forum.

    Comment by Patrik — February 26, 2010 #

  296. Daison, once windows loaded, press CTRl + ALT + DEL. Task manager opens. CLick File, new task.
    Type explorer.exe and press Enter.
    I should back your icons and Start button.

    Comment by Patrik — February 26, 2010 #

  297. Brian, try the following:
    CLick Start, Run, type command and press Enter.
    Command console opens.
    Type regedit and press Enter.
    Registry editor opens.
    Click File, Import. Select fix.reg and click Open.

    Comment by Patrik — February 26, 2010 #

  298. I noticed comments from Dot and others that after running the fix.reg file, when they try to open explorer or even control panel what they get is my documents. In typing the file they have missed a blank space between 2 characters. I tried the file with and without the space and discovered the issue. This line MUST have a space and it’s hard to tell it’s there:
    @=”\”%1\”space is here%*” and it will look like this @=”\”%1\” %*” Patrick I will try TDSSkiller.

    Comment by Rob W — February 26, 2010 #

  299. phydous…I couldn’t run my internet also..I had to save the file instead of running it on a usb drive from my labtop then run it off of my usb drive onto my infected desktop pc to get to step 2..thanks Patrik I will go and try this

    Comment by Daison — February 26, 2010 #

  300. Patrick – I was infected with XP Internet Security and this is what I did:
    -read everything in this site 15 pages, then
    -created and ran fix.reg as you advise
    -searched and eliminated av.exe
    -installed Malwarebyte from the cnet website because I was barred from the Malwarebyte site
    Result:
    -XP Int Sec stopped popping up
    -still could not update Malwarebytes
    -searches from google were still re-directed to sales sites – shopzilla
    -while using explorer, could not backup using lefthand arrow on top of screen from websites
    -explorer would not open right away after doing a boot, took almost 2 minutes
    -could not run Safe Mode
    Further action:
    -downloaded and ran TDSSKiller as per Patrick and it found 4 infected files
    -on another computer, installed Malwarebytes, updated and loaded rules.ref to a USB stick as per your `malwarebytes won`t ìnstall or run` forum
    -ran Malwarebytes and it cleaned up everything-9 infected files
    -using log from Malbytes, modifed XP security centre and any registry values with (1) to (0)
    -modified registry for startmenuinternet to remove ave.exe modifed references and quotation marks in command
    Everything appears to be perfect but I`ve not run Safe Mode yet.
    Users should beware when looking for malwarebytes on google search, the first offering is AntiMalware2010.org which looks suspicously like it might be tied to XP Internet Security.
    Last – this stuff doesn`t install itself. I admit I got infected from Pirate Bay by downloading a file sitting right above the torrent I actually wanted for PowerISO. I recall thinking – that file was very small. To make things worse, I did not pay attention and simply clicked the exe file sitting on my desktop which then loaded XP Internet Security.
    Patrick, would you recommend buying the full Malwarebytes program

    Comment by Rob W — February 26, 2010 #

  301. Whilst these instructions did work, and I am most greatful for that, it appears that this problem is rampant. My brother got the computer infected a couple of weeks ago using IE, and I have recently being infected using Firefox. Are there any reliable methods of prevention? I really do not want to have to go through all this a third time.

    Comment by Stuart — February 26, 2010 #

  302. so fast, easy and usefull! thanks!!!!

    Comment by Steve — February 26, 2010 #

  303. The fix worked, thanks so much!

    Comment by Nancy — February 26, 2010 #

  304. Patrick- a further update:
    I forgot to mention that I ran the exe.download fix from dougknox.com as per comments from other users. Don’t know if it did any good but ?
    Other results:
    -ran EasyCleaner and it found 25 files low priority, 1 high priority, deleted them all
    -Safe Mode opens perfectly
    -ran Malwarebytes in Safe Mode, no infections

    I’ve been dealing with this malware for 4 days and maybe I’m relieved but I’m also convinced my computer is more responsive that it was previously. Without the assistance of yourself and this website, what would I have done?

    How can I make a $money$ contribution

    Cheers Rob W

    Comment by Rob W — February 26, 2010 #

  305. Glad to help you Rob :)
    A few information for you about the MalwareBytes Anti-malware Full version. It features scheduled scanning, scheduled updating and highly advanced Real-Time Protection to ensure protection from installation or re-installation of potential threats as you surf the Internet.
    If you want purchase it, the use the following link FULL version of MalwareBytes Anti-malware.

    Comment by Patrik — February 27, 2010 #

  306. Stuart, to protect your computer, you should have:
    1. good antivirus and antispyware.
    2. firewall
    3. an alternate browser.

    And also be careful when opening attachments and downloading files (from torrents too!!!).

    Comment by Patrik — February 27, 2010 #

  307. thank you a lot pretty simple explanation

    Comment by Daniel — February 27, 2010 #

  308. my icons popped up using your advice but i think some things didnt get properly removed in step 2… i have two runtime error dialog boxes..(’40′) and (’440″) and in my start menu there is a black box where my most used applications would be…and when i click on the applications button it is disabled i cant view all my applications through my start menu…my dvd player is disabled and so is windows media player

    Comment by daison — February 27, 2010 #

  309. Ok. I’m getting a little frustrated. I cannot get my fix.reg to run after double clicking. I read the previous posts and believe I tried everything. I’m still getting the “Cannot import “…”, The specified file is not a registry script…

    1. I checked to make sure that “Windows Registry Editor Version 5.00″ was on the first line.
    2. I tried right-clicking and selecting Merge on the fix.reg file.
    3. I tried “Importing the registry file” into the Registry Editor.

    Nothing seems to work. Any suggestions would be greatly appreciated.

    Comment by Kim — February 27, 2010 #

  310. Do I have to run the update before running the quick scan to remove the Antivirus XP 2010?

    When I try to update the Malwarebytes’ Anti-Malware prior to performing the quick scan, it pops up a message saying ‘An error occurred. Please report the following error code to the Malwarebytes’ Anti-Malware support team. Error code 732 (2, 0) The system cannot find the file specified.’ Please help me on this. Thanks a lot!

    Comment by Eric — February 27, 2010 #

  311. I follow the first step, then when I try to execute a .exe file it does nothing, it tells me “Choose the program you want to use to open this file:

    Comment by mart — February 27, 2010 #

  312. I just wanted to say thanks. The reg entry was worth it alone. The link for malwarebytes was for spywaredoctor. All the same thanks again! I just reinstalled and was using kaspersky internet security.

    Comment by tony — February 27, 2010 #

  313. my icons came back up but now my computer has a runtime error ’40 and runtime ’440 message and the C++ Runtime Error message and when i click start my most used icons are not there..just a black box and i can’t select all applications to view all my applications…what do I do now? i think step 2 uninstalled some of my programs incorrectly and now its not running correct

    Comment by daison — February 27, 2010 #

  314. do i delete the fix.reg file from my desktop?

    Comment by daison — February 27, 2010 #

  315. im sory the first runtime error is ’0′ not ’40′

    Comment by daison — February 27, 2010 #

  316. Worked for me… excellent. Very confused though, wondering why nobody’s anti-virus, anti-spyware software seems to intercept this. Found this searching google, executed the instructions… followed them step by step, and 100% fine now. Thank you,
    Casey from Nebraska

    Comment by Casey — February 27, 2010 #

  317. You guys also posted what the XP AntiSpyware 2010 does to your computer (creats files, regestry files) I was just wondering why you posted it. Do I have to now go and find those files and delete them?

    Comment by Vlad — February 27, 2010 #

  318. Thanks for turning a bad day into a good one. Instructions worked a treat. My McAfee 2009 didn’t prevent it.

    Comment by Jay — February 28, 2010 #

  319. Thank you so much! Glad I was just able to get on your site with that stinkin xp 2010 blockin me up. thanx again

    Comment by A Very Happy Tim — February 28, 2010 #

  320. Now no exe. files run and I can’t download because it says my security settings will not allow this action. guess i’m not out of the woods yet…….

    Comment by A Very Happy Tim — February 28, 2010 #

  321. I have the same issue as Dot from Feb. 25…after successfully removing the XP Guardian, the Internet Explorer will not launch from the Start Menu, and none of the similar situations’ fixes above have repaired it. (Curiously, I *can* launch IE from the desktop?!?) I will try to enter an issue on the Spyware Removal forum (but I admit that at this point, I have no idea what that means….)

    But, this issue aside, and hoping that there aren’t 1,000,000 other undiscovered problems lurking on my PC since I followed your directions here, I am SO SO SO grateful to you, Patrik, for being the one source that helped me out of that awful XP Guardian infinite loop. I thought I would go nuts or just throw this computer away and start over, seriously.

    Here’s hoping I can get the IE on the Start menu to work again, and then all will be back to normal, I think…

    Comment by Laura — February 28, 2010 #

  322. twice this has gotten me. It suddenly appeared after I went onto a website I have been on before. I didn’t even click anything, it just downloaded to my laptop. Why do people created such things? Is this a proper Microsoft product? Can’t they do anything to stop it?

    Comment by lindsey — February 28, 2010 #

  323. Hi, I’ve done all the steps, but I still have antivirus xp 2010 on my computer. The program detected four problems only and I still cannot access my internet explorer. the virus stays inactive until I start up internet explorer.

    I also tried going into safemode, but I can’t. I think it’s because I am using bootcamp on my mac.

    Comment by Susan — February 28, 2010 #

  324. The only internet program that the malware doesn’t seem to block is google chrome. Will uninstalling IE do anything?

    Comment by Susan — February 28, 2010 #

  325. Kim, open the fix.reg in the notepad. Click File, Save as. In the dialog, set Encoding to ANSI and click Save and rewrite old file. Run it.

    Comment by Patrik — February 28, 2010 #

  326. Eric, probably your computer also infected with TDSS trojan. Download TDSSKiller from here and unzip to your desktop.
    Open tdsskiller folder and run TDSSKiller. Follow the prompts.
    Once finished, run Malwarebytes Anti-malware once again.

    Comment by Patrik — February 28, 2010 #

  327. Mart, check twice fix.reg and try run once again.

    Comment by Patrik — February 28, 2010 #

  328. Daison, yes remove the fix.reg. If you need a help, then open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — February 28, 2010 #

  329. Vlad, no. malwarebytes will remove them automatically.

    Comment by Patrik — February 28, 2010 #

  330. Tim, try run fix.reg once again.

    t says my security settings will not allow this action

    How says ?

    Comment by Patrik — February 28, 2010 #

  331. Susan, run the fix.reg once again. The, don` rebooot your PC, click Start, Run, type regedit and press Enter.
    Registry editor opens.
    Navigate in the left panel to HKEY_LOCAL_MACHINE \ SOFTWARE \ Clients \ StartMenuInternet \ IEXPLORE.EXE \ shell \ open \ command

    I the right part of window click twice to “@”. You will see a screen with the contents like below: “C:\Documents and Settings\user\Local Settings\Application Data\av.exe” /START “C:\Program Files\Internet Explorer\iexplore.exe”
    Remove left part, leave only “C:\Program Files\Internet Explorer\iexplore.exe”.

    Repeat the previous steps for Firefox, HKEY_LOCAL_MACHINE \ SOFTWARE \ Clients \ StartMenuInternet \ FIREFOX.EXE

    Comment by Patrik — February 28, 2010 #

  332. Ok so I’m able to save the fix.reg file (as All files and ANSI coding) onto my desktop, but when I try to open it, it just gives me an error message saying that it’s not a valid WIN32 application. Any clue what to do?

    Comment by Steph — February 28, 2010 #

  333. i tired it and its still a problem…norton is not working…can’t access the internet (loads homepage then says a syntax error when i try to go to another one), my sonic dvd player and media player won’t run…and the some of the programs are not running

    Comment by daison — February 28, 2010 #

  334. I have a program called Advanced System Optimizer. I can save registry restore points, much like Windows XP System Restore, except it is not a running application. I simply save a registry restore point every week or so. I had the XP Guardian on my computer and simply stopped the av.exe process (XP Guardian executable) in the task manager and kept the task manager running. I opened ASO and reverted back to a restore point from a few days ago. Worked like a charm.

    Comment by Mark — February 28, 2010 #

  335. Thanks for getting back to me. I did a system restore and everything runs fine…I just have to redownload a couple of applications.

    Comment by Tim — February 28, 2010 #

  336. Thank you so much…it worked great…but its so wierd i got hit yesterday and today my sisters laptop got hit with vista 2010 and it seems to be the same kinda thing…now we just have to figure out how to get it off hers……..THANKS AGAIN

    Comment by Lori — March 1, 2010 #

  337. Steph, try merge fix.reg with Windows registry by doing: right click to the fix.reg and select Merge.

    Comment by Patrik — March 1, 2010 #

  338. Daison, try run TDSSKiller.

    Comment by Patrik — March 1, 2010 #

  339. Thanks a lot!

    This worked perfectly

    Comment by david — March 1, 2010 #

  340. Fellow posters ( & Patrik )
    Follow the instructions exactly how Patrik gives them. It’s very important to restart the computer after the first regfix, otherwise it seems that even after the mal-ware is removed you need to follow the advise of 2/28 to SUSAN from Patrik in order to get IE pointed correctly. Also- once fixed download Crome which wasnt effected by this. Patrik – you are excellent. thank you so much. Robert

    Comment by Robert — March 1, 2010 #

  341. I got XP Gueardian on my computer and i finished doing step 1 and now i cant use my internet and other programs what can i do? :(

    Comment by Will — March 1, 2010 #

  342. Also I am trying to install Malwarebytes to my computer

    Comment by Will — March 1, 2010 #

  343. Can anyone help me i got the XP Guardian on my computer. I did step 1 and i restared and i am trying to download Malwarebytes but my internet and some other programs are not working can someone please help me???? :(

    Comment by Will — March 1, 2010 #

  344. Thanks Patrik. I got XP Guardian 2010 virus on Feb 27 and was able to fix it based on this site and a few others. One thing to note is that newer versions of the virus use different names than av.exe. Mine was MSASCui.exe. Nasty little bugger. I was running McAfee AV by the way.

    Comment by rich — March 1, 2010 #

  345. I just got this program yesterday and the fix.reg thing didn’t work then, but it just worked just now. Scan with MBAM didn’t detect anything (got 1 file yesterday, and removing it didn’t fix the problem. I have McAfee (full version) and it didn’t come up with anything either. The version I have, instead of having the process av.exe I have a process called msascui.exe and so far this factor has made most of these tutorials completely useless to me. HELP PLEASE!!!

    Comment by Yume — March 1, 2010 #

  346. Will, open a new topic in our Spyware removal forum.

    Comment by Patrik — March 2, 2010 #

  347. Yume, probably your computer is infected with an updated version of this malware. Open a new topic in our Spyware removal forum. I will check your computer.

    Comment by Patrik — March 2, 2010 #

  348. Thank you! You are my hero!! The comments on here really helped…I also had no access to internet- thank you to whoever said to go through Google Chrome to be able to download, etc. Lifesaver!
    Thank you so much- I can breathe again!!

    Comment by Che' Gilliland — March 2, 2010 #

  349. Hi,
    I (stupidly) purchased a 6 month subscription to XP internet security rogue yesterday($50.00). So now I can’t open anything on my laptop except the internet. And they don’t have a phone number or website for me to cancel it.
    Pease help, what should I do???

    Comment by Ashley — March 2, 2010 #

  350. Patrik,

    Thank you again it worked like a charm however, I saw that some people were having issues getting exe files to work again and I didn’t see a response. Now I am having the same problem, for example I cannot run malawarebytes it says \open file with\ and I don’t know what to do from there., this also happens when I go to iexplorer I tried starting the process over but it will still not open anything. Do you have any advice for me. Thanks again.

    Comment by Dix — March 2, 2010 #

  351. Also, you are never going to believe this but I got the same virus on my laptop. I ran the fix and it worked but now explorer will not work only firefox. Sorry to keep bugging you but what should I do?

    Comment by Dix — March 2, 2010 #

  352. Thank you, thank you, thank you! This worked perfectly and completely removed XP Guardian 2010 from my laptop. If anyone is in the same fix and has reservations about trusting this website to help you, have no fear. This is a very easy process and works the first time.

    Comment by Jose — March 2, 2010 #

  353. Thanks alot! Think I picked this up on pirate bay, last time i’l be using that site. In fact im quite dubious about all torrent sites now…

    This process seemed to work though thanks.

    Comment by Andrew — March 2, 2010 #

  354. Hi Patrik- I followed the instructions and was able to use my internet explorer again. However, I cannot open many programs/applications on my comp anymore- itunes, Microsoft Word, Excel, media player, etc. Any tips?

    Comment by Nikki — March 2, 2010 #

  355. I tried doing step one but I keep getting messages saying “cannot import C:\Documents and Settings\Regina’s\Desktop\fix.reg:Error accessing the registry

    What should I do?

    Comment by Judy — March 2, 2010 #

  356. I got this virus and it p.o.ed me a lot!! I asked some friends at school about it and they reformatted their computers. I am glad I found this site! thank you so much.

    Comment by Steven — March 2, 2010 #

  357. This doesnt work for me. This XP Guardian is on my daughters laptop and has stopped me from accessing the internet or accessing add/remove programs. I follow the instructions above and when i click on fix.reg all that happens is notepad opens back up with what i just typed. Nothing happens even after the reboot. HELP!!!

    Comment by Scott — March 2, 2010 #

  358. If I just do a system restore, will it get removed?
    because thats what i did and so far its gone

    Comment by Mike — March 3, 2010 #

  359. funny how this virus blocks all exe files and does not allow any antivirus to run or remove it. yet it allows pc doctor to be installed and if you pay to reg pc doctor it will remove it. Stop praising pc doctor people, they are surely the ones who created this virus to begin with. think about it, its the only program allowed to run without modifiying anything first.

    Comment by Kman — March 3, 2010 #

  360. Thank you SO SO much for posting this! I read so many guides for removal, and this is the one that actually worked and properly got rid of the virus! Now I can get on with my day!

    Comment by Kate — March 3, 2010 #

  361. Thanks, Patrik. I already had Malwarebytes but the virus was blocking my ability to use it. Your instructions are simple and direct and now I’m running a scan with an updated Malwarebytes. Hope your day is a good one. You’ve helped make mine one.

    Comment by Pete — March 3, 2010 #

  362. Ashley, call or go to your bank and tell them what has happened. Ask for chargeback.

    Comment by Patrik — March 3, 2010 #

  363. Dix, read my comment above (Comment by Patrik — February 28, 2010 to Susan).

    Comment by Patrik — March 3, 2010 #

  364. Nikki, try repeat first step.

    Comment by Patrik — March 3, 2010 #

  365. Judy and Scott, try the following:
    CLick Start, Run, type command and press Enter.
    Command console opens.
    Type regedit and press Enter.
    Registry editor opens.
    Click File, Import. Select fix.reg and click Open.

    Comment by Patrik — March 3, 2010 #

  366. Mike, yes, its pssible. But anyway, once you have done the System restore process, please scan your computer with Malwarebytes Anti-malware.

    Comment by Patrik — March 3, 2010 #

  367. Everyone! Stay off Pirate Bay That’s where I picked up 2010 xp!!!!I cured my problem with the Reg.fix but It killed all my exe. relations to my programs. I backed up all my music and pics,documenrs etc. on an external drive. I then did a system restore (f10) before your computer boots up. I had to redownload all my programs like bearshare, tunebite etc. and redo all my settings. Now day three of clicking on updates and rebooting my computer for security settings of xp, internet explorer etc. The movies are better on blu-ray anyway, some things aren’t worth downloads! 6 bucks to rent or 1 week of wasted time….Thanks again Patrick for the reg.fix.

    Comment by Tim — March 3, 2010 #

  368. The executable has definitely changed it’s name, no more av.exe and I believe the location may have changed too.
    However, Spybot-Search&Destroy still works. Not sure if the executable is still lying around.
    Any suggestions appreciated.
    Thanks
    Ranadeep

    Comment by Ranadeep — March 3, 2010 #

  369. Works a treat !!! GREAT GUYS….THANKS

    Comment by Mark — March 3, 2010 #

  370. Our PC had XP Internet Security 2010 and wouldn’t let us do anything. I couldn’t even get to start run CMD so I copied the text on my laptop and put on a flash drive. After running fix.reg it was gone. After scan nothing was found; but it’s fixed.
    I won’t have to miss American Idol tonight!!!

    Comment by Mark Tate — March 3, 2010 #

  371. Hey Patrik,
    Thanks for the site! This saved my butt. I had a similar prob to a few people out there – I could not open .exe files even after Step 1. I changed the mbam-setup.exe to mbam-setup.com and that worked to complete step two. Afterwards, I still could not open .exe files and so I used Gary’s found site (from 2-13-10):
    dougknox.com/xp/file_assoc.htm
    And I ran the .EXE default reg thing. It seems to have worked thus far.
    I did try your additional reg fix (from 2-14-10)but it did not work:
    Windows Registry Editor Version 5.00
    [HKEY_CLASSES_ROOT\exefile\shell\open\command]
    @=”\”%1\” %*”

    I was wondering if you can update your original posting of the fix to reflect these problems since it seems a decent percentage have them.

    A few tips on what to do if steps 1 and 2 don’t seem to work could really save some people time and hassel looking through all these thank you posts to try and find a couple of specific answers.

    Just trying to help those a little less patient and savvy as me… I REALLY do thank you for this site and your dedication and help! We all owe you! ~Joe

    Comment by JoeSolo — March 3, 2010 #

  372. First of all – Thanks.
    I followed your directions and got malwarebytes to run, ran the update and ran the quick scan – it found four items – none explicitly labeled XP – but the popups have stopped and the icon is no longer in my taskbar – have I successfully removed the problem? Thanks again.

    Comment by crispien — March 4, 2010 #

  373. PS = This is from my MB Log
    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Documents and Settings\user\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> Quarantined and deleted successfully.

    Comment by crispien — March 4, 2010 #

  374. Hello, I’m still having trouble with step one. When I click ok I get message ending with “error accessing the registry”. I tried to go through command and then regedit and import it, made sure it was encoded ANSI, still got the same message when I tried. Sorry, I’m not very good with computers, anything I can do?

    Comment by Tom — March 4, 2010 #

  375. Ranadeep, if the guide above does ne help you, then ask for help in our Spyware removal forum.

    Comment by Patrik — March 4, 2010 #

  376. crispien, looks like you`re clean. Wait a few days, then update Malwarebytes and perform a new scan.

    Comment by Patrik — March 4, 2010 #

  377. Tom, try split fix.reg to three parts (split at blank line). Then try run first part, second part, …

    Comment by Patrik — March 4, 2010 #

  378. Patrik – your efforts are very much appreciated

    Comment by crispien — March 4, 2010 #

  379. got xp guardian tue..found you wed…steps worked perfectly…no more xp guardian….keep up the good work…thanks a million

    Comment by Mike Stringer — March 4, 2010 #

  380. Tom, thanks.
    Process was simple. Links were accurate/current.
    I’ve been paid in beers for your useful info.

    Comment by Darren — March 4, 2010 #

  381. Can I just say:

    Thank You, Thank You, Thank You, Thank You, Thank You, Thank You, Thank You, Thank You, Thank You, Thank You, Thank You, Thank You, Thank You, Thank You.

    The first computer that got infected with this crap took me a full day to clean up. I followed your procedure, and it was 1-2-3-DONE.

    Again…THANK YOU!

    Comment by Joe — March 4, 2010 #

  382. trying step 1 and i am getting
    “Cannot import C:\Documents and Settings\Justin\Desktop\fix.reg: Error accessing the registry.”

    I copy and pasted everything verbatim from above.

    Comment by Justin — March 4, 2010 #

  383. This was by far the easiest instructions I’ve found. Had 2 pc’s that were infected. First one was easy since the user just stopped using it on the first pop up. The other tryed to fix it himself and it just got worse. You have saved the day! Thanks!!!

    Comment by Arlan — March 4, 2010 #

  384. WOW! Perfect advice from start to finish! I have my PC back! Thank you soooo much.

    Comment by Krystal — March 4, 2010 #

  385. hey this is a really late reply, but I did what you said and it worked perfectly. thank you!

    Comment by Susan — March 5, 2010 #

  386. patrik, this worked perfectly — thanks. but is there a way to prevent this from happening in the future?

    Comment by Fred — March 5, 2010 #

  387. My PC was infected by the XP Guardian virus.
    I have run the fix.reg and rebooted.
    Then I downloaded mbam-setup.exe and run it and restarted. When I open up IE it says add-ons are disabled,unable to open up videos. Also when you try to fix ,select manage add-ons is greyed out in IE.Please help!!!

    Mona

    Comment by Mona George — March 5, 2010 #

  388. Ok – I did the step1 — and now when I rebooted the computer I can do nothing! Everything I try to do I get this message:
    This file does not have a program associated with it for performing this action. Create an association in the Folder Options control panel.

    Now what? This is at work & if I cannot get it fixed I am in big trouble.

    Comment by Jess — March 5, 2010 #

  389. i had this come on my comp today and it would not let me go into anything,i have now found you on our other comp so i shall give it ago,first of all i have gone back into system restore set back to a date that you it was working ok. i’m trying that first then if no good i shall try yours great thanks for your help..

    Comment by phil hicks — March 5, 2010 #

  390. I had this shit on my computer – needed to access it immediately.

    Used the solution provided by this website.

    IT WORKS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    THANK YOU!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    Comment by Brad — March 5, 2010 #

  391. Hi,
    I tried this out and it worked perfectly. Thank you kindly for creating this, and bravo.

    Down with Trojans!

    Comment by Stingdafling — March 5, 2010 #

  392. Pat,

    My computer refuses to acknowledge fix.reg as a .reg file. If I double click it only notepad opens up with the correct code, but nothing happens. If I right click and click Merge it once again just opens notepad and does nothing.

    Any advice?

    Comment by Brian — March 5, 2010 #

  393. BTW, I made sure to save the file as a .reg in All Files and as ANSI.

    Comment by Brian — March 5, 2010 #

  394. THANK YOU SOOOOO MUCH!!!!!!!!!!!!!!!!! i still couldnt download it via internet but i had my mom send it to me over skype and it worked like a charm! you are amazing i will always come her!

    Comment by JOE — March 5, 2010 #

  395. I’m no longer getting pop ups from the “XP Security” crap. Instead I’m just now able to go directly through exe’s by using a loop hole in which i double click the file that belongs to the exe first. So, essentially, I still am not allowed to double click exe’s.

    I used “Hijack This” to delete some crap. I wonder if it backfired.

    Anyway, executables will not open unless I bypass them by opening files that lead to them.

    Curious, eh?

    Comment by Brian — March 5, 2010 #

  396. hey i got instructions from another website and its pretty similar but i didnt do the command thing. do i need to do that?

    and also i ran malwarebytes on my computer but it doesnt detect the xp internet security virus. please help!!

    Comment by Matt — March 5, 2010 #

  397. Hey Patrik! I followed all of your instructions. However, I had to manually remove MSASCUI.EXE from the registry shell open command, and for some reason, Malwarebytes has only found the following:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    Registry Data Items Infected:
    HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> Quarantined and deleted successfully.

    What should I do??

    Comment by Jey — March 6, 2010 #

  398. Patrick you are a genius and I like to thank you, I just got my internet turned on 2 days ago and I got the virus. Thank to your help i am up and running, again thank you and keep up the good work

    Comment by Ramon — March 6, 2010 #

  399. Fred,
    1. use good antivirus and antispyware.
    2. use firewall
    3. use an alternate browser.
    4. be careful when opening attachments and downloading files.

    Comment by Patrik — March 6, 2010 #

  400. Mona,
    Click Start, click Run, type regedit, and then click OK.
    Locate the following registry subkey:
    HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions
    In right panel right click to NoExtensionManagement and select delete. Confirm it. Close registry editor and reboot your computer.

    Comment by Patrik — March 6, 2010 #

  401. Jess, the fix.reg twice, then run it once again.

    Comment by Patrik — March 6, 2010 #

  402. Brian, run click Start, Run, type command and press Enter. Command console opens. Type regedit and press Enter. Registry editor opens. Click File->Import.

    Comment by Patrik — March 6, 2010 #

  403. Brian, try first step once again. If it does not help, then open a new topic in our Spyware removal forum.

    Comment by Patrik — March 6, 2010 #

  404. Matt, only if you still having troubles with this malware.

    Comment by Patrik — March 6, 2010 #

  405. Jey, computer works fine now ?

    Comment by Patrik — March 6, 2010 #

  406. Pat,

    Thank you very much for that simple instruction. The only change I had to make was to integrate the .reg file in safe mode with the command prompt, since regular mode wasn’t letting me open it.

    Thanks again!

    Comment by Brian — March 6, 2010 #

  407. Ran Malware Bytes and destroyed the (BLEEP). Although, once I did and rebooted I couldn’t access exe’s again, so, I ran fix.reg one more time. It worked. Thanks once again for your generous assistance Pat. Really, thank you!

    Comment by Brian — March 6, 2010 #

  408. Let me just say that we should all be appreciative of Patrik’s generosity in dealing with idiot’s like me.

    There seems to be a war brewing between the malware morons and the truly compassionate honesty of the internet community.

    May compassion and honesty win!

    :)

    Comment by Brian — March 6, 2010 #

  409. This worked great. I am now back online. Only problem I am having is computer runs much slower tahn before. Is there a fix for this. Thanks so much for this web site. This is my second bout with this virus.

    Comment by Clayton — March 6, 2010 #

  410. when i tried to open the file, there’s a message saying Ërror accessing the registry. I tried Start-Run-Command-regedit-import fix.reg but it still doesn’t work. i’m going crazzzyyy :D

    Comment by Lexilia — March 6, 2010 #

  411. When I double click on the fix.reg file I get “Registry Editor has encountered a problem and needs to close.” Now what do I do? Please! Help! Anybody?

    Comment by Dave — March 6, 2010 #

  412. It is people like you, Patrick, that make fixing something so easy. Thanks for your help as I too was infected with the XP Guardian and had checked several other sites. Yours was one of the few that offered the help for free and in a simple language that was easy to follow. Thanks again!

    Comment by Sarah ST — March 6, 2010 #

  413. Patrik, my computer is working fine, but I was wondering if I needed to do anything else, since Malwarebytes didn’t actually locate and remove the .exe file.

    Comment by Jey — March 6, 2010 #

  414. Have XP Internet Security 2010. Step 1- Error msg trying to run fix.reg: “Cannot import fix.reg: Error accessing the registry”. Do I need quotes on Windows Registry Editor Version 5.00 ? Please help!

    Comment by Char — March 6, 2010 #

  415. Just tried importing fix.reg in regedit(v5.1), but get the same “Cannot import – Error accessing the registry”. Any suggestions?

    Comment by Char — March 6, 2010 #

  416. Patrick: I’m getting the same response as Kim from Feb. 27. I cannot get my fix.reg to run after double clicking.“Cannot import “…”, The specified file is not a registry script…

    I opened the fix.reg in the notepad. Click File, Save as. In the dialog, set Encoding to ANSI and click Save and rewrite old file. Run it.

    Nothing changes. Any help? Thanks

    Comment by Bill — March 6, 2010 #

  417. I had this nonsense pop up yesterday (not sure how or from where) and was a bit panicked. However after initially being unable to open ANY programs this morning, I rebooted for a 3rd or 4th time over the last 12 hours or so and it seems to have disappeared altogether? Has anyone else found it just goes away under these circunstances.
    May I add my thanks and praise for the work I see you doing here Patrik; it is appreciated by us all.

    Comment by John K — March 6, 2010 #

  418. Wow! I was a skeptic but it worked and was free!! No more problems and I think the computer works as fast now as it did yeas ago! Thanks guys!

    Comment by JackMaghee — March 6, 2010 #

  419. this infected my good work computer at noon today. of course searching for porn… when i first got it and realized what happened i was so sick!!! that was so smart searching for porn on work computer :)

    since xp internet security 2010 kept closing my browser i paid for malware bytes. i had to jump drive it in, but it worked perfect! thank god all back to normal. lost 7 hours in time and a year in stress terms!

    Comment by brett — March 6, 2010 #

  420. Absolutely fabulous method! I have both AVG and Spybot and AVG did absolutely nothing to ward off my laptop from this stupid virus/malware. Thank you SO incredibly much for this! It definitely saved me having to make another $75 trip (I got hit with viruses mid-January, hence having Spybot and AVG) to get my laptop fixed. I tried running Spybot cause my firefox icon got changed/disappeared and IE ddnt work but Spybot doesn’t get rid of the whole problem. Found out I could open Firefox b/c of step 1 and this method works like a charm aside from some difficulty trying to get the Malware Bytes install menu to open. Thanks again!!!

    Comment by Mimi — March 6, 2010 #

  421. Just wanted to say thanks, the above instructions worked great! This virus is relentless, but all programs and my pc are back to working normally. Follow the instructions and you can’t go wrong. One note: if you can’t get on the internet after step 1, I just used my laptop and downloaded the Malwarebytes program, then transferred it to my infected PC using a flash drive. Ran it no problem (if it won’t start, just run the reg.fix file again, then Malwarebytes will install no problem) Everything worked just as the instructions said, thanks again!!

    Comment by JM — March 7, 2010 #

  422. Clayton, please open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — March 7, 2010 #

  423. Lexilia, try open the fix.reg from Safe mode.

    Comment by Patrik — March 7, 2010 #

  424. Dave, run registry editor (read my comments above), then Click File, Import and select fix.reg.

    Comment by Patrik — March 7, 2010 #

  425. Jey, try scan you computer with an online scanner or open a new topic in our Spyware removal forum. I will check your computer.

    Comment by Patrik — March 7, 2010 #

  426. Char, looks like you need reset permissions for any unwriteable registry keys.
    Try the following steps:
    Visit the following Microsoft Web site: http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B
    Click Download to download the SubInACL tool (SubInACL.exe).
    When the download is finished, double-click to install the downloaded file.
    The SubInACL tool installs to the %programfiles%\Windows Resource Kits\Tools folder.

    Click Start -> Run, type Notepad, and then press ENTER.
    Copy and then paste (or type) the following text into Notepad:
    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
    subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

    Click File, and then click Save As.
    Copy and paste the following path and file name into the File name box:
    %programfiles%\Windows Resource Kits\Tools\sub.bat
    Click Save.

    Click Start, and then click Run.
    Copy and then paste the following path and file name into the Open box, and then click OK:
    %programfiles%\Windows Resource Kits\Tools\sub.bat
    A Command Prompt window opens.
    The tool runs for about 5-10 minutes or longer. Do not restart the system at this point.
    When the tool has finished running, the Command Prompt window closes automatically.
    Restart the computer.

    Note: Good idea – make a backup before any changes. Read and follow the instructions: How to backup Windows Registry.

    Comment by Patrik — March 7, 2010 #

  427. Bill, check your fix.reg. It should have “Windows Registry Editor Version 5.00″ in first line.

    Comment by Patrik — March 7, 2010 #

  428. Patrik,

    I did step 1, rebooted my computer and downloaded malwarebytes. However, when I tried to click on the desktop icon malwarebytes, the following windows pop up, “vbAccelerator SGrid II Control: Run-time error ’0′” and “Malewarebytes’ Anti-Maleware: Run-time error ’440′: Automation error.” Did I do something wrong?

    Thanks

    Comment by Chris — March 7, 2010 #

  429. when i try to run the fix.reg i get a error message saying cannot import the specified file is not a registry script. you can only import binary registry files from within the registry editor. what am i doing wrong? also i cant download the program because when i open explorer or mozilla xp guardian wont let me go to the site. how can i download?

    Comment by brian — March 7, 2010 #

  430. Worked beautifully! Thanks

    Comment by R — March 7, 2010 #

  431. Fabulous solution!!! Worked like charm. I thought I was screwed when this thing popped up and your step by step worked great. Thanks for being there.

    Comment by Gene — March 7, 2010 #

  432. Hi Patrik I just completed the first step and XP Guardian is gone! It didn’t appear when I rebooted my computer and there are no more alerts. Should I continue with the next steps or can I leave it as is?

    Comment by Rabia — March 7, 2010 #

  433. MASSIVE Thanks!!

    Spent 5 hours pressing everything I knew in to service before I found this little techy guide and, fingers crossed it hasn’t re-appeared since following your instructions to the letter.

    You might be thousands of miles away, but if you ever call over to Lancashire UK, send me a mail and I’ll buy you a pint!

    Cheers mate!

    Pete

    Comment by Pete, Lancashire UK — March 7, 2010 #

  434. I completed the second step as well and it worked like a charm! Thank you!

    Comment by Rabia — March 7, 2010 #

  435. Thank you very much for providing a solution to XP guardian 2010.

    I am trying to remove it, but need some help!

    (1) “fix.reg” problem: I tried to follow the instructions above, but I find that I could not finish step 1. “fix.reg” simply won’t run.

    (2) Malwarebytes character display: I tried to skip step 1 and proceed to installing Malwarebytes (Step 2). I couldn’t install when mbam_setup.exe was on the desktop, so I moved the mbam_setup.exe to C:\ and installed from command line.

    During installation, the software asked me about the language to install. Because my computer is traditional Chinese, I installed traditional Chinese version. Then I realized that I cannot read the characters from Malwarebytes because it is encrypted. Desperate, I uninstalled the software and reinstalled again with English version. Still, Malwarebytes is still encrypted.

    (3) Malwarebytes scanning: I thought that I could proceed with scanning anyways provided that I press the right buttons. So I tried, but the scanning ended in 3 seconds. I can’t read the log because it is also encrypted.

    Please advice on how I should solve this problem.

    Thank you very much for your kind help.

    Frank

    Comment by Frank — March 7, 2010 #

  436. Thank you! worked great. Caught XP Internet Security 2010 while at whitepages.com! had no other website open. I don’t know how people get these things in the places they do.

    Was infected by one of the other versions a while back but it wouldn’t even let me open notepad or turn off the computer. I ended up having to re-install Windows to get rid of it. This was much easier lol. 20 min and thank you!

    Comment by David — March 7, 2010 #

  437. Patrick,

    You’ve made significant deposits in the bank of karma!

    Live Long & Prosper!

    Peace,

    YinYangMind

    Comment by YinYangMind — March 8, 2010 #

  438. So glad i could read this site – as i thought it was just me and i had done something, even though my Norton Virus checker couldnt fine anything!!!!

    I dont really want to pay to get rid of this as just paid for Norton,

    Please explain in simple words how i can get rid of it?
    Thanks

    Comment by Kai — March 8, 2010 #

  439. Hi There, I tried the above steps but I still cannot access my laptop the way I used to. The Guardian boxes are still popping up and I cannot access the internet as the error and virus protection boxes keep preventing me moving further. Any ideas?

    Comment by No Luck! — March 8, 2010 #

  440. Just wanted to say that you for the fix…. Was clear concise and much appreciated.

    Comment by scott — March 8, 2010 #

  441. Boss’s choice
    worked for me cheers guys x

    Comment by Big Jon ;) — March 8, 2010 #

  442. Patrik! You are the man!
    For some reason Malwarebytes runs for only ten minutes or so and the stops responding. Any thoughts?

    Comment by Britty — March 8, 2010 #

  443. STEP 1 WAS PERFECT!!! I had been trying all night to fix it and called the computer guy we use ocaasionally for our small offce. He wanted to wipe the hardrive and reinstall everything for 200 bucks. He was nice enought to try a few things over the phone but could not help.
    THANK YOU VERY myantispyware.com MUCH FOR YOUR POST!!

    Comment by Andrew Anton — March 8, 2010 #

  444. Hi Patrik,

    We tried the fix last night and it worked great! It was gone as far as we could tell, however this evening I launched internet explorer and the stupid thing is back. I ran the fix again and it seemed to work. How can we make sure it’s really gone this time?

    Comment by Liz — March 8, 2010 #

  445. Can’t thank you enough – your fix worked great. After getting this once, I restored my system from a full backup and thought I was safe. Then it came back. Any idea what vector is carrying this? Is it possibly Facebook?

    Comment by Doug — March 8, 2010 #

  446. Thanks heaps guys. This really works well and fixes the problem straight away.

    Comment by Naim — March 9, 2010 #

  447. Rabia, anyway, download malwarebytes, update it and perform a scan.

    Comment by Patrik — March 9, 2010 #

  448. Frank, right click to fix.reg and select Merge.

    Comment by Patrik — March 9, 2010 #

  449. “No Luck!”, try repeat all steps, If it does note help, then open a new topic in our Spyware removal forum.

    Comment by Patrik — March 9, 2010 #

  450. Britty, try reinstall Malwarebytes. If it does not help, then open a new topic in our Spyware removal forum.

    Comment by Patrik — March 9, 2010 #

  451. Liz, read and follow the steps from my answer to Susan (Comment by Patrik — February 28, 2010).

    Comment by Patrik — March 9, 2010 #

  452. Doug, its possible, also probably your computer is infected with a hidden trojan that reinstalls the malware.

    Comment by Patrik — March 9, 2010 #

  453. Patrik: Fix ran successfully first time, and Malwarebytes found and killed the malware, I think. However, I’ve lost all the file associations like several others here. Can’t run any executable file; so can’t run regedit and can’t do a system restore. You advised others in my position to run fix.reg again; have done this but still no .exe files (including Malwarebytes) will run. Your advice to Susan on 28 Feb seems to apply, but I cannot run regedit: I get the message “Windows cannot open this file: … Windows needs to know what program created it” etc. What steps should I take next? Thanks in advance for any help.

    Comment by Karern — March 9, 2010 #

  454. Thanks Patrik! I have taken those steps…you are life saver!!

    Comment by Liz — March 9, 2010 #

  455. Patrick

    I located the registry key, however there was no restriction folder in the registry, even did a search for it and no luck!!!

    Mona

    Comment by mona george — March 9, 2010 #

  456. I don’t know how to thank you for these great instructions. I am a ameture computer person and these instructions were awsome. Straight forward, easy to understand, and with a great outcome. Everything worked and the MalWare program I actually use on a regular basis so I was comfortable using it. Some sites told me to download other programs I was unfamiliar with and reluctant to use. Since I already had MalWare I used it and had no problems. The fix.reg worked like a charm as well. I just want to thank the wirter of the conclusion to this stupid torjan and I want to tell him I appreciate the effort he put fourth in making it so user friendly.

    Anyone that reads this turst me it works great. I had no problems after the hole process.

    THANKS AGAIN!!! ;)

    Comment by DorkJediMater — March 10, 2010 #

  457. Quick question…Im getting the same error message about not being able to register fix.run and can only import from within the computer…DO you have a step by step for removing other hidden trojans, with instrustions that are easy to follow like the above? Im not technical, and I understand…Just need a little more guidance!

    Thanks a lot if you can help me out.

    Comment by Kelsie — March 10, 2010 #

  458. ^^^
    I restarted my computer and put it into safe-mode and still noting!
    kels

    Comment by Kelsie — March 10, 2010 #

  459. When I go through step one I save it as fix.reg on my Desktop and I select all files from file type. When I got to open it up, I am not asked to confirm anything, and it just opens up and doesnt do anything… what am I doing wrong?

    Comment by Hamp — March 10, 2010 #

  460. Patrik,

    I’ve gone through all the steps and removed 4 items from my desktop computer. However when it asked me to restart I did and now it is in continuous loop of rebooting. How do I fix this? Thanks.

    Comment by Jonny — March 10, 2010 #

  461. Why does your link for malware download go right to PC doctor with ANTIVRUS 2010???? Isnt that what we’re trying to get rid of?

    Comment by Frank — March 10, 2010 #

  462. My parents bought Norton (which cost them 100 dollars and i told them it was a waste of money) and i was so happy i got this virus again, just to prove them wrong. (i’ve gotten the 2008, 2009 versions also) thanks for the tips on making it go away!

    Comment by joey — March 11, 2010 #

  463. PATRIK!!!!! MAN THANK YOU THANK YOU!!!! THIS SITE IS THE BEST!!!!, I AM SUCH A ROOKIE WHEN IT COMES TO THE COMPUTER!!!, YOU HAVE MADE ME FEEL LIKE A WELCOMED MEMBER TO THE GEEK SQUAD!!!!!, LOL, I STILL DONT KNOW WHAT I DID BUT I FOLLOWED YOUR ONSTRUCTIONS AND BAMMM!!! IT WORKED!!!! MAY YOUR LIFE BE FILLED WITH RICHES!!!!! I ALWAYS WONDERED ABOUT WHO?? STARTS THESE VIRUSES!! AND ARE THE SAME FOLKS THAT SHOW US HOW TO FIX THEM …..ARE THEY THE ONES WHO CREATE THEM??, I HOPE NOT!!.. I DIGRESS….ANYWAY THANK YOU WHOEVER U ARE!!!! THANK YOU!!! THIS STUFF REALLY WORKS!!!!

    Comment by DOUG — March 11, 2010 #

  464. Kelsie, please open a new topic in our Spyware removal forum. I will check your computer.

    Comment by Patrik — March 11, 2010 #

  465. Hamp, try another way. Right click to fix.reg and select Merge.

    Comment by Patrik — March 11, 2010 #

  466. Jonny, try boot your PC in Last good configuration.

    Comment by Patrik — March 11, 2010 #

  467. Frank, probably you have clicked to Google ads. At the page scroll down to “Download MalwareBytes Anti-malware” and click to a link.

    Comment by Patrik — March 11, 2010 #

  468. Patrik, I re-did step one again. I clicked on merge, and also tried double clicking it to open it, but it still did not ask me to confirm anything. IS there are way around the confirmation step… or any other suggestions?

    Comment by Hamp — March 11, 2010 #

  469. OK. I need a little help here. I did the first step. Then I downloaded the anti spyware, but it won’t run. There’s now no XP security popping up, but my internet isn’t running properly and it keeps asking me what program I want to use to run everything. HELP?!?

    Comment by Jennifer — March 11, 2010 #

  470. Im stuck on the first thing, when I type command it opens but I cant type anything in. I think I have the newest version of the xp antivirus because it seems smarter. im going to try to get it done in safe mode? also malwarebytes wont start for me when im in normal mode in windows but works fine in safe mode with or without network..and when i scanned in safe mode in MWB it didnt detect anything, and my mcafee scan said it quarantined something but im still getting the stupid popups every 5 minutes, any help would be appreciated

    Comment by jeffy — March 11, 2010 #

  471. Thank you so much. Caught it out of the blue and followed everything you said. Now its working fine again and the popups are nowhere to be found. It seems to have worked a treat. Thanks again, its people like you that make the internet an awesome place after sifting through the scum that makes these things.

    Comment by Greg — March 11, 2010 #

  472. Well, I thought I was a pretty good tech until I ran up against this devil. The .exe was new to me, and as a consequence, I did a rebuild to kill the malware. But, that was after hours of trying to fix the .exe issue. Thank you so much for this post. I, and thousands of other techs appreciate your efforts on our behalf. God Bless…..

    Comment by Jon Tabakman — March 11, 2010 #

  473. Thanks man worked great. Good Work!

    Comment by Mike — March 11, 2010 #

  474. Patrik:

    I wrote you a couple of times, but my posts seem to have disappeared, so will try again.
    I had been infected with Internet Security 2010 several weeks ago and did all the things you suggested and got rid of it.
    Then last week we got infected with smss32. Followed your instructions for that and got rid of it, but Internet Security 2010 reappeared. Again folloewed the instructions and got rid of it again. However, the machine won’t boot up. It stops at the Welcome screen and freezes up. Have to shut down . It will boot up in safe mode, but even there Internet Security seems to creep in. How can I get it to boot up normally?

    ChuckB

    Comment by ChuckB — March 11, 2010 #

  475. hi, havent used my pc at all today, woke up to find this dam thing on it. It says above to do that reg thing, then install malware bytes, which i already have on my system but cus of this xp guardian, it doesnt allow u to install or open any files, it will just reopen the av.exe in the processes, so u might have to boot to safe mode before doin this.

    Comment by zer0darkx — March 11, 2010 #

  476. Patrik,

    I’ve tried rebooting in last good configuration, it runs a disk check then reboots and I’m back to square one. If I try to skip the disk check it reboots automatically again. The only way I can get it to power on is in safe mode. Thanks in advance.

    Comment by Jonny — March 11, 2010 #

  477. Dear Patrik

    Like some of your other XP internet security 2010 victims, I have fallen at the first hurdle. When trying to run the fix.reg I get the error message saying cannot import, the specified file is not a registry script. you can only import binary registry files from within the registry editor. Pleeeeeaaaaase help? (What the hell is a registry editor anyway?!)

    Comment by Alison — March 12, 2010 #

  478. Thank you! My PC got this problem. I followed your directions, I got rid of the problem and now my PC is working very well. Thanks a lot!

    Comment by Luz — March 12, 2010 #

  479. Patrik – PLEASE HELP? Hair falling out and am at screaming/crying point now after 5hrs trying … fix.reg OK. MBAM install process gets to finish point, but then a big fat nothing. Have tried name change to .Com etc. but still no good. What should I try next?

    Comment by Alison — March 12, 2010 #

  480. Alison, please open a new topic in our Spyware removal forum. I will check your computer.

    Comment by Patrik — March 12, 2010 #

  481. I followed these steps exactly.
    So far, so good …the virus is gone.
    Another website had a slightly different set of registry edits, which didn’t work.
    This one worked fine.

    Comment by Ian — March 12, 2010 #

  482. Followed the instructions last night, except I didn’t update Malware Bytes (I already have it, and had just updated a few days ago). Last night I had seemingly gotten rid of it, but it returned this morning. Managed to use the fix.reg again, and chose to update Malware Bytes this time–it’s currently scanning once more for it. Do you suppose it came right back because I didn’t update? The list of bad files it found last night seemed awfully small. Would you think this current scan after updating it would work?

    Comment by Nick — March 12, 2010 #

  483. now it’s saying it’s not finding anything malicious! and the faulty program is still there! help!

    Comment by Nick — March 12, 2010 #

  484. Nick, open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — March 12, 2010 #

  485. A lot of my programs on my computer wont work (ex. itune, mic. word and excel), becuase if antivirus 2010. When I click on these programs, it says application not found? Will step 1 repair or find these programs? or will I have to reinstall windows again.
    Also I click on merge and also tried double clicking it to open fix.reg, but it does not ask me to confirm anything. IS there are way around the confirmation step… or any other suggestions?
    Thanks

    Comment by Hamp — March 12, 2010 #

  486. Brilliant!! Thank you so much

    Comment by Mike — March 12, 2010 #

  487. everything seemed to work perfect…..BUT then it all came back! Do I start from step 1 again?
    Do I do it all over, again?

    Comment by tylerdurden — March 12, 2010 #

  488. I’m in the result of this problem right now, but I’m really confused and frustrated. I’m still on the first step! My notebook shit’s being annoying. =.=” Thank you though, I’ll inform my friends to stay clear of XP Guardian and etc!

    Comment by Noi-Chi — March 13, 2010 #

  489. Hamp, open a new topic in our Spyware removal forum. I will help you.

    Comment by Patrik — March 13, 2010 #

  490. I consider myself an IT-expert but this new version (av.exe) was really hard to hunt down. I have to admit im very happy with your instructions.

    Comment by Ragnarok — March 13, 2010 #

  491. I can’t run the fix.reg cause it’s saying
    “currently used by ano ther program”
    Did anyone got the same problem – can I proceed somehow without copleting step 1?
    Thanks.

    Comment by Paul — March 13, 2010 #

  492. I used the Trojan Remover from —> .simplysup.com . It removed the “xp internet security” problem I had on the first run. It has been 5 days with no reaccurances.

    Comment by Kevin — March 13, 2010 #

  493. if you are having a hard time savign teh fix.reg the way i was. its because under teh name area you need to change it to “all files” i have jusr gotten rid on my virus thanx so much for your help this worked perfectly for me

    Comment by cdndaddy — March 13, 2010 #

  494. Thank you very much. Helped me a BUNCH… I had Mlwarebytes for a year now and went to it for a help when I so that stupid XP thing, and that BITCH blocked my Malwarebytes and wouldn’t let me open it… So thanks a lot for showing how to get rid of it in the first place, now Malwarebytes are scanning for all the leftovers)))))

    Comment by Gino — March 14, 2010 #

  495. To Patrick… Do you think it would be a good idea to additionally turn the “System restore” off before following your directions or it doesn’t matter for this case?

    Comment by Gino — March 14, 2010 #

  496. First of all, thanks for this info site and easy instructions.

    It seems to be working. But

    1.)My desktop went to the original xp theme like it is a fresh install. I managed to find my previous desktop icons in a new folder created on c:\Documents and Settings\user-computerID as it used to be = c:\Documents and Settings\user

    2.) My programs are not executing – like everything is a fresh install.

    My question is… what is this folder it created from #1? Would it be safer to start a new user account? This happened after using Malwarebytes.
    Please advise. Thank you…

    Is it possible to retrieve my old desktop with icons & folders and to have my programs working again w/out having to redo passwords and settings (like Filezilla – all accounts are gone)? Using Windows XP Pro SP3

    Thanks Patrick!

    Comment by art — March 14, 2010 #

  497. Gino, once yo have done the above instructions, turn off System restore, reboot PC and turn On it back. Make a new Restore point.

    Comment by Patrik — March 14, 2010 #

  498. merci pour les blondes qui se trouvent bien dépourvues (voulant absolument voir l’episode 12 de la saison 6 de grey anatomy) en chopant ce virus sur allostreaming….
    Explications très claires et très efficace

    Un très grand merci !

    Comment by pascale — March 14, 2010 #

  499. I wish someone suggested a way seems to Antivirus XP 2010-proof the computer once it was removed. I successfully removed this particular malware but got it back again – despite installing Lavasoft Ad-Aware (I also run Avast Personal ed-n). If you already have an answer it would be much appreciated. My first observation was, java icon got kicked off in the tray bar at approximately the time I got the infection again.

    Comment by igloo — March 14, 2010 #

  500. just wanted to let you knwo that it has been a day and i have had no other issues with my computer. thanx so much for your system patrik.

    Comment by cdndaddy — March 14, 2010 #

  501. Patrik,
    Nice job on this post. Thank you so much for all the help. I have my .exe files all up and running again, and malwarebytes is doing its search. Already found a couple infected files! Thank you again,
    Alex

    Comment by Alex — March 14, 2010 #

  502. yo Pat, my man, you need 2 help me out! I see u got yo PC game down pat (PUN!! haha luv em!) so I was wondering WHAT SOULD A BROTHA DO??? I got this PC infected 2 days ago, and luckily I can use all my programs, the stupid av.exe thing just keeps popping up. I already tried the “.reg” method but it doesn’t work. Can I do a “search” for any of the files related to this god-damn virus?

    Comment by N.K.O. — March 14, 2010 #

  503. I have been using Malwarebytes on all my computers for several years now, after my daughter’s computer was infected two ago with a Browser highjacker. This software is simply amazing as it has saved me (and my daughter) countless times.

    This malware was particularly nasty in it would not allow me to start Malwarebytes. I also run Spybot Search and Destroy (freeware). I ran Spybot first, although it did not completely clean this malware, it allowed me to start and run Malwarebytes, which completely cleaned my daughter’s computer. Defense in depth is a good strategy.

    Comment by Lew — March 14, 2010 #

  504. I got this nasty SOB today. felt that I should point out that for some oddity, i was never redirected to another page, it just inconspicuously downloaded itself. I was just perusin’ DA, when my internet closes and I get a message sayinf my comp was hijacked and I need to download “Guardian” so I was like “pfft, right, windows actually making something for XP now.” So I turned off my internet connection, Avasted my computer, got rid of the main file labeled “Fake,” then came here. Good thing I have 2 PCs, otherwise I’d be lost. My point is, this thing downloaded without a page redirection, sript prompt, opened file, or anything of the sort. Thanxx a bunch!

    Comment by drakkie — March 15, 2010 #

  505. It isn’t dead yet! I installed software, had no problem with the notepad, the files are deleted, BUT THE GUARDIAN IS STILL THERE! I rebhooted my internet, the guardian warning still popped up! It’s alive still. What do I do now?

    Comment by drakkie — March 15, 2010 #

  506. Thank you so much!!! it works!!! just follow the instructions carefully..thanks again!

    Comment by krissy — March 15, 2010 #

  507. drakkie, please open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — March 15, 2010 #

  508. hi patrick.
    when i try opening the fix.reg file (saved under all files and ansi coding), i get a message that it is not a valid WIN32 application. i tried the other options you’ve previously suggested, right clicking and merge, doing it in multiple steps, importing through registry editor, but none seem to work. any ideas on what could be wrong?

    Comment by Peter — March 15, 2010 #

  509. Ugh I’m so frustrated. I’m trying to help my neighbor fix this on HER laptop. I found these instructions so though piece of cake. I know nothing about computers but figured I’d try. I typed EXACTLY what you have on step 1. And it registered..though i have no clue what that means or does. But I still can’t access the interent on her computer. I have re registered the fix file 500 times and rebooted. I’m sitting now in safe mode with networking and it’s still popping up. I put the Malware on a flash drive and tried installing on her comp but it keeps shutting down and stops mid scan with soem error message. What do I do..cause I’m about to just give her back her computer and say call Geek Squad..I’ve been at this damn thing all day..errrr Help!

    Comment by Carrie — March 15, 2010 #

  510. Saved my life. Thankyou.

    Comment by Antwone — March 15, 2010 #

  511. Worked perfectly!!! Thanks a million

    Comment by Liz — March 15, 2010 #

  512. Carrie, please ask for help in our Spyware removal forum.

    Comment by Patrik — March 16, 2010 #

  513. So I tried running the repair of the .exe files like in step one, and when I went to reopen the fix.reg file it still opens up in notepad even if I save it to all files!!! What do I do?

    Comment by Kelly — March 16, 2010 #

  514. Kelly, i have updated the above instructions. Please try method 2 of step 1.

    Comment by Patrik — March 16, 2010 #

  515. How to secure computer against XP (….) 2010???
    I don’t want another infection… :(

    Comment by Krzysiek — March 16, 2010 #

  516. when i type command, or notepad in run nothing opens..anyone know why?

    Comment by Ross — March 17, 2010 #

  517. Thanks…. your are great.

    Comment by Fernando — March 17, 2010 #

  518. Krzysiek, read and follow the good suggestions.

    Comment by Patrik — March 17, 2010 #

  519. Ross, use another computer to create fix.inf or fix.reg. Then move it to infected PC and run.

    Comment by Patrik — March 17, 2010 #

  520. Thank you soooooooo much. This was really easy and it made me happy.I can’t find the words to thank you enough

    Comment by Sabine — March 17, 2010 #

  521. I dont know why this wont work for me. I have somehow got infected with XP Smart Security 2010. I followed your instructions and ran the Malware, which found lots of trojans etc, but every time I reboot the pop-ups come back. I have also tried using Spybot Search & Destroy and nothing seems to be able to get rid of this. Do you have any other suggestions please before I throw this out of the window! Or get fired…

    Comment by Sacha — March 17, 2010 #

  522. Sacha, you have done first step ? If yes, please open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — March 17, 2010 #

  523. Hey, Good job, the receptionist at my work DL XP defender…It’s gone now thanks to you!

    Thanks,

    Comment by SoCore — March 17, 2010 #

  524. Thanks you very much. Your instruction was very clear and the solution worked very well in stopping this annoying program.

    Comment by Randy — March 17, 2010 #

  525. my computer got a virus called xp guardian and all the programs were blocked..I shut down my computer and then i restarted it but now it doesn’t open at all!!!! it shows me a page where i can choose safe mode, safe mode with networking etc.. and i chose normal start up but nothing happens.. it goes to a black page for a few seconds and then back to the page where i have to choose safe mode etc..this happens all the time and i have chosen all the options(safe mode, safe mode with networking….) what to do?? i can’t go to the point where i must enter my password..what can i do??

    Comment by maria — March 18, 2010 #

  526. Maria, you have tried Last good configuration ?

    Comment by Patrik — March 18, 2010 #

  527. Thank you! Thank you!

    I spent hours trying to get this fixed and you helped me do it in 20 mins.

    Comment by Perry — March 18, 2010 #

  528. U r awesome, I got infected with XP Internet security 2010 and method 2 worked like a charm. I cannot thank you enough!!! keep up the good work.

    Comment by Rav — March 18, 2010 #

  529. Thanks for this!

    Comment by Tim — March 18, 2010 #

  530. Big hugs to you.
    Thank you, I followed “how to remove xp antivirus” and its other names. I know have my computer back. Thank you

    Comment by A. Dunlop — March 18, 2010 #

  531. Thank You so much the first method worked for me. And the Malwarebytes is a great remove tool.

    Comment by Edith — March 18, 2010 #

  532. Guys, I just had this ave.exe “XP Internet Security 2010″ virus/malware thing happen to me. The easiest fix is just do a system restore to the last restore point before the problem showed up. Start > Accessories > System Tools > System Restore.

    If you are having trouble getting programs to open, ctrl+alt+delte, go to processes, and keep “Ending Process” for ave.exe or av.exe that shows up. This will help slow it down while you spam the command for whatever program you’re trying to run.

    Comment by Mike — March 18, 2010 #

  533. I’m at work and my computer was infected with the virus, I can’t get to any internet pages on that computer to fix it. I am on a different computer right now to try and figure out how to get rid of it, if anyone can help me… PLEASE!!!!!!!

    Comment by Melissa — March 19, 2010 #

  534. WOW, you saved me from having to TRASH EVERYTHING, you surely did. I followed this step by step and IT WORKED!!!! SO VERY AWESOME FOR YOU TO POST THIS, A TRUE BLESSING!!!!

    Comment by Skee — March 19, 2010 #

  535. nevermind!! i got it!!!!! Thank you so much for this website! my coworkers would have killed me if there was no internet!

    Comment by Melissa — March 19, 2010 #

  536. Melissa, print then follow the above instructions.

    Comment by Patrik — March 19, 2010 #

  537. Will these instructions work for XP AntiMalware 2010 as well?

    Comment by Anita — March 19, 2010 #

  538. Thanks! 1st method worked like a charm on “XP Defender Pro”.

    Comment by Rich — March 19, 2010 #

  539. Anita, yes.

    Comment by Patrik — March 19, 2010 #

  540. Thanks has been said enough but for a computer illiterate like me you just don’t know how much this means to me. easy instructions worked like a charm:)

    Comment by Jay — March 19, 2010 #

  541. Thank you soooo….. much, thought the world was shifting right under my feet the *.reg had some problems once the trojan was fully operational but the *.inf worked perfectly.

    thaks to myantispyware.com, the day was saved…

    Comment by Hojinx-3 — March 20, 2010 #

  542. thanks

    Comment by waheed — March 20, 2010 #

  543. Just to let you know our computer was hijacked by this nuicence of a thing. I managed to get the method one on to the computer ran it and now all is ok. Thank you so much for all our help.

    Kind wishes to all.

    Comment by Jenny Pless — March 21, 2010 #

  544. thank very much, after hours of searching a way to get off from defender i found your page! It’s work with the first way!

    Sorry for the mistake, i speak french!!
    Phil

    Comment by philippe — March 21, 2010 #

  545. xp guardian 2010 tries to force us to spend money that we dont need to spend or want to spend…

    this “fix” you are offering still costs $40 since you FORGOT to mention that it is not a free version on your website. furthermore, damn near every post on this site is the same horrible english as if it came from the same person.

    i’m under the suspicious that this site is affiliated with the virus it claims to want to rid the world of. IF not, then you really should specify that we have the option of paying the virus or we can pay you, either way the options are rediculous.

    thank you very much for wasting my time installing a product that will not work unless i spend money. i will be removing the virus my way, free and simple.

    Comment by Tyler — March 21, 2010 #

  546. I went through with the procedure, step one, went fine, downloaded malware bites, went fine, scanned the computer, went fine, got rid of the viruses exept from 3 wich i was told i would need to restart my computer to get rid of.

    I restarted my computer and now i get as far as the logon page before i am asked to regiister my copy of microsoft, ive tryed my product key plus a key i got straight from microsoft and im now unable to register my microsoft account and as such cannot log on.

    I need this fixed asap as the computer infected has all the coursework that is due in on wednesday, i was just finishing things up when i recieved this virus and i cuurrenty have zero access to my files.

    What should i do?

    p.s. ignore the spelling mistakes, im not used to my sisters laptop.

    Thanks

    Comment by Andrew — March 22, 2010 #

  547. To whoever post this feed:
    You are on point; my 13 year old daughter ended up with this BS virus on her mini PC; after reading and following the instructions over the phone to her, she was actually able to rid of the virus as you said it would have. Thanks for being there for us.

    Comment by Alex — March 22, 2010 #

  548. you guys rock. XP defender got in my laptop and made my life miserable but your procedure worked like a charm and removed it altogether. Thanks

    Comment by ajay — March 23, 2010 #

  549. Great fix.
    Thanks so very much.

    and… Tyler, settle down, in fact, I DID NOT SPEND A CENT, so I am not sure what you are talking about. I got the free version of the Malaware.
    Method 1 worked so I could get into my computer again.
    Step 2 removed the nasty thing with Malware .

    Comment by Claudia — March 23, 2010 #

  550. This is a great fix, but I am having to run it again for a second time. I did it about a month ago and it cured the problem. I am just wondering why I keep getting this thing on my computer? Thanks for any info!

    Comment by Christi — March 24, 2010 #

  551. I just tried using the first method which didn’t seem to do anything because Malware bytes would not run afterward. Then I used the second method. Now, all I get is a black screen where the the profile pictures are supposed to come up. Any help would be appreciated. I am computer literate so I know I followed your simple instructions correctly. Please help! Thanks!

    Comment by tim — March 26, 2010 #

  552. One other thing maybe I should add…my computer froze about a minute after running the .inf file and I had to manually reboot by holding down the button to turn it off. Ever since then all I get is a blank screen when I turn on again…

    Comment by tim — March 26, 2010 #

  553. Tim, try run you computer in Safe mode and perform a scan with Malwarebytes Anti-malware.

    Comment by Patrik — March 26, 2010 #

  554. Worked for me!!!! Thanks very much!!!!

    Comment by Bex Marsh — March 27, 2010 #

  555. hey I need something to remove this xp Internet Security

    Comment by markisohn brown — March 27, 2010 #

  556. I got this on my computer + before reading this I performed sytstem restore to an earlier date + it seems to have removed it? no pop up’s + can use internet explorer fine. didnt think it would work but it has

    Comment by behn — March 27, 2010 #

  557. The main computer has been infected with this virus for allmost a year now. Tried doing the instructions but to no avail. Can’t run anything at all. Tried running stuff of a USB stick but that didn’t work either. Try to go into safe mode and get BSOD’d. Please help.

    Comment by Trey — March 27, 2010 #

  558. markisohn brown, if the instructions above does not help you, then ask for help in our Spyware removal forum.

    Comment by Patrik — March 27, 2010 #

  559. Thank you! Instructions were very easy to follow and my applications open now!

    Comment by Michelle — March 27, 2010 #

  560. Trey, you can boot your PC in Normal mode ? can download anything from the internet ?

    Comment by Patrik — March 27, 2010 #

  561. Hi Patrick – I fell for this and paid, although my credit card company are helping me get the money back. Do I still need to remove XP Internet Security or do you think it will have gone now?

    Thanks for all the help you are giving people here.

    Comment by Crispin — March 28, 2010 #

  562. Thank you very much. I followed your guides and got rid of XP Smart Security rouge on my netbook. You rock!!! God bless.

    Comment by Amie — March 29, 2010 #

  563. Crispin, anyway you need download Malwarebytes Anti-malware and perform a scan.

    Comment by Patrik — March 29, 2010 #

  564. IT WORKS! Muchas gracias.

    Comment by Andrew — March 29, 2010 #

  565. I tried this the first time I got teh virus and it worked wonders! It was fine for a month or so but now I keep getting the virus under different names, and it just randomly leaves by itself, and then comes back a few hours later under a different name. However, when I try to run the “fix.reg” I get the same prompt that Ambia did “Not all data was successfully written to the registry. Some keys are open by the system or other processes”. And when I run Malwarebytes, it doesn’t detect anything at all. I tried the OTM thing you posted, but when I go to download it, there’s no way for me to change it to “otm.com”

    Comment by Carmen — March 30, 2010 #

  566. Carmen, try method 2 of step 1, then update Malwarebytes and perform a scan.

    Comment by Patrik — March 30, 2010 #

  567. I tried to save Method 1 as fix.reg, All types, Unicode, but nothing happened. It is always giving the message: cannot import the file is not a registry script. You can only import binary files from within registry editor..

    PLEASE HELP ME!!! Thanks

    Comment by nali — March 31, 2010 #

  568. Method 1 worked great…. thank you so much… for all your help

    Comment by Niall — March 31, 2010 #

  569. followed your instructions to the letter to remove xp security tool virus. It worked a treat. Thanks for the help

    Comment by Mike — March 31, 2010 #

  570. You are a goddam star ! 3 hours messing around and then found your information and sorted it in 20 minutes. Many thanks

    Comment by Rob — March 31, 2010 #

  571. Thanks, this worked great. I tried step one and it worked great no virus. However I tried to play a game on my computer later and nothing worked. It said something about my .exe files not working. I tried to go to control panels to reinstall but it said the same thing. Any ideas? I tried step one again and rebooted but nothing changed.

    Comment by Niall — March 31, 2010 #

  572. Sorry to bother you again the warning that came up said the file does not have a program associated with it

    Comment by Niall — March 31, 2010 #

  573. I followed your instructions, after i ran Malwarebytes Anti-malware i rebooted now i get error on startup “error loading lgu.rlo” Can someone please help me ?????????

    Comment by Anna — April 1, 2010 #

  574. nali, try method 2.

    Comment by Patrik — April 1, 2010 #

  575. Niall, repeat first step, then update Malwarebytes and perform a fresh scan. If it does not help, then ask for help in our Spyware removal forum.

    Comment by Patrik — April 1, 2010 #

  576. Anna, your computer is infected with a trojan. Please open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — April 1, 2010 #

  577. hi

    tried method 1 rebooted and worked perfectly. thanks for a great easy fix; the internet IS useful sometimes :) woohoo

    Comment by nik — April 1, 2010 #

  578. @anna

    hi

    even though you get the error do you still manage to access your computer after clicking ok to the error message? if so, this is most likely down to a remnant of the trojan still lurking on your machine. the good thing is the fact that it cant be found! try running msconfig from start->run going to startup tab and looking for anything relating to the name of the file. if you find anything just untick the box to disable it and then restart your computer. once it restarts just ignore the ms config utility message and tick the box to turn it off permanently.

    hope this helps but im sure you will appreciate its hard to know when i have no idea about your computer :)

    there…paid it forward (hopefully) lol

    Comment by nik — April 1, 2010 #

  579. it is getting more sophisticated. your *.reg file is blocked. no *.exe files can be run. regedit cannot be run, even from a command prompt. no task manager. any executable file leads to a prompt, “what do you want to use to open this file?”

    thoughts?

    Comment by Doug — April 1, 2010 #

  580. Thanks so much guys! Used option #1 and then ran MWB. Had to save both Notepad txt and MWB on a flash drive in order to run it! Tokk about 20 min.
    “Caught” the malware through a fake Flash update on Firefox. Avira Antivir did not catch it.
    Again, thanks for the help!

    Comment by DCinDC — April 1, 2010 #

  581. Doug, try method 2.

    Comment by Patrik — April 2, 2010 #

  582. thnx workes brill
    saved my computer
    advised to use this

    Comment by amanuel — April 2, 2010 #

  583. Great stuff. Thanks for being one of the good guys, Patrik. Nice to have you on our side! Of note for those who have disable .exe files after running the reg file, I had re-typed Notepad registry program and it disabled my .exe files. Not sure where my typing error was. I ended up copying and pasting and creating the reg file on a separate computer and using a swap drive to move it to my infected laptop. It worked after doing that. Currently running Malwarebytes and it has sensed 6 infected objects. If Malwarebytes fixes the problem, I may purchase it out of gratitude. Is it one of the better programs out there?

    Comment by Bob — April 2, 2010 #

  584. Bob, Malwarebytes is really good malware remover. Read comments in the Internet. But anyway, you should also have an antivirus.

    Comment by Patrik — April 2, 2010 #

  585. I currently have officescan and ad-aware, both of which missed the XP Internet Security bug. I was thinking of removing ad-aware (currently free version with limited capabilities) and adding the Malwarebytes. Do you have a recommended antivirus program?

    Comment by Bob — April 2, 2010 #

  586. FANTASTIC. MANY THANKS.it took about five minutes to fix bit i had to use a second pc and download the fix then transfer to infected pc as xp defender pro blocked access to the net.a note of caution. i was running avg internet security version 9.008 and it got through.

    Comment by TIM — April 2, 2010 #

  587. Kudos! Thank you – it seems to have worked!

    Comment by Colin — April 2, 2010 #

  588. How on earth did I get this awful virus?

    Comment by Emily — April 2, 2010 #

  589. Do you have a recommended antivirus program?

    At your choice :) If you want free AV, then try AVG, Avira, Avast. If want purchase, then try Kaspersky, Symantec…

    Comment by Patrik — April 3, 2010 #

  590. I had a run-in with this malware earlier today, I got rid of it by using Spyware Doctor (I didn’t pay anything, it apparently just deleted it after I rebooted), and now that threat is gone. Unfortunately, now as I try to open processes such as Internet Explorer and Microsoft word, it says that the application can not be found. Is this what it means by using step one: \Repair ‘running of .exe files’\?

    Comment by Chris — April 3, 2010 #

  591. Emily, probably through an exploit in Internet Explorer or Adobe Flash Player or Adobe Acrobat reader. Update all of them now.

    Comment by Patrik — April 3, 2010 #

  592. Chris, try repeat step 1.

    Comment by Patrik — April 3, 2010 #

  593. Thankyou for your easy to follow instructions.

    Comment by Kirsty — April 4, 2010 #

  594. Wow! This worked really well! Thanks! :)

    Comment by Maia — April 4, 2010 #

  595. you guys are rock!!!
    thank you so much!!!

    Comment by julia — April 4, 2010 #

  596. This has been the second time that your website has saved my butt. You are a godsend. The internet can feel like a giant deathtrap sometimes; it’s comforting to know that someone is on our side. :)

    Comment by Serena — April 4, 2010 #

  597. I did everything this guide says to the very end But for some reason, whenever I search something in and click on it in Google or Yahoo, I get redirected to an ad website. Why didn’t Malware bytes get rid of ALL the viruses? And also, many of my programs cannot be found and/or need a program to run. Any suggestions? Help me please!

    Comment by chris — April 5, 2010 #

  598. Chris, probably your PC also infected with TDSS trojan. Follow the instructions.

    Comment by Patrik — April 5, 2010 #

  599. At first, I wasn’t able to open Firefox to reach your instructions – but by clicking on one of the no longer functioning programs, and accepting the instruction to look for the appropriate program on the web, I tricked the terrible XP Antivirus into letting me open the internet.

    Apparently McAfee won’t fix this virus if you bought the individual version or the small corporate version of their software. You seem to need the big corporate version (mega-sized corporation) version! Since my 12-year-old son isn’t the size of a mega-corporation, your solution involving “fix.inf” was a very welcome rescue! However, the following day a routine Google search led to Colgate Ads, ads for antivirus software, and an apparent new download of the XP Antivirus monster! This second time I used the MalwareBytes program followed by going to Firefox’s Tools, then Options section, to tighten up popups, security, etc.

    Thanks and XOXOXO to you!!!

    Comment by GaileIrene — April 5, 2010 #

  600. Okay, I followed the instructions you gave me Patrik (thank you). And I have two more questions:
    Do I try to delete the registry keys and values that the spyware creates, or does the Malware bytes get rid of it? And also, why are some of my icons on my screen not available when I click them and some require a program to open them (as if the programs were unknown to my computer). Did the spyware screw up my programs or what? Please answer both questions, thank you!

    Comment by chris — April 5, 2010 #

  601. Okay, I followed the instructions you gave me Patrik (thank you). And I have two more questions:
    Do I try to delete the registry keys and values that the spyware creates, or does the Malware bytes get rid of it? And also, why are some of my icons on my screen not available when I click them and some require a program to open them (as if the programs were unknown to my computer), and when I try to use “Set Program Access and Default” my computer says “application not found”. Did the spyware screw up my programs or what? Please answer both questions, thank you!

    Comment by chris — April 5, 2010 #

  602. Chris,

    I click them and some require a program to open them (as if the programs were unknown to my computer).

    First step above should fix the trouble.

    Anyway you need scan your PC with Malwarebytes to remove any associated malware.

    Comment by Patrik — April 5, 2010 #

  603. Thank you for helping me get rid of pesky virus. I was a little confused by typing “command” in the Run box, but figured it out to be “notepad”. After that, it was all uphill.

    Comment by TJ — April 6, 2010 #

  604. I have tried all the recommended steps but when I reboot my pc I still have the XP program blocking my every move. Now when I go to my control panle it also blocks everything with the following prompt: C:\WINDOWS\system32\rundll32.exe Application not found. I need help PLEASE am so frustrated

    Comment by Kofi — April 6, 2010 #

  605. Hi,

    I’m still on step one. Notepad will not even let me save as for either option one or two. I just got the virus yesterday. Is it possible there’s something else is wrong?

    Comment by Brian — April 6, 2010 #

  606. Thank you so much! The second method worked. The thing is there were two rouge multipliers also installed, but Malwarebytes got rid of it(:

    Comment by Carmen — April 6, 2010 #

  607. Hey, but I did what you told me to do with the first step above, but my files still need a program to open them, and when I try to open my “Set Program Access and Default”, I get a message saying “application not found”. Can you help me? (I’ve already run a lot of scans so don’t tell me to keep scanning.)

    Comment by chris — April 7, 2010 #

  608. Kofi, open a new topic in our Spyware removal forum. I will help you.

    Comment by Patrik — April 7, 2010 #

  609. Brian, you need use another computer to make fix.reg or fix.inf, then move it to your infected PC using a flash or cd disk.

    Comment by Patrik — April 7, 2010 #

  610. but my files still need a program to open them

    Chris, the first step above should fix the troblem, it it does not help, then ask for help in our Spyware removal forum.

    Comment by Patrik — April 7, 2010 #

  611. HELP, Been fighting this thing for a while now. Was XPSmart Security2010 then it was Antivirus XP I followed dir above MBAM and Spysweeper gave clean bill but the Phishing on off box keeps popping up and going away, can’t open any apps, webpages are still being hijacked,can not run command to open notepad now.

    Comment by Jenny — April 7, 2010 #

  612. forgot to tell you that when I try to open Notepad now it comes up full of stuff I can’t read

    Comment by Jenny — April 7, 2010 #

  613. I ran method 1 and it appears to have worked, however it somehow disabled my wifi on my HP laptop. Any suggestions?

    Comment by Felicia — April 7, 2010 #

  614. Patrik, I will show you a video of my problems. Watch it please and tell me what I can do.

    youtube.com/watch?v=B3rnnZp8LOM

    Comment by chris — April 7, 2010 #

  615. Jenny, what shows your computer when you trying run “command” or another program ?

    Comment by Patrik — April 8, 2010 #

  616. Chris, you can run command prompt by doing: Click Start, Run, type command and press Enter ?

    Comment by Patrik — April 8, 2010 #

  617. I can do command prompt, but my “Install or Remove Programs” is gone. And entering the name of a program isn’t very helpful because most of the time my computer tells me that the name of a program isn’t a recognizable command.

    Comment by chris — April 8, 2010 #

  618. Thanks a lot for your help! It was easy to use and removed the malware!

    Comment by Nico — April 8, 2010 #

  619. Folks, I am sure this worked well for some and not for others.

    I am running Windows XP Professional and I’ve always manually been able to beat this virus… but not this time.

    These instructions are very helpful, but it has taken me hours to complete.

    I took the liberty to take a USB drive and downloaded MBAM, Avast (for a sanity check), and the REG fix to a USB drive.

    Before my safe-mode methods were tried as per this site’s instructions; I installed Avast and it looked like it got rid of the virus, but that did not happen.

    As I started with this site’s instructions, my system did go into safe mode, but then after the reboot… the infection got worse. I did it again and it happened again.

    On my third attempt, I went a bit radical with the instructions. Here is the play-by-play…

    1. Booted the machine in safe-mode and logged in as Administrator (not the auto-loaded admin-like ID I use all the time).

    2. Ran the REG file and rebooted.

    3. Booted back to Safe Mode with Networking as Administrator (not the auto-loaded admin-like ID I use all the time).

    3B… Installed MBAM from the USB Drive; it updated automatically.

    4. Ran the Quick Scan, cleaned the files (it indicated that not all files COULD be cleaned) and rebooted.

    5. Same as step 3.

    6. Same as step 4 – but now all files were cleaned.

    7. Same as step 3.

    8. Ran a Full scan; more viruses found, So I cleaned them and rebooted. (At this step, most of the infections were in the System Restore folder).

    9. Same as step 3.

    10. Same as step 6… everything was clean.

    11. Rebooted normally; but somehow there was a “Open With” dialog box on the screen and some apps didn’t open in the Taskbar (a problem found with this virus).

    12. Open Explorer (which was currently not harmed by this virus) and ran the REG fix again.

    13. Rebooted and started Windows normally.

    14. Ran MBAM in Quick Scan mode… more viruses found, all were removed and rebooted again.

    15. Same as step 13.

    16. Ran MBAM in Full scan mode… one final virus found (again, in the system recovery data).

    17. Rebooted normally, ran an AVAST Quick Scan… no viruses found.

    18. Turned on Windows Firewall (some reason, it was off).

    Now all is well… and I’ve ages 9 hours in this process… but it was a good 9 hours.

    Cheers… MikeA

    Comment by MikeA — April 8, 2010 #

  620. Thank-you so much for the advice Patrick. I just wanted to share what worked for me with the other people who are experiencing problems even accessing the internet let alone this website on their infected pc.
    I was actually looking at this website from my itouch while trying to deal with a computer that would not let me open any page whatsoever. After reading through the comments I noticed a user had mentioned that they actually tricked their comp onto going onto a website.
    So first I did the run-command and opened up Notepad. Then what weorked for me to actually access the internet was going into my computer and accessing a web page from the address bar at the top of the page. This would let me access one website before going into crazy XP not let me open anything mode. So I had to close everything down, reopen “my computer” and type the address of this page exactly in the address bar.
    From there I was able to copy and paste the code for fix.reg and continue on with the steps recommended.
    I hope this helps all you non tech savy people out there like me. This website and detailed instrucions were very much appreciated. Thank-you Patrik!

    Comment by Rachel — April 9, 2010 #

  621. chris, then you need follow the first step above, After that run Malwarebytes.

    Comment by Patrik — April 9, 2010 #

  622. Cheers guys,

    Lot’s of poking around and I had a wonky version of this virus that I didn’t see screen shots of anywhere… close though and I imagine there’s tons of different skins/versions.

    WHAT WORKED FOR ME:
    http://www.myantispyware.com/2010/01/28/how-to-remove-xp-internet-security-2010-xp-guardian-antivirus-xp-2010/

    Comment by Rob — April 9, 2010 #

  623. This file was download onto my HP desktop, and I am unable to do anything because whenever I try to log on, it immediately logs me off. I can’t do anything even in safe mode. What should I do?

    Comment by sarah — April 9, 2010 #

  624. Sarah, you have tried boot your PC in:
    1. Safe mode with command prompt ?
    2. Last good configuration ?

    Comment by Patrik — April 10, 2010 #

  625. Method 1 worked right away (and it was easy). Thanks very much!

    Comment by Betsy — April 10, 2010 #

  626. Hi! I was so happy to try this out, but I tried running method 2 and had no problems running MWB but when I run a quick scan it says nothing was found.

    Furthermore, my McAfee says Real Time scanning is off and when I try to turn it on it shuts back off after a few seconds. I am afraid to do anything else, please help me! (I will try method one in the meantimetime)

    Comment by Jai — April 12, 2010 #

  627. I downloaded TDSSKiller and it messed with my .exe file extension. It won’t run my wireless internet anymore! It seems to have some problems with my .exe files.

    Restore doesn’t do anything help! TDSSKiller was a bad move!

    Comment by Tom — April 12, 2010 #

  628. TDSS is bad bad news. Stay away from!

    Comment by Tom — April 12, 2010 #

  629. It is probably worth the $75 to let the guys at Geek Squad take care of it, other than wasting 2-3 days on something

    Comment by Tom — April 12, 2010 #

  630. Jai, update Malwarebytes and scan once again.

    Comment by Patrik — April 12, 2010 #

  631. Youse guys are de bestest ever. McAfee let this crap right on thru and locked me out totally. Fortunately, I had anutter puter n could git-er-done by cut-n-pasten the instructions to my broke puter. So THANKS … good job. rj

    Comment by Rinaldo Jonass — April 13, 2010 #

  632. This worked for me, but I had to do one more thing. The Start Menu icon for IE had been changed by the virus as well. The setting for that resides at: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command. I just changed the default value back to C:\Program Files\Internet Explorer\iexplore.exe and all was good.

    Comment by Keith — April 13, 2010 #

  633. Hey guys! I did system restore as soon as it all started and seemed to have worked flawlessly. DLing this program to protect in the future. Haven’t used it yet, so can’t say if it’s helpful or not, so wish me luck.

    Comment by salieve — April 14, 2010 #

  634. So I did step one, everything seems to have worked except that my computer no longer regonizes ANY .exe file. Even when opening explorer or add/remove programs WinXP has me choose from a list of programs. This happened after the registry change, and I am 100% lost.

    Comment by Chris — April 14, 2010 #

  635. Chris, you need repeat first step.

    Comment by Patrik — April 14, 2010 #

  636. Thank you so much! Your instructions were very easy to follow and the computer is back to normal.

    Comment by Andrea — April 14, 2010 #

  637. Worked great thank you

    Comment by Erik — April 14, 2010 #

  638. I should also say that I’ve used Malwarebytes in the bast and it’s always been a lifesaver

    Comment by Erik — April 14, 2010 #

  639. Very2 useful. Thanks

    Comment by Vrida — April 15, 2010 #

  640. thanks for the guide sorted this problem out straight away all is well for the time being i’ve gotten rid of every file that it made. hopefully this won’t happen gain bookmarked this page incase and sent the fix.reg file and mala to my usb just incase, thank you very much for this guide everyone :)

    -Metal

    Comment by Metal — April 15, 2010 #

  641. I’ve done all this – but now every time i click onto any .exe file apart from installers and the internet, the whole pc crashes and then restarts!!!

    HELP!

    Comment by gallefray — April 16, 2010 #

  642. Hi thanks Patrick I keep getting it and I know how to remove it but I keep getting it can you help me to prevent it

    Comment by Luke — April 16, 2010 #

  643. You guys are worth your weight in gold. I spent almost 8 hours trying everything I could think of to fix the problem. I come across your website… done in minutes. A huge thank you.

    Comment by Clyde — April 16, 2010 #

  644. You are the man…
    I think I did it. The icons are gone. Pop ups seem to have stopped. I’m going to try the malwarebytes to be sure.
    I sure would like to catch up with the guy that created the total xp security!
    Thanks man!

    Comment by BMan — April 16, 2010 #

  645. Thanks. It worked for me. I installed the fix.reg program and it did not come up after I rebooted. Thanks again.

    Comment by Joseph — April 17, 2010 #

  646. Worked brilliantly, what a great site, thanks! It’s good to know there’s someone I can trust

    Comment by Laura — April 17, 2010 #

  647. gallefray, start a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — April 17, 2010 #

  648. Luke, if the above instructions does not help you, then ask for help in our Spyware removal forum.

    Comment by Patrik — April 17, 2010 #

  649. I used the first one the fix.reg and it worked great! Ive been at this for 5 hours and i finally got on and looked at a few web pages and this by far was the best! Thank you so much for the advice and very very great details! The only thing i think someone should do is to be able to block that kinda stuff from happening! That is the dumbest thing ever invented lol, so if anyone ever does come up with a resolution for it plz post and i will follow them instructions to lol! Thanks again

    Comment by Kristin — April 17, 2010 #

  650. OMG!!
    I just wanna thank you for saving my laptop!!
    Seriously,Anti-Virus like McCafee and others are just some bull…the best savors are people like you who know what to do!!

    thank you again!!

    …used the 2 Method.

    Comment by simon — April 19, 2010 #

  651. Received the virus just a few days ago, though my internet knowledge-lacking mother decided to ‘buy’ it. Any tips of where to go from here? I Haven’t found any solution on the internet as of yet, any help would be greatly appreciated =]

    Comment by Matt — April 20, 2010 #

  652. I followed the first two portions of the step and worked great. Once I run malware it did run for 3 hours, froze the computer and now it is frozen. I unpluged and pluged the computer back up a couple of times and it is still frozen. I can’t do anything. What should I do?

    Comment by George — April 20, 2010 #

  653. George, you can`t boot your PC in all modes, including Safe mode and Last good configuration ?

    Comment by Patrik — April 21, 2010 #

  654. i have clicked on run, typed command and enter, and thats as far as i have got. waited 10 mins but nothing else has happened. dont know how u are supposed to type nopepad when you have already typed command??
    help please anyone

    Comment by Natalie — April 21, 2010 #

  655. It worked. Thanks!

    Comment by Paul — April 21, 2010 #

  656. Natalie, once you have typed “command” w/o quotes and pressed Enter, your computer should run command console (black window). You need type “notepad” w/o quotes into it.

    Comment by Patrik — April 22, 2010 #

  657. Wow this thing was nasty, your fix worked though. I had the .exe problem too but when I shut down and rebooted it went away. I had 4 different versions of this little basterd running at once. Bad. Some things I learned from this:

    1) You can shut off the popups by terminating the processes AV.exe and AVE.exe and similar from the CTRL+ALT+DEL Task Manager. It doesn’t reapir your system but at least you can work without popups driving you crazy.

    2) I was able to start Firefox and connect to the net by clicking program tab off the Start –> All Programs menu. It never worked from the desktop shortcut. It worked intermittently from the Start menu, usualy after several tries. Give it a try.

    3) This things loads through JAVA probably as an applet. About 5 minutes before it struck a little JAVA box opened on me and flashed a couple times. I suspected I was in trouble when that happened and sure enough I was. Maybe that will mean something to somebody who knows this stuff. If you see that maybe try to disconnect from the net before it fully loads. Might work but I don’t know.

    4) The thing gets worse if you shut down after you get it. Most everything still worked on my system until I shut down and rebooted. Then it was gridlock after that.

    DO NOT SHUT DOWN

    If you get this virus. Stay running and kill the thing while you still have some function. Do not try System Restore, it doesn’t work for this one.

    Thanks for the help Patrik and good luck everybody.

    Comment by Scotto — April 22, 2010 #

  658. Natalie-

    I had a problem with that too. The virus locked that window up and wouldn’t let me enter any text there. Down in the bottom left of the screen click the green button Start –> All Programs –> Accessories –> Command Prompt.

    You’ll get the same little black window except you’ll be able to use it to do the job. Follow the instructions from there. No guarantees but It worked for me. Give it a try.

    Comment by Scotto — April 22, 2010 #

  659. I got infected with this some time ago, but I removed it the following day. What I want to know now is: How & CAN I get my money back? Sorry if this was mentioned before, I just do not have the time to read everything.

    Anyway, anybody that has the answer is welcome to e-mail me. Help me, please~!

    Comment by Danii — April 22, 2010 #

  660. I sent my computer in ot be repaired, but if I found this, it would of helped Thanks!

    Comment by saintdane — April 23, 2010 #

  661. Danii, you need contact your credit card company and tell them what has happened.

    Comment by Patrik — April 23, 2010 #

  662. this was awesome!!! my laptop was infected for a couple of weeks and it was driving me crazy!!! now its fixed and i am soooo happy.
    good job!

    Comment by Louise — April 24, 2010 #

  663. Thanks,
    it worked.

    Comment by anna v — April 25, 2010 #

  664. I used Malwarebytes’ Anti-Malware it found multipul virus and I did the “Remove Selected”. Now this is where I may of messed things up. I went into the “Quarantine” Tab and deleted everything in there. Also I did the Step 1 method 1 after everything I did written above. Now I am unable to access the internet. Can you please help me!

    Comment by Tom — April 26, 2010 #

  665. after i run the malaware program, it tells me it found 54 infections, when i click ok to go to show results so i can delete it, it jus turns off the program. what do i do in this case? seems like no one had that problem

    Comment by usman — April 27, 2010 #

  666. Tom, try the following steps:
    Click Start, Run, type regedit and press Enter.
    Registry editor opens.
    Navigate in the left panel to HKEY_LOCAL_MACHINE \ SOFTWARE \ Clients \ StartMenuInternet \ IEXPLORE.EXE \ shell \ open \ command

    I the right part of window click twice to “@”. You will see a screen with the contents like below: “C:\Documents and Settings\user\Local Settings\Application Data\ave.exe” /START “C:\Program Files\Internet Explorer\iexplore.exe”
    Remove left part, leave only “C:\Program Files\Internet Explorer\iexplore.exe”.
    Reboot your computer and try run Internet Explorer once again.

    Comment by Patrik — April 28, 2010 #

  667. usman, reboot your computer in Safe mode and try scan once again.

    Comment by Patrik — April 28, 2010 #

  668. Brilliant!!!! This worked like a dream. I had the “XP Security Center” virus which is another variant of this and I am now able to download Malwarebytes and get rid of it. Thank you soooo much.

    Comment by Chris L — April 30, 2010 #

  669. Like Tom above I was able to get rid of the issue with malwarebtes but now I can only connect to the internet with firefox. IE , Yahoo msgr, and my antivirus software all say there is no internet connection but firefox connects fine. Please help.

    Comment by Rob — May 1, 2010 #

  670. Rob, check Internet Explorer proxy settings.

    Comment by Patrik — May 2, 2010 #

  671. Hi Patrik. Thanks, somebody walked me through IE and helped me get connected. Thanks for your help to me and so many others. My issue now is with this “company” which is guilty of fraud and internet terrorism. Are they not guilty of crimes and punishable under the law? I would say the mischief and trouble they cause would indicate they are.

    Comment by Rob — May 2, 2010 #

  672. Hi moderator,

    I ran the 2 methods in step 1 and did step 2 by installing a renamed version of Malwarebytes(name the mbam.exe file any name before running the installation) and i successfully installed malwarebytes. However there was no virus nor malware detected after 3 full scans. My pc is running great now but im thinking if there’s a possibility that a virus is still lurking in my computer? any suggestions?

    Comment by jonahs — May 3, 2010 #

  673. Thank You.

    Comment by yogesh Kumar — May 5, 2010 #

  674. jonahs, try update Malwarebytes and perform a fresh scan.

    Comment by Patrik — May 5, 2010 #

  675. Dear Sir/Madam
    I have install guardian antivirus in my laptop one week before. now virus protection guardian 11.00 reports that it is turned off. Please tell me how to turn on.

    Comment by vineet — May 5, 2010 #

  676. I used the method suggested thanks…but after ensuring antivirus 2010 gone…i still had doubts if there might be any trojans still there hacking on my personal data…so I used Reimage at reimagepcrepair.com to fix further issues…now i’m happy to say…my laptop is working pretty faster like the day i brought it!!!

    Comment by jessica — May 7, 2010 #

  677. thanks a lot….
    its really helped me a lot…

    Comment by Computer Security Software — May 17, 2010 #

  678. this is very bad antivirus

    Comment by shashank — May 19, 2010 #

  679. I had this virus on my computer and used this to get rid of it. Now it’s on my roommates but I can’t open command on his or anything. Any other ways to get this virus off?

    Comment by Benzie — May 20, 2010 #

  680. Benzie, create fix.reg and fix.inf using another PC, then move them to infected computer.

    Comment by Patrik — May 20, 2010 #

  681. Ok, please help. I’m rubbish with computers and not getting anywhere!
    This spyware thing is not on the other user’s login on the pc. It is on mine however and I need to get rid of it.
    On my login, I can’t get anywhere near online as it just jumps up with warnings, so can’t get on this page for instance.
    So I’m in the other user’s login right now, but does this mea if I follow the steps, i’ll get rid of the spyware from the whole PC?

    Comment by Tessa — May 25, 2010 #

  682. Tessa, if you computer is infected with the rogue or a clone of it, then YES, the instructions above will help you. If you unsure, then ask for help in our Spyware removal forum.

    Comment by Patrik — May 25, 2010 #

  683. Perhaps someday Malware will be a thing of the past. Until then it, and Ransomware – the next big thing – will continue to get worse and cause a lot of inconvenience.

    This blog was helpful for information. I am amazed at how many people have been affected by this Malware program. However, the suggestions did not work for me. Either I did something incorrectly with the fix.reg and fix.inf procedures, or the system was too infected.

    This was the third time I’ve had this Malware infect one of my systems in recent months. The first time, a professional tech introduced me to Malwarebytes, which worked well for removal of the second infection in about an hour. The third and most recent hit was different as the free version of Malwarebytes does not ‘auto update’ or protect in real time. As soon as the infection hit I pulled the LAN cable to protect the network. However, Malwarebytes definitions were a few weeks old and would not remove the Malware completely. I searched the internet with another computer and found your site and copied the files to a flash drive. After running the fix.reg and fix.inf programs I attempted to update Malwarebytes which required connecting to the internet. When I plugged in the LAN cable (with other network computers offline) the dreaded WIN32HEUR virus was downloaded and the computer was effectively crippled. As I had all my data backed up separately, it made more sense to simply wipe the computer with the factory restore discs – much less time than trying to remove the virus.

    In re-reviewing the instructions you provided, I realize my fault may have been with not properly rebooting the computer prior to trying to update Malwarebytes via the Internet. Hopefully my example will serve as a lesson to others: Keep Malwarebytes up to date regularly or buy the full version; Always follow directions thoroughly and; ALWAYS HAVE A BACKUP OF YOUR DATA in caser disaster strikes – which it inevitably will.

    Thanks!

    Comment by KJ — May 29, 2010 #

  684. Okay so this doesn’t really work in my cause because notepad doesn’t work either, how do i do this?

    Comment by Phillisha — June 8, 2010 #

  685. Download fix1.zip from here, unzip it. Double Click fix.reg and click YES for confirm.

    Comment by Patrik — June 9, 2010 #

  686. Thanks for the instructions. AVG didn’t stop the trojan from infecting my PC.

    I do not know how my computer was infected. It was not infected went I went out this morning and was when I came home, implying an automatic update (AVG was only thing that updated today) caused the infection.

    The trojan would not allow any programs to run. Thus it was very important to go in under another account.

    Thanks to ya’ll that work to provide us necessary tools to fix these issues.

    Comment by J — September 25, 2010 #

  687. Thank you sooooo much for this! This bug was very annoying and I followed your instructions and was able to get rid of it. Thanks!

    Comment by TOhio — October 2, 2010 #

  688. Thank you so very much! It works!!

    Comment by Tracey Daniels — October 9, 2010 #

  689. my anti wirus do not delete my pc and do not work

    Comment by nandgopal — October 19, 2010 #

  690. I did all the steps…above

    Step 1. Smile
    step 2. Do method 1 and 2 above
    step 3. visited this site: http://dougknox.com/xp/file_assoc.htm
    step 4. EXE File Association Fix (Restore default association for EXE files)
    step 5. install MalwareBytes on my USB then transfer to infected computer
    step 6. install in MalwareBytes
    step 7. Look for the path of where I installed MalwareBytes. C:\Program Files\Malwarebytes’ Anti-Malware
    step 8. Rename mbam.exe to mb.exe (just anything)
    step 9. click on mb.exe
    step 10. Ran Malwarebytes (scanning right now)

    Comment by hoang — October 22, 2010 #

  691. Go to start… then Run and type regedit Click ok. Locate HKEY_CURRENT_USER. Click plus(+)to expand. Click plus (+) beside Software to expand. Click plus (+) beside Classes to expand. If you see a .exe then right click on it and select delete. That’s where it is hiding and this will remove it from your computer. Guaranteed!

    Comment by Carla W — November 16, 2010 #

  692. Added to above – After deleting make sure you restart your computer for change to take affect.

    Comment by Carla W — November 16, 2010 #

  693. Patrik!!!! Wow, for a Blonde bunny in Canada with no computer skills this was a no brainer to follow. The first issue I had was I didnt copy the top line of the reg file. After that it all went fine. Just rescanning my pc in full. I need to ask my Husband (Who is off work and has too much idol time) to stop surfing and watching all that porn. Those sites are the cause I am thinking. BiG! Hugs!

    Comment by JennySkelton — November 23, 2010 #

  694. I got this virus on vista yesterday after looking through google images of saxophones… i kid you not, but what annoys me the most is that this virus seems to be at least a year old looking at the comments here, and it just walked through my mcafee without problem. I think its time to change, but I dont know what to change to. Did any anti virus program actually catch this one ???

    Comment by terry — December 18, 2010 #

  695. THANKS this was great. i spent hours trying to figure this out, but then i found your instruction worked a treat. BRILLIANT !!

    Comment by Sam — February 8, 2011 #

  696. i did the process you told me and the virus went away, but it keeps coming back. I checked my registry and i have a key named:

    [-HKEY_CURRENT_USER\Software\Classes\sezfile]

    The only difference to this file to the one you showed is that this one contains ‘sezfile’ instead of ‘secfile’. Is this also a virus registry value?

    Comment by lilly — March 6, 2011 #

  697. lilly, yes this entry was created by virus.

    but it keeps coming back.

    Probably your computer is infected with a trojan that reinstalls the rogue. Ask for help in our Spyware removal forum. I will help you to cure your PC.

    Comment by Patrik (Myantispyware admin) — March 8, 2011 #

  698. Wow! Had these kind of viruses several times before, always managed to get rid of them after some severe grief but this took ten minutes. Thanks very much!

    Comment by Tom — March 13, 2011 #

  699. how can u download MWAB with the virus stopping u from using the internet?

    Comment by Iain — May 2, 2011 #

  700. MERCI!!!!!!!!

    Comment by Provensa — May 16, 2011 #

  701. Thanks So Much!! Bless You!

    Comment by Provensa — May 16, 2011 #

  702. Iain, try use Safe mode with networking or try reset Internet Explorer proxy settings.

    Comment by Patrik (Myantispyware admin) — May 19, 2011 #

  703. Method 2 seems to have restored limited functionality on win7 home premium, enough to install and run malwarebytes (running now, different computer) is there another set of reg keys to fix on a win 7 install?
    Top thread by the way, really has helped.

    Comment by Adrian — June 11, 2011 #

  704. Adrian, try download and run Malwarebytes in safe mode with networking.

    Comment by Patrik (Myantispyware admin) — June 12, 2011 #

  705. It’s truly a great and useful piece of info. I am glad that you shared this useful information with us. Please stay us informed like this. Thank you for sharing.

    Comment by fat burning meals — August 11, 2011 #

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>


My Anti Spyware - Free antispyware programs and Spyware Removal Instructions.