Do you have pop-ups or your computer infected with trojan or spyware ? Learn how to ask us for help, click here!

How to remove XP AntiSpyware 2010, XP Antivirus Pro 2010

XP AntiSpyware 2010 also known as XP AntiSpyware, XP Antivirus Pro and XP Antivirus Pro 2010 are names of one program, which is a rogue antispyware application. It is promoted and installed with the help of trojans. When the trojan is started, it will download and install XP AntiSpyware 2010 (XP Antivirus Pro 2010) onto your computer.

During installation, XP AntiSpyware 2010 (XP Antivirus Pro 2010) will configure itself to run automatically every time when you run any program that have “exe” extension (99% of Windows applications). The rogue also uses this method of running to block the ability to run any programs, including antivirus and antispyware applications.

When XP AntiSpyware 2010 (XP Antivirus Pro 2010) is started, it will perform a system scan and detect a large amount of infections. All of these infections are fake, so you can safely ignore them. What is more, while the rogue is running, it will display various fake security warning and notifications from Windows task bar that have “Spyware infection has been found” or “Tracking software found” header. However, all of these alerts are fake and like false scan results should be ignored.

Last but not least, XP AntiSpyware 2010 (XP Antivirus Pro 2010) will hijack Internet Explorer and Firefox and display fake warnings when you opening a web site.

As you can see, XP AntiSpyware 2010 (XP Antivirus Pro 2010) is created with one purpose to scare you into thinking that your computer in danger as method to trick you into purchasing the full version of the program. If your computer is infected with this malware, then most importantly, do not purchase it! Remove the rogue from your computer as soon as possible. Use the removal guidelines below to remove XP AntiSpyware 2010 (XP Antivirus Pro 2010) from your PC for free.

Use the following instructions to remove XP AntiSpyware 2010 (XP Antivirus Pro 2010) (Uninstall instructions)

Step 1. Repair “running of .exe files”.

Click Start, Run. Type command and press Enter. Command console “black window” opens. Type notepad as shown below


Command console

Press Enter. Notepad opens. Copy all the text below into Notepad.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

You will see window similar to the one below.


Notepad

Save this as fix.reg to your Desktop (remember to select Save as file type: All files in Notepad.) Double Click fix.reg and click YES for confirm.
Reboot your computer.

Step 2. Remove XP AntiSpyware 2010, XP Antivirus Pro 2010 associated malware.

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

malwarebytes-antimalware1
Malwarebytes Anti-Malware Window

Select Perform Quick Scan, then click Scan, it will start scanning your computer for XP AntiSpyware 2010 (XP Antivirus Pro 2010) infection. This procedure can take some time, so please be patient.

When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.

mbam
Malwarebytes Anti-malware, list of infected items

Make sure that everything is checked, and click Remove Selected for start XP AntiSpyware 2010 (XP Antivirus Pro 2010) removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.

Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.

XP AntiSpyware 2010 (XP Antivirus Pro 2010) creates the following files and folders

%AppData%\av.exe
%AppData%\WRblt8464P

XP AntiSpyware 2010 (XP Antivirus Pro 2010) creates the following registry keys and values

HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\.exe\shell
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start\command
HKEY_CURRENT_USER\Software\Classes\secfile
HKEY_CURRENT_USER\Software\Classes\secfile\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\secfile\shell
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command
HKEY_CURRENT_USER\Software\Classes\secfile\shell\runas
HKEY_CURRENT_USER\Software\Classes\secfile\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\secfile\shell\start
HKEY_CURRENT_USER\Software\Classes\secfile\shell\start\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | @ = “”%AppData%\av.exe” /START “%1″ %*”
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | IsolatedCommand = “”%1″ %*”
HKEY_CURRENT_USER\Software\Classes\.exe | @ = “secfile”
HKEY_CURRENT_USER\Software\Classes\.exe | Content Type = “application/x-msdownload”
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command | @ = “”%AppData%\av.exe” /START “%1″ %*”
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command | IsolatedCommand = “”%1″ %*”

February 22, 2010 on 12:14 pm | In Malware removal, Rogue Anti Spyware | 122 Comments |


122 Comments »

RSS feed for comments on this post.

  1. It is possible that these pieces of malware may have done a stealthy Conficker installation. If any users out there even suspect that may be infectd with Conficker, I would head over to the sophos.com page and poke around for their free Conficker removal tool. It works a charm and it’s completely free.

    Comment by Nina — February 24, 2010 #

  2. WOW, I have been messing with this virus for 2 hole days, IT WORKS !!!! amazing, i was really starting to freak out. Great job.

    Comment by alaska — February 24, 2010 #

  3. wow you guys are amazing my wife just about killed me because she swore i was looking at xxx and got this malware virus on the computer lol thanks guys it worked perfect!!!

    Comment by Daniel — February 25, 2010 #

  4. Thank you! thank you! thank you! This worked. We have the best McAfee security. McAfee recognized the trojan had tried to get through, said it had gotten rid of it. It did not.

    What a nasty virus !! It wouldn’t let us access internet. Lucky for us, we had access to more than one computer system, so were able to get internet… and thusly your fix.

    THANKS!!

    Comment by Melanie — February 26, 2010 #

  5. I posted a comment to this thread yesterday but it’s (along with ~50 others) gone now… bummer!

    I have this virus and I tried creating and running the fix.reg file mentioned in step 1. Even after I ran the registry import, when I rebooted I still cannot get past the virus to download anything. I cannot access my start menu, no task manager, or anything. In safe mode, it tells me that system restore has been disabled by group policies, and I can’t access my c:\ or USB drives.

    I tried to find the entries listed in the registry, none are there as listed (possibly removed by the fix.reg. The only file I can find is av.exe in the c:\windows\system.

    Any thoughts? I also posted this question in the forums, but my post isn’t there today either… not sure what happened..

    Any help greatly appreciated!

    Comment by Phydous — February 26, 2010 #

  6. When I double click on fix.reg I get a error that ‘Registry editing has been disabled by your administrator’.

    Comment by Darla — February 27, 2010 #

  7. Darla, try the following:
    Please download OTM by OldTimer from here.
    Run OTM, copy,then paste the following text in “Paste Instructions for Items to be Moved” window (under the yellow bar):
    :reg
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "DisableRegistryTools"=-

    Click the red Moveit! button. When the tool is finished, try run fix.reg once again.

    Comment by Patrik — February 28, 2010 #

  8. Worked like a charm. Now I can apologize to my teenager! Thank you!!!!!

    Comment by Linda — February 28, 2010 #

  9. You are my hero!! I have been trying to figure out what to do…great comments about using google chrome to break through the internet lockout from this virus! i think my netbook is fixed! Thank you thank you thankyou!!! Che’

    Comment by Che' Gilliland — March 2, 2010 #

  10. Great advice thanks. Problem is the spyware somehow caused stuff like itunes to not open and my adobe files to get deleted. What do I do after I get rid of the virus?

    Comment by Zack — March 2, 2010 #

  11. Had this twice, once from a live cricket stream and once from a film on Tudou – major panic when nothing worked, but found a quick fix:
    1.Internet off
    2.Open WinPatrol – select active tasks
    3.Kill task “av.exe” or similar (would probably work with taskmanager but not tried it)
    4.Run Spybot Search&Destroy
    5.General AV cleaning
    Still bothered that AVG free not catching it and will need to check registry, but the fix did work for a good while.

    Comment by WapenziMcMental — March 3, 2010 #

  12. Zack, you can also check you PC using an online scanner.

    Comment by Patrik — March 3, 2010 #

  13. Absolutely speechless. This is fantastic and the best post ever made abou this spyware. God bless you and I love you to the max. It really works like magic. Stay blessed

    Comment by virusman — March 3, 2010 #

  14. When I tried to run fix.reg I get the following: Cannot import c:\…fix.reg: The specified file is not a registry script. You can only import binary registry files from within the registry editor.

    Any thoughts or help.

    Thanks – Brian

    Comment by Brian — March 4, 2010 #

  15. Patrick – I recreated fix.reg and it worked. AOL is still working on my computer. Can I move to Step 2 and download the MalwareBytes program before I reboot my computer? Is the reboot necessary if I am able to download and install MalwareBytes, or can I run it once I have downloaded it and installed it, without the reboot?

    Thanks – Brian

    Comment by Brian — March 5, 2010 #

  16. when i try to run fix.reg it says the specified title is not a registry script. help!!

    Comment by dan — March 5, 2010 #

  17. Brian, check the fix.reg. Looks like you have skipped first line.

    Comment by Patrik — March 5, 2010 #

  18. Thanks for the response- I did skip the first line, edited the file and it ran successfully.

    A quick follow-up – AOL is still working on my computer. Can I move to Step 2 and download the MalwareBytes program before I reboot my computer? Is the reboot necessary if I am able to download and install MalwareBytes, or can I run it once I have downloaded it and installed it, without the reboot?

    As a side note, I can actually get programs to fuction on my computer by starting the program a second time and then ending the ‘MSASCui.exe’ process with Task Manager, even IE with internet access.

    Thanks again! – Brian

    Comment by Brian — March 5, 2010 #

  19. Brian, yes you can use Malwarebytes without the reboot.

    Comment by Patrik — March 6, 2010 #

  20. dan, fix.reg should have “Windows Registry Editor Version 5.00″ in first line.

    Comment by Patrik — March 6, 2010 #

  21. Patrik – the Malwarebytes fix worked. Very easy to complete after re-naming the (exe) to (com). Thanks for all your help. – Brian

    Comment by Brian — March 6, 2010 #

  22. When I Save As All Files “fix.reg” using the notebook application, the only thing that seems to happen is the Notebook application opens the “fix.reg” file. Is it supposed to be an executable program updating the registry?

    Comment by Ron — March 6, 2010 #

  23. Just used your fix, worked great. I had tried a couple of other fixes to no avail. Thanks for the fix.

    Comment by Dave — March 7, 2010 #

  24. I have done everything and I think it worked. Just one question – does it matter that the MalwareBytes software only found only 5 infected files? I know it is stated in your guide how the results may differ from your scan image, but your images shows loads more infections than mine. Just wondering.
    Cheers :)

    Comment by Rob — March 7, 2010 #

  25. Rob, its ok :)

    Comment by Patrik — March 7, 2010 #

  26. Thanks so much for this info. I thought my computer was done for. The virus was starting to cut off my internet. Your fix worked perfectly and was very clearly described! Thanks so much!

    Comment by John — March 7, 2010 #

  27. I have checked the site, but to be able to get rid of the xp Anti virus thing, i need to download something – but i dont have access to the internet in the first place to get rid of it,

    Please tell me if there is another way round this?

    Thanks

    Comment by Kai — March 8, 2010 #

  28. Kai, do first step, the reboot computer and try download Malwarebytes.

    Comment by Patrik — March 9, 2010 #

  29. if you go into task manager and end the process av.exe it gives you temporary controll of programs… right click internet and select start if its there, if not then click open… do not just left click on internet… continue endtasking the av.exe while you use the internet, and you will be able to access web pages

    Comment by Daniel — March 10, 2010 #

  30. I did the registry fix as mentioned above, restarted the computer but now do not have access to my C Drive/program files. The fake antivirus is no longer on the taskbar but now I can’t get to my C drive help!

    Comment by Brad — March 14, 2010 #

  31. Brad, no C drive in My computer folder ?

    Comment by Patrik — March 15, 2010 #

  32. Thank you so so much. I luckily have internet on my phone and was able to get to your site. you’re amazing it worked!

    Comment by Nicole — March 18, 2010 #

  33. Hello,

    Please i really need help! I have XP AntiMalware on my computer, I created the fix.reg, doubleclicked and rebooted but my internet browser will not open for me to download malware butes! Please help me!

    Comment by Sarah — March 20, 2010 #

  34. I am using my work computer right now,and the infection is on my laptop.

    Comment by Sarah — March 20, 2010 #

  35. Sarah, follow the steps below:
    Click Start, Run, type regedit and press Enter.
    Registry editor opens.
    Navigate in the left panel to HKEY_LOCAL_MACHINE \ SOFTWARE \ Clients \ StartMenuInternet \ IEXPLORE.EXE \ shell \ open \ command

    I the right part of window click twice to “@”. You will see a screen with the contents like below: “C:\Documents and Settings\user\Local Settings\Application Data\av.exe” /START “C:\Program Files\Internet Explorer\iexplore.exe”
    Remove left part, leave only “C:\Program Files\Internet Explorer\iexplore.exe”.

    Reboot your PC and try download Malwarebytes once again.

    Comment by Patrik — March 20, 2010 #

  36. I followed all the steps, but every time I reboot, Malwarebytes is always able to find and “remove” 5 items. Something keeps reinstalling every time there is an internet connection.

    Comment by mike — March 22, 2010 #

  37. I ran the malware and removed the infected files but Antivirus is still hijacking my computer. Please help?

    Comment by M Bha — March 23, 2010 #

  38. I followed all the steps, but when I reboot and run Malwarebytes again, it finds and “removes” 5 items every single time. It also seems like when ever there is an active internet connection, the program takes hold again. AVG pops up an alert about a possible trojan horse in the WINNT folder. Thanks for the help so far. Any tips on cleaning for good would be appreciated.

    Comment by Mike — March 23, 2010 #

  39. Greetings from Guam USA……Thanks a million! It worked for me.

    Comment by Anthony — March 24, 2010 #

  40. Mike, open a new topic in our Spyware removal forum. I will check your computer.

    Comment by Patrik — March 24, 2010 #

  41. M Bha, please open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — March 24, 2010 #

  42. I am not able to save the notpade ad fix.reg.
    It saves as fix-nodepad. and it opens as a notepad.
    Any help…please.
    May

    Comment by May — March 25, 2010 #

  43. it doesnt copy and paste onto that notepad mate

    Comment by ali — March 25, 2010 #

  44. May, most important, in the Save dialog, you need select File type: All files.

    Comment by Patrik — March 25, 2010 #

  45. Ali, if you can`t copy and paste, then manually type a text.

    Comment by Patrik — March 25, 2010 #

  46. Total success! You are a modern hero! Thanks for your selfless dedication!

    Now, if only I could figure out how this **** got on my PC!

    Comment by Larry — March 31, 2010 #

  47. HEY, i some how got this virus, and the solutions they provide here really work. :] THANK YOU SO MUCH

    Comment by Heather — April 4, 2010 #

  48. also, the notepad thing didn’t work for me either, but when i downloaded malwarebytes anti-malware–it got rid of it successfully and quickly.

    Comment by Heather — April 4, 2010 #

  49. Thanks alot. I think I got this infection from a fake ups email.

    Comment by mitsie — April 7, 2010 #

  50. If your screen locks up and you cant do anything try to open task manager and kill the av.exe program running on the system. You should be able to open an internet browser and fix the problem as shown above.

    Good luck

    Comment by Jack — April 7, 2010 #

  51. I am trying your steps for removal but the installation of Spyware Doctor keeps getting hung when it says “Creating registry entries…”. What do I do now?

    Comment by Michele — April 7, 2010 #

  52. Michele, open a Malwarebytes page (link in the instructions above), then scroll down to Malwarebytes Anti-malware direct link. Download it and run.

    Comment by Patrik — April 8, 2010 #

  53. I’m unable to type the full command into the notepad as the computer freezes due to the number of things running

    Comment by laura — April 8, 2010 #

  54. laura, try boot your computer in Safe mode and follow the steps above.

    Comment by Patrik — April 9, 2010 #

  55. thank you for this superb explanation and guide! it help my friend .. from a distance …
    thx a lot ;)

    Comment by Psqad — April 11, 2010 #

  56. Another thought people…if you do some research you find that this is a russian-sourced program that might not load on your pc if it detects certain things in your browser history–like going to google.ru!

    Apparently if the program thinks you know Russian, it will not load on your machine.

    So you might want to tell your peeps to go to google.ru today.

    Comment by bob` — April 13, 2010 #

  57. after loading the fix.reg and rebooting anything I try to open asked for what program to open with. it’s the same with IE as well as Malwarebytes exe.Thanks for the help

    Comment by Lee — April 13, 2010 #

  58. Sorry, I should look more carefully at what I typed. Thanks Again

    Comment by Lee — April 13, 2010 #

  59. Thankyou sooooooo much that was a horrible virus and thanks to you it’s gone. You’re great!!!

    Comment by Rachel — April 14, 2010 #

  60. How do I reverse the registry changes? Everytime I try to start a program, including the command prompt, I get the error message “This file does not have a program assosciated with it for performing this action. Create an association in the Folder options control panel.”

    Comment by Dan M. — April 16, 2010 #

  61. Hi, I’ve used your website before to remove XP Guardian and worked like charm. However, I’m having some diffculting with this one…I did all of Step 1 sucessfully, downloaded MalwareBytes but now I can’t open the file, no matter how many times I click or left-click. Help!

    Comment by Nur — April 16, 2010 #

  62. Did everything but didn’t download the malware scanner just used my avg. Gone anyway. as soon as i used the notepad trick everything was fine cheers guys. Hate rouge viruses this was a very crafty one.

    Comment by You — April 17, 2010 #

  63. Dan M, looks like the first step is not fully installed, you need repeat it. Try method 1 or 2.

    Comment by Patrik — April 17, 2010 #

  64. Nur, if all programs are work except Malwarebytes, then probably you computer is infected with TDSS trojan. Try the steps or ask for help in our Spyware removal forum.

    Comment by Patrik — April 17, 2010 #

  65. I keep getting Antispyware XP Alerts such as System Integrity Threats, Malware Intrusion, Trojan Virus Detected, Your Computer is at Risk, Stealth Intrusion. It blocks me trying to use Firefox until I click ‘continue unprotected’. Also runs a system scan and reports 27 infections. I’m not stupid and know this is an attempt to get me to purchase and register Antispyware XP. I’ve downloaded Malwarebytes however, when I try to run it…nothing happens. Same with my AVG program. Any help would be appreciated. (I tried the removal steps but not sure what command I am supposed to type…please specify.)

    Comment by Patty — April 17, 2010 #

  66. Patty, you need type “command” w/o quotes.

    Comment by Patrik — April 17, 2010 #

  67. Thank you so very much, Patrik. After I renamed the file and changed the extension to .bat, I was able to run Malwarebytes. It’s gone now and everything seems to be back to normal.

    Comment by Patty — April 17, 2010 #

  68. Hi Patrick! I was able to get rid of the anti-virus 2010, and my computer was working fine for a while but now malwarebytes won’t open up. Every time I try to open in (regardless of where I try to open it) a missing shorcut box opens and says that it cannot find mbam.exe. So then I try browsing for it and I find it but it still will not open up!! What do I do???
    Oh and also whenever I get on the internet to look for this website on google, random websites pop up that have nothing to do with this website, and the computer runs slower.

    Comment by Kelly — April 19, 2010 #

  69. Thank you so much! It is always a good thing to try the internet for solutions when in times of trouble. I hope that in my future troubles I will be able to find solutions in this site. Again thank you very much indeed! :)

    Comment by Anne — April 19, 2010 #

  70. Kelly, i have answered you here.

    Comment by Patrik — April 20, 2010 #

  71. I tried the above but got the following message when trying to lunch the Malware program:

    “This file does not have a program assosciated with it for performing this action. Create an association in the Folder options control panel.”

    Following a different website I used the txt below as my fix, it is slightly different but overcame my folder association issue:

    [-HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand]
    [-HKEY_CURRENT_USERSoftwareClassessecfileshellopencommand]
    [-HKEY_CLASSES_ROOT.exeshellopencommand]
    [HKEY_CLASSES_ROOT.exe]
    @=\exefile\
    \Content Type\=\application/x-msdownload\
    [-HKEY_CLASSES_ROOTsecfile]

    Comment by J Aiken — April 22, 2010 #

  72. Mum got this virus while on facebook, thanks for the fix. :-) youre a star

    Comment by Tony Cone — April 23, 2010 #

  73. I have system restore off and have scanned and removed several infections with malwarebytes and avg yet XP AntiMalware reappears after every time i start a process. Also, when i scan with avg i have do untick the box for “Scan system enviroment” or i get blue screen’d during the scan. Now im getting shell32.dll errors so i can’t add/remove programs etc. >_>

    Comment by Elliot — April 24, 2010 #

  74. Elliot, you have done the first step above ?

    Comment by Patrik — April 24, 2010 #

  75. Followed step 1. I am now able to access internet.
    One question: is there a space between ” and % (the ninth and tenth characters) in this code
    @=”\”%1\” %*”
    Or is there no space @=”\”%1\”%*”

    I am unable to download Malwarebytes as cannot find the program to run it. In fact almost the entire control panel is unable to be accessed – error message: This file does not have a program associated with it for performing this action. Create an association in the Folder Options control panel. I am not sure what to do now

    Comment by Janelle — April 25, 2010 #

  76. I did that a few days ago. Just did it again and got blue screen on startup after reboot.

    Comment by Elliot — April 25, 2010 #

  77. Janelle, it should have a space.

    Comment by Patrik — April 25, 2010 #

  78. Hi Patrik, your solution worked like an absolute dream. I think this may have infected my PC through my son downloading a game. It is so nice to know that there are people like yourself out there who take the time and effort to provide an antidote to those who seek to disrupt our lives. Please let me know if there are any means by which to make a token financial donation to show my appreciation.

    Comment by Nick — April 25, 2010 #

  79. Nick, glad to help you :)
    You can help the Myantsipware site and other peoples who needs a help by linking to the article or main page of myantispyware.com.
    Safe surfing!

    Comment by Patrik — April 27, 2010 #

  80. I did everything that you said to do, changed the registry file with the fix.me notepad file but Malwarebytes still won’t open. I think I’ll have to format. Please help!!! I would appreciate it

    Comment by Cara — April 28, 2010 #

  81. Cara, open a new topic in our Spyware removal forum. I will check your PC.

    Comment by Patrik — April 29, 2010 #

  82. Thanks for your help, have lost days becuase of this.

    For some reason though my internet explorer still wouldn’t work. I noticed that the green bar would get to 2 blocks and then I’d get a flash of “XP Virus” in the tab, before it said it couldnt get a connection. Got round this by resetting the explorer settings, as follows from MS website:

    Methods to follow for Internet Explorer 7 or Internet Explorer 8
    Method 1: Reset the Internet Explorer settings
    If you have Internet Explorer 7 or Internet Explorer 8 installed, you can repair damaged files or missing registration information in Internet Explorer 7 or in Internet Explorer 8. To do this, follow these steps:
    Start Internet Explorer.
    On the Tools menu, click Internet Options.
    On the Advanced tab, click Reset.
    In the Reset Internet Explorer Settings dialog box, click Reset to confirm.

    Thought it might be helpful.

    Thanks again.

    Comment by Neil — April 29, 2010 #

  83. hi! I’d like to ask a question. I follow the fix.reg instruction and the following but I don’t understand that I cahnge the registry and no steps written that registry restoring. Is it not necessary? sorry I don’t good enough at programming. so only that steps(at this site above) enough? is it sure? thanks a lot.

    Comment by Jani — April 29, 2010 #

  84. Jani, the first step above will restore default Windows registry settings. Second step will remove malware.

    Comment by Patrik — April 30, 2010 #

  85. When I attempt to use the command prompt to initiate the registry fix sequence, it will not let me type anything into the command prompt. Chrome is not launching either, it is what I was already using, and Mozilla works fine. Any advice on how to get past this and start the fix? Thanks.

    Comment by Javier — May 11, 2010 #

  86. so I guess I have the same problem as everyone else but now I cant even open up any programs. When I try to open something up I get a security warning saying “application cannot be executed”. Now i cant even open up an anti virus program or even open up the RUN on the start menu, please help me I do not want to buy another computer!!!!

    Comment by Jon — May 11, 2010 #

  87. Javier, try the following:

    * Click My computer.
    * Click the Tools menu and click Folder Options.
    * After the new window appears select the View tab.
    * Put a checkmark in the checkbox labeled Display the contents of system folders.
    * Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
    * Press the Apply button and then the OK button.
    * Now your computer is configured to show file extensions for known file types.

    Navigate to C:\ Windows \ System32 folder.
    Copy notepad.exe to your desktop.
    Right click to it, select rename and type notepad.com
    Run it.
    Notepad opens. Then follow the steps above,

    Comment by Patrik — May 12, 2010 #

  88. Jon, you need run “command” w/o quotes to run notepad. Follow the steps above. If command is blocked, then follow the steps from my previous comment.

    Comment by Patrik — May 12, 2010 #

  89. I had the virus and was able to remove it thanks to your information. I ended up using safe mode to use malwarebytes and I can use my computer, however, I can not connect to the web. I get IE cannot display the webpage. I have tried step 1 again and nothing. I have read many of the comments and can not figure out what my next step should be. I am on a wireless modem and it shows that I am connected to the wireless modem.

    Comment by Nancy — June 1, 2010 #

  90. Nancy, download Malwarebytes to another PC and them nove it to your computer using a flash or cd disk.

    Comment by Patrik — June 2, 2010 #

  91. Thanks, I have done that and have run Malwarebytes several time, my problem now is that I can not connect to IE. I get the “IE can not display this webpage” screen. I have run the registry fix and that works. Should I download IE to flash and try to reinstall that way?

    Comment by Nancy — June 2, 2010 #

  92. Nancy, only IE does not work ? or all network application ? including ping, instant messengers, email readers, other browsers.

    Comment by Patrik — June 2, 2010 #

  93. No, nothing connecting to the web works. I have tried to use Safari nothing works. I am able to get updates to malwarebytes, and trend micro so I can run scans but nothing directly to the web. What is ping?

    Comment by Nancy — June 2, 2010 #

  94. HI, all network applications do NOT work. I tried using Chrome and got error 102 net::ERR_connection_REFUSED). when I do a standard ping it says packets sent 4 packets received 4, when I do a ping to microsoft it says packets sent 4, received 0, loast 4.

    Comment by Nancy — June 2, 2010 #

  95. after searching other comment section on this website, I have resolved my issues of internet not opening. I had the incorrect proxy settings in IE and once I unclicked the Use Proxy settings, i was back on line. Thanks for all your help.

    Comment by Nancy — June 2, 2010 #

  96. Ive tried to put in notepad but it will not work it keeps saying notepad is not recognized as an internal or external command operable program or batch file. wha Do I need to do…Please thank you

    Comment by avdean21@gmail.com — November 30, 2010 #

  97. avdean21, use wordpad.

    Comment by Patrik — December 1, 2010 #

  98. I need some help I followed all the instructions and made sure everything was correct but I keep getting a message that says cannot import the specified file is not a registry script. You can only import binary registry files from within the registry editor

    Comment by Johnny — December 2, 2010 #

  99. Johnny, try the instructions http://www.myantispyware.com/2010/11/22/how-to-remove-vz-exe-malware/, step 1 – method 2 (inf file).

    Comment by Patrik — December 4, 2010 #

  100. Many thanks for this, worked a charm.

    Comment by neil cooper — February 27, 2011 #

  101. I have followed your steps to try to remove xp anitivirus. cannot download malaware because when i try to open internet expl it said it cant because of diagnostice problems. so i ran malaware that was already downloaded to rid of in fections. Think they are all gone?? still cant get on internet. also tried what you suggested to sara (goin into regedit ets..) still cant acess. Help. from computer dumy :)

    Comment by mandy — March 20, 2011 #

  102. All good now. Phoned iinet who helped reset my intenet settings. Thanks for all your help!!!

    Comment by mandy — March 21, 2011 #

  103. Thanks a million. Great Stuff

    Comment by Michael — March 22, 2011 #

  104. I only have one computer that been infected with this damm thing. No way I can search for info about this. Out of despration, I tried this. What I did, I rolled back my computer through Start\Programs\Accessories\Syatem Tools\System Restore. I selected the date a few days before this happening. And it works. I’m not sure for how long. Possibly someone can comment on this approaches.

    Comment by UncleCBX — March 28, 2011 #

  105. The steps outlined above worked great and got my pc seemingly working again with viruses removed. However now I am having trouble running programs and get a pop whenever I run most programs. Pop up reads “Open with…CHoose the file you want to open the file with:” It does this with the malware program, vlc, notepad and many others. I figure I need to do something with the registry as exe extensions arent working. I see some other with this error but I am not sure I see how to fix it back.

    Comment by DavidL — March 29, 2011 #

  106. DavidL, you need to repeat the step 1.

    Comment by Patrik (Myantispyware admin) — March 31, 2011 #

  107. Hi, thank you so much for this free fix-up on removing this xp antispyware. the first time i saw it i was mad and already planning on getting a new pc thinking my comp was really infected. then my brother told me to search and maybe it just needs a fix and lo and behold there is a fix for it! so glad it works!! thanks! :)but there seems to be a problem now with my windows security center, i can’t seem to update the automatic update option from off to on, is there a fix to this? thanks.

    Comment by klare — April 9, 2011 #

  108. I was able to accomplish this fix in about 30 minutes. Luckily, I already had the malwarebytes software on my system.

    Comment by Matt B — April 15, 2011 #

  109. i did all of step one…when i double click to open the fix.reg it says to me “registry editing has been disabled by your administrator” i also tried to system restore and got a similar message…any ideas??? thank you in advance!

    Comment by briana — April 15, 2011 #

  110. uncleCBX, your method worked for me, restoring the system is ok and this depends on one timing the restoration point. Thanks Uncle CBX you have saved my day.

    Comment by Gson — April 16, 2011 #

  111. Have run all tasks, MAlwarebytes isn’t finding the reg keys and files mentioned. Any ideas?

    Comment by Jon — April 22, 2011 #

  112. I had this earlier, tried MWB and it removed it but there were still traces of it when it was uspposedly fixed. It was so bad i had to sent it back to our IT department for my laptop to get re-imaged. I visited wreckedexotics.com and seemed to catch it again, but I re-downloaded MWB again, ran it and so far it’s fine, no more issues cropping up

    Comment by Eric B — April 25, 2011 #

  113. just one thing… THANK YOU

    Comment by Adriano — May 1, 2011 #

  114. I tried the 1st step, and fix icon saved to my desktop, but when i try rebooting pc it says it might need more time (the black window when i try closing it)

    i cant get on any internet page without the virus taking over it, so i cant download malware or even check my emails. i amm writing on this from my friends pc. It doesnt seem to work at all

    i saved the notepad thing as all files ANSI, shoukd it be something else?

    Comment by wendy — May 3, 2011 #

  115. Plz hlp.I did the the registry fix and did reboot but as windows loads up I get
    buffer overrun detected! And goes black. Nothing
    Its in the winlogon.exe

    Comment by jason c — May 4, 2011 #

  116. Your solution was quick and spot on. Thank you so so much for your selfless time in solving and posting the information needed. This was definitely the worst bugger I had dealt with in a long time.

    Comment by karen — May 15, 2011 #

  117. I too have Windows XP and got the XP Anti Spyware Virus. None of the above suggestions worked for me.

    I used a free program called Super Anti Spyware. I have used it previously, and it effectively removed the Windows Repair virus when Malwarebytes could not. It’s totally free and it continues to rock my socks off! Go to “http://www.superantispyware.com/” and download the free edition.

    Also, in order to fix the EXE problem where programs won’t load because of a broken file association, I visited “http://www.pcreview.co.uk/forums/exe-files-wont-open-t532346.html” and followed Venkatesh’s link “http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip”. Inside the zip folder, I found a reg file, which I double clicked and pressed “okay”.

    Abracadabra, my computer was fixed! Hope this works for you too!

    Comment by Ryan B — May 24, 2011 #

  118. After step 1 I clicked on my fix.reg and I got a Registry Error

    “Not all data was successfully written to the registry. Some keys are open by the system or other processes.”

    What does this mean? Should I continue to a reboot anyways or is there something more that needs to be done.

    Thanks, JDub

    Comment by JDub — May 31, 2011 #

  119. Many thanks for this article and help- I have spent a fair part of my weekend trying to rid my thinkpad of this nasty virus- I have never had this much trouble and time spent on a fix, the registry edit was the key to getting thru to run malwarebytes- until then it was slow and a hassle. .

    I wish I had come across this page on day 1!! would have saved me sooo much time- I had malwarebytes already on my tpad but it did not find anything, removed that and put newest version on and it sorted out issues quickly; just got it running and its not back to normal BUT at least no blue screening!

    Just now have to get it running fast and access the www.

    I also got the latest version of superantispyware on and ran that- picked out a bunch of things.

    Cheers Darren

    Comment by Dazzla — June 7, 2011 #

  120. Thank you very much, you are very appreciated!

    Comment by Misty — June 7, 2011 #

  121. I just had this infection. My IT dept used Malwarebytes to get rid of it, but my “My Documents” folder had been hidden (not sure how, but they got it back) and somehow my XP Quick Launch folder was wiped out and my desktop wallpaper was gone. Neither of the latter are serious, but suggest something else funky is happening with this virus. Anyone else see this?

    Comment by Jeff — June 16, 2011 #

  122. I’ve been seeing this thing all over the place. I’m at IT guy for multiple companies, and this thing was really getting on my nerves. Great job.

    Comment by YTHOMIT — June 23, 2011 #

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>


My Anti Spyware - Free antispyware programs and Spyware Removal Instructions.