September 7, 2008 03:18am pdt

Member Login

Hall of Fame

Yearly

1rpggamer... 76,391
2IndiGenus 63,552
3younghv 48,461
4legalsrl 18,850
5phototropic 17,130
6war1 17,100
7orangutang 9,172
8briancassin 8,670
9r-k 8,490
10yasserd 8,412
11jimmymcp02 8,390
12moh10ly 8,346
13johnb6767 8,229
14snoopfrogg 8,000
15McKnife 6,500
16Maeros 6,475
17LeeTutor 6,064
181972vet 5,900
19GaryStev... 5,628
20David-Ho... 5,323
21Richard_... 5,200
22eXpeLLeD... 5,150
23nobus 5,004
24Kutyi 4,832
25Jonvee 4,703

	[x] Attachment Details

How do I remove Vista Antivirus 2008 from my Windows XP Pro machine?

Zones: Anti-Virus Applications, HijackThis Software, Anti-Virus

Tags: Vista Antivirus 2008

Hello all,

One of my users recently became infected with Vista Antivirus 2008 on his XP Pro laptop. After reading through these forums, I downloaded ComboFix and ran it on the infected computer while in safe mode. Attached are the ComboFix and HijackThis logs. Are there other vestiges of infection that I need to remove? If so, what's the best way to go about it?

Thanks in advance,

Attachments:

20080616-ComboFixLog-1.txt (12 KB) (File Type Details)

ComboFix Log after 1st pass

20080616-1-hijackthis.txt (12 KB) (File Type Details)

Hijack This Log after 1st pass

Start your free trial to view this solution

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.4

Question Stats

Zone: Software

Question Asked By: brandonharris

Solution Provided By: IndiGenus

Participating Experts: 3

Solution Grade: A

Translate:

Loading Advertisement...

Open Discussion

Comment by zopit

To REMOVE XP Antivirus Manually...

NOTE: When you locate the RANDOM FILE NAME, note it down to scan (find) the registry and remove entries which have this name.

Kill processes via Task Manager
AntivirusXP2008.exe %ProgramFiles%\\[RANDOM NAME]\\rhccv9j0e1b1.exe
%ProgramFiles%\\[RANDOM NAME]\\rhccv9j0e1b1.exe.local
%ProgramFiles%\\[RANDOM NAME]\\Uninstall.exe %System%\\[RANDOM NAME].exe

Unregister DLLs: using from cmd prompt: regsvr32 u FILENAME
%ProgramFiles%\\[RANDOM NAME]\\msvcp71.dll
%ProgramFiles%\\[RANDOM NAME]\\msvcr71.dll
%ProgramFiles%\\[RANDOM NAME]\\MFC71.dll
%ProgramFiles%\\[RANDOM NAME]\\MFC71ENU.DLL

Delete files from your system: Note administrator access may be required and may be easier to delete these files though safe mode.
AntivirusXP2008.exe
%UserProfile%\\Application Data\\Microsoft\\Internet Explorer\\Quick Launch\\Antivirus XP 2008.lnk
C:\\Documents and Settings\\All Users\\Desktop\\Antivirus XP 2008.lnk
C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\Antivirus XP 2008.lnk
C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\How to Register Antivirus XP 2008.lnk
C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\License Agreement.lnk
C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\Register Antivirus XP 2008.lnk
C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\Uninstall.lnk
C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008.lnk
%ProgramFiles%\\[RANDOM NAME]\\database.dat
%ProgramFiles%\\[RANDOM NAME]\\license.txt
%ProgramFiles%\\[RANDOM NAME]\\MFC71.dll
%ProgramFiles%\\[RANDOM NAME]\\MFC71ENU.DLL
%ProgramFiles%\\[RANDOM NAME]\\msvcp71.dll
%ProgramFiles%\\[RANDOM NAME]\\msvcr71.dll
%ProgramFiles%\\[RANDOM NAME]\\rhccv9j0e1b1.exe
%ProgramFiles%\\[RANDOM NAME]\\rhccv9j0e1b1.exe.local
%ProgramFiles%\\[RANDOM NAME]\\Uninstall.exe
%System%\\[RANDOM NAME].exe

Delete files which control the background and Screen saver
Located via Explorer the Random file name.scr and Random file name.bmp under windows directory or windows\system32 and delete.
NOTE: these files are usually created at or around the same date and time the virus was first located (last few hours or days)..

OTHER ISSUES TO LOOK FOR WITH XP ANTIVIRUS 2008

AFTER or WHEN YOU CLEAN - XP ANTIVIRUS 2008 VIA TOOLS FROM WEB OR MANUALLY,
When you restart, YOU LOGIN AND NOTHING IS THERE, No Explorer or Icons or Start Button !!!!
CTRL / ALT / DEL to start Task Manager.
Run REGEDIT and locate the following folder.

\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution\

Delete this highlighted folder (explorer.exe)

IE: Delete the folder and the Keys it holds

\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution\Explorer.exe

Then from TASK MANAGER run explorer.exe and your system should start if this was the problem that started this issue.

20080723-EE-VQP-34 / EE_QW_2_20070628