W32.Spybot.Worm - deletion of offending registry entries is being monitored by virus

mdkelley51 used Ask the Experts™
OS: Windows XP Home Edition SP2 and all critical updates applied as of 5-29-2007.
Ran full scan using Symantec antivirus. Symantec antivirus detected W32.Spybot.Worm; specifically it removed c:\windows\system32\avp.exe.

From Symantec's website they outline the procedure for removal of the worm. After the full scan and deletion of the file, Symantec then details the procedure for cleaning the registry by removing the references to the deleted file (in my case, avp.exe) from the following locations:

The problem is that after removing the "avp.exe" entry from the above keys, a quick reivew shows that they have been added back almost immediately.  It's as though some service is monitoring my editing of the registry and replaces them after I've completed editing.

Any suggestions?

Thank You.

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Expert of the Year 2004
Top Expert 2004
try running the scan in safemode because in normal mode this avp.exe must be running the background, and thus adding itself back upon deletion.
Top Expert 2007

Safemode should fix the problem.  If files still show back up on reboot, you may also have to disable System Restore (do a full backup of all important data to removable media before disabling SR).


I realized after posting this question that even with a "correct" answer, I would still have insufficient knowledge to remove the "worm".

I've decided to reinstall Windows.

Thank you for your help.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial