troubleshooting Question

W32.Spybot.Worm - deletion of offending registry entries is being monitored by virus

Avatar of mdkelley51
mdkelley51 asked on
Anti-Virus AppsWindows XP
3 Comments1 Solution433 ViewsLast Modified:
OS: Windows XP Home Edition SP2 and all critical updates applied as of 5-29-2007.
Ran full scan using Symantec antivirus. Symantec antivirus detected W32.Spybot.Worm; specifically it removed c:\windows\system32\avp.exe.

From Symantec's website they outline the procedure for removal of the worm. After the full scan and deletion of the file, Symantec then details the procedure for cleaning the registry by removing the references to the deleted file (in my case, avp.exe) from the following locations:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
etc...

The problem is that after removing the "avp.exe" entry from the above keys, a quick reivew shows that they have been added back almost immediately.  It's as though some service is monitoring my editing of the registry and replaces them after I've completed editing.

Any suggestions?

Thank You.



ASKER CERTIFIED SOLUTION
Join our community to see this answer!
Unlock 1 Answer and 3 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 3 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros