Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

Troubleshooting
Research
Professional Opinions
Ask a Question
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

troubleshooting Question

Got infected w/ malware: Antivirus XP

Avatar of ugeb
ugebFlag for United States of America asked on
Anti-Virus AppsAnti-Spyware
18 Comments1 Solution923 ViewsLast Modified:
Hi,

Don't know how, but I got infected w/ a malware program masquerading as an antivirus program.  It's called Antivirus XP and mimics the native Windows Security center, and AVG.  I probably have the newest version of this malicious crap.

I couldn't launch any apps because it would always bring up that stupid app.  I looked in my registry and there was were two entries in
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
(Default)                 "C:\Documents and Settings\Gene\Local Settings\Application Data\ave.exe" /START "%1" %*
IsolatedCommand     "%1" %*

I didn't know whether the .exe entry was changed or added, so I renamed it to ".exeX".  After that I was able to launch applications.  However, the bad entry remains in my registry, just renamed.

I did some searching and a program called MalwareBytes was recommended.  However, when launched it doesn't update properly, just hanging.  I do have internet access on this machine, so that's not the problem.  So the program didn't work for me.

My concern is that if I reboot, it could start up again.  I don't know which files to delete, or which entries in msconfig or whereever.  Before deleting the registry entry, I searched for ave.exe and could only find it as ave.exe****.pf  (the **** were some numbers).  However, the program still launched.

How can I delete this crap for good??

Thanks!

ASKER CERTIFIED SOLUTION
Avatar of Kruger_monkey
Kruger_monkeyFlag of United Kingdom of Great Britain and Northern Ireland image

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Commented:
This problem has been solved!
Unlock 1 Answer and 18 Comments.
See Answers