https://wiki.nocrash.net/index.php?action=history&feed=atom&title=Remove_XP_Internet_Security_Virus
Remove XP Internet Security Virus - Revision history
2026-06-04T22:59:42Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://wiki.nocrash.net/index.php?title=Remove_XP_Internet_Security_Virus&diff=20&oldid=prev
Chris: Created page with "1. Ctrl-Alt-Del, kill {av.exe} 2. Run RegEdit and correct the following: [BAD] HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local S..."
2010-08-04T20:12:29Z
<p>Created page with "1. Ctrl-Alt-Del, kill {av.exe} 2. Run RegEdit and correct the following: [BAD] HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local S..."</p>
<p><b>New page</b></p><div>1. Ctrl-Alt-Del, kill {av.exe}<br />
<br />
2. Run RegEdit and correct the following:<br />
<br />
[BAD]<br />
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*<br />
[Good]<br />
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command<br />
(Default) REG_SZ exefile<br />
Content Type REG_SZ application/x-msdownload<br />
[BAD]<br />
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*<br />
[Good]<br />
*Delete Key*<br />
[BAD]<br />
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*<br />
[Good]<br />
HKEY_CLASSES_ROOT\.exe\shell\open\command<br />
(Default) REG_SZ exefile<br />
Content Type REG_SZ application/x-msdownload<br />
+ Folder = HKEY_CLASSES_ROOT\.exe\PersistentHandler<br />
[correct key entry should be unaffected]<br />
HKEY_CLASSES_ROOT\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*<br />
[Good]<br />
*Delete Key*<br />
[BAD]<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"<br />
[Good]<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command<br />
(Default) REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe<br />
[BAD]<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode<br />
[Good]<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command<br />
(Default) REG_SZ "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode<br />
[BAD]<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"<br />
[Good]<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command<br />
(Default) REG_SZ C:\Program Files\Internet Explorer\iexplore.exe<br />
[BAD]<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"<br />
[Good]<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "0"<br />
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "0"<br />
<br />
3. Restart, and IF possible RUN System Restore and choose a day or two from the past to restore. If you installed an application AFTER the restore date then reinstall that application.<br />
<br />
You may have to delete the affected user's account and create a new one.</div>
Chris