AntiVirXP08 (AntiVir XP 08) Removal Instructions (Anti Vir XP 08)

By Garry on Jun 27, 2008 | Reply

I can’t remove the files because I keep getting a blue screen befor I can do anything. How do I get rid of this Anti Virus Xp 2008?

By Win Pet on Jun 27, 2008 | Reply

So do I.
I checked the minidump and it crashed by different modules at different time.

By MetsFan on Jun 27, 2008 | Reply

I do not have Antivir08, but Antivirus XP 2008 keeps popping up.

By Jeff on Jun 28, 2008 | Reply

I did everything and I still have the message as my wallpaper saying I have a virus and need to install some kind of antivirus or spyware remover program on my computer. The tabs in the display properties to modify wallpaper and screen saver settings disappeared. How do I get that back and is XP Antivirus really off my CPU??

By Mark on Jun 29, 2008 | Reply

Me too. I got AntiVirXP08 floating around my screen but could not get rid of it.

By T.J. on Jun 30, 2008 | Reply

Man! This AntiVirXP08 is certainly annoying. I’ve been fighting against it for the last few days but no avail. Damn it!

By O.Oliver on Jun 30, 2008 | Reply

Could someone help me with suggestions on how to remove this damn AntiVirXP2008. I have tried but no avail. pls….anyone?

By doug on Jun 30, 2008 | Reply

can’t get id of Antivirus 2008. Any help? Doug

By Griff on Jul 2, 2008 | Reply

dam this antivirxp … to think i got it from kaspersky’s website when ifinally decided to buy the product online…. now it seems – “they sealed deal” S%%T

By manas on Jul 2, 2008 | Reply

ME too. I can’t get rid of the popup and also the wallpaper of this AntiVir. Although after delete all AntiVir file.

By Arie on Jul 3, 2008 | Reply

Well I think it’s my own stupidity. I opened an email which looked fishy to me and still I could resist opening it. The subject was something like we cought you on tape and it seems to coming from Belgium.
Anyway I’m in trouble as well. And don’t know yet how to solve this. Good luck to you all.

By Robbie B on Jul 4, 2008 | Reply

Once you have the virus deleted you will notice you are missing the screensaver and wallpaper tabs. This will prevent you from removing that annoying message. Here is how you get the tabs back and get rid of the message:

Manual Steps Using Windows XP Registry
Click Start and then Run.
Type regedit.exe in the Run dialog box.
Press ENTER on your keyboard.
Navigate to:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System

Right-click NoDispScrSavPage to select Modify.
Change the value to 0.

OR

Navigate to:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System

Right-click NoDispScrSavPage to select Modify.
Change the value to 0.
Quit the Registry Editor (Regedit.exe).
NOTE: You may need to log off then log on to your user account or restart your computer for the changes to take affect.

Good luck!

By Justin on Jul 8, 2008 | Reply

After all of the above, you will ofcourse still get the fake popups!!!! This is because the virus has modified your user.ini and desktop.ini files. The easiest solution to fix it is actually to end the virus processes, delete the virus exe files and create a new XP user profile called TEMP or bob or whatever. COpy all your stuff to temp. Rename your xp user profile to Delete, rename temp to your name and then delete the user profile called delete. You nopw have new user.ini, and desktop.ini files and popups are gone.

By Rudi Geldenhuys on Jul 10, 2008 | Reply

Thanks Robbie B

I followed your advice, worked like a charm.

Just a further Note:

In HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, there were both the NoDispBackgroundPage and NoDispScrSavPage Items……….

Because both my Background Page & Screen Saver Page were missing under Display Properties, both values there had to be MODIFIED.

When Right-clicking on Modify (applies to both) you have to reset the value from 1 to 0

Hope this helps some other okes out as well !

Regards

Rudi Geldenhuys

By Rudi Geldenhuys on Jul 10, 2008 | Reply

This freegin Viral Threat also goes and disables your System Restore Options

Here are Instructions to correct this:

1. Go to the System Registry (Start Run, type in: regedit and click OK)

2. Highlight My Computer, then under Edit in the File Menu select Find

3. Type RestoreOpenIsSafe and click on Find Next

4. At the Fist Instance of the Entry, Right-Click on it and select Modify………. change the value to 1 (if it is not 1 already, Click OK, then press the F3 Button to search for more of the same Entry

5. At the 2nd Instance of the Entry, do the same

6. There should only be 2 Instances of the Entry but to make sure that you press F3 again and modify any additional Instances of the Entry until you are through the Registry.

7. Go out of the Registry and Restart your computer.

Now your Restore Systems should work again.

Regards

By Becky on Jul 12, 2008 | Reply

you guys helped me so much! Thanks to you I finished getting rid of that nasty AntiVirus XP 2008 thing that was buggin my computer. Thanks again!

By Kim on Jul 13, 2008 | Reply

I have gotten rid of the AntiSpyware, but I still have a red X on my taskbar. Any suggestions on how to get rid of it? Thanks much.

By Lew on Jul 16, 2008 | Reply

Well, I survived, too, with a combination of luck and coffee. BUT my time and date still says “21:40: VIRUS ALERT!” and I can’t remove it, much like Kim has an X on her taskbar. Help! And, THANKS for all the advice so far. Lew

By EdC on Jul 17, 2008 | Reply

21:40:VIRUS ALERT.
Please check: control panel,regional options icon,regional oiptions tab, customize, time. change the AM and PM indicators to “PM” and “AM”

By EdC on Jul 17, 2008 | Reply

“21:40: VIRUS ALERT!” From registry, search control panel, international, modify keys: s1159 to AM and s2359 to PM.
They both must have “VIRUS ALERT!” now…

By john on Jul 18, 2008 | Reply

i need a response on this soon
the blue desktop background is still there after i think i deleted all of the files
i tried doing what was sated above, but the file name to change was not there
please help

By Rahul on Jul 21, 2008 | Reply

That’s awesome Rudi, it works thatnx a lot for ur support.

By Dr. Frank on Jul 21, 2008 | Reply

Yeah, this one is mean. Took me a whole day and a half to get rid of it. Partly my fault because I didn’t immediately renew my virus protection. This thing uses random filenames. If you search on symantec.com they will tell you that. The file names it used on my pc were phc7d7j0er3t.exe, pphc7d7j0er3t, rhc3d7j0er3t. There were registry entries I had to search for using all of those and the damn name antivirxp08. Also had to fix the screensave and themes tabs like everyone above. I just wish I knew what my wife or kids opened that installed it.

My advice, keep you antivirus/firewall/spyware programs up to date and active! I use Norton Internet Security, and Webroot Spysweeper for the Spyware/Adware.

Luck to all!

By Kevin on Jul 25, 2008 | Reply

Will the procedures posted to remove Antivirxp08 also work for Windows 2000?

Thanks.

By asd on Jul 27, 2008 | Reply

Ive deleted this shlwapi.dll, wininet.dll now i cannot logon in the machine…. what is this?? a hoax??? damn!

By Shpono on Jul 29, 2008 | Reply

This program is so stupid, I have another antivir and it say that antivirxp is a virus. I can’t remove it. And i reinstall my windowsXP it works. Now i am free from this stupid program!!!

By argh! on Jul 29, 2008 | Reply

ugh, this damn virus is virtually bitch slapping my computer!

By Steve W on Jul 29, 2008 | Reply

I know it costs and most people try to fix problems without resorting to dipping into there wallets/Purses,(Myself included) but having tried everything else and failing, I finally purchased “Spyhunter”. This solved it straight away. The only problem was that the annoying message in the middle of the screen was still there, but thankyou to Robbie and Rudi for there help in rectifying this. For the sake of a few quid/dollars etc I would definitely reccommend Spyhunter.

By Daniel on Jul 29, 2008 | Reply

same as asd above, i deleted shlwapi.dll and wininet.dll and now I can’t log on. When I restart windows I get this message:

The application has failed to start because SHLWAPI.dll was not found, Re-installing the application may fix this problem.

Anyone have any ideas on how to fix this?

Do not delete these files if you’re trying to get rid of this virus.

By Victoria on Jul 29, 2008 | Reply

I picked up Trojan.renos and have been able to remove the wallpaper items of this trojan but the Antivirus software purchase continues to popup. I tried to use the steps above and can not get past the first step. when I enter the cmd for command my system shows the c:\documents and settings>our name instead of the root. I have tried to regisvr line and have tried to go back to the root (these instructions also listed above) and I continue to get the response “c:\” is not recognized as an internal or external command, operable program or batch file. Not sure what to do next to get past this.

By ERVIN DUDAS on Jul 30, 2008 | Reply

i CANT OPEN Anti Virus XP 2008
My order # 8172492
Password: xOAkkgKv
I been charged $ 49.95
34.95
24.95
I need some explanation
my E-mail: erwin1933@yahoo.com

By mem on Jul 30, 2008 | Reply

getting a “task manager has been blocked by administarator” or a “registry editing has been blocked by administarator”? best thing is to go on safe mode as administrator, preform all the above steps, then create a new account for yourself as an administrator and get rid of your old account. do this ONLY AFTER you deleted all the evil virus dll files and registry entries. worked for me anyways…. good luck!

By munzter on Jul 30, 2008 | Reply

i have just removed it today. what i did is the easiest way. i just run system restore…

By Kevin on Aug 3, 2008 | Reply

Thank you Robbie and Rudy. Finally it’s outta here. Also paid for the spyhunter and got rid of the little bastard. Worth the 30 bucks

By shit on Aug 3, 2008 | Reply

i dont want to say much, but this is not normal antivirus, i dont want help and i dont want something, just who made this antivirues, to be nice
i have so many things on my computer, and now i have to make format for this antivirus xp2008
shit shit shit

By lee on Aug 4, 2008 | Reply

try doing a system restore n no more porn sites that’s how it gets in your system

By Amanda on Aug 5, 2008 | Reply

Thank you so much for all the advice, i filnally got my background tab back…Still working on kicking the initial problem in the butt.

By Seb on Aug 6, 2008 | Reply

Will the Spyhunter program advertised on this page get rid of this AntivirXP08?

By Robert on Aug 6, 2008 | Reply

My computer doesnt find “RestoreOpenIsSafe”. I also dont have a “NoDispScrSavPage” to modify in the registry

By Angel on Aug 6, 2008 | Reply

Can anyone tell me how to get my internet explorer back. I must not have removed all of the files associated with this thing because I still can’t get online. Can someone help me
please?!!!!!!!!!

By Kevin on Aug 7, 2008 | Reply

It’s really too early to tell, but I think I might have gotten rid of this stupid thing. I had to use Spybot Search & Destroy, and in the end, had to restore my computer to an earlier time. Spybot did name it as a “fraud” antivirus.

By Pepe on Aug 7, 2008 | Reply

i simply uninstalled it, will that work? i knew it was fake from the start.. though i got quite worried coz the computer restarted..

By Don on Aug 7, 2008 | Reply

I have removed this from 5 or 6 computers over the last 2 weeks. It definately comes from a web page 2008 xp anti virus. The ctrl alt delete and end task should be the only way to say no. The one interesting thing that I found out is that the blue screen of death that reports several errors and then restarts windows is only a screen saver. After you restore the desktop and screen saver tabs then change the screen saver and maybe the background. I went into safe mode and installed Ad-aware, and I have a old copy of pest patrol that is still under update contract. I then followed a lot of the steps from http://www.xp-vista.com/spyware-removal/antivirxp08-anti-vir-xp-08-removal-instructions. After restarting back into regular mode I installed AVG Free. I also use JV16 Power Tools to search the registry and remove the items suggested in the above link. I do that both in safe mode and right away in normal mode. Out of the 6 systems I had did fresh re-installs and then copied over all the documents, music etc. Oh and if you get into safe mode right away do a file and transfer settins backup even if it is the same drive. When you have problems like this it is good to imediately attach another hard drive of some kind to use as a working area and even another hard drive to do a image copy using Acronis. Appreciate the help of this web page and the techs answers. Thanks

By Jolliver on Aug 7, 2008 | Reply

To Rudy Geldenhuys and Robbie B I would just like to say you two and people like you are what make the internet such a great tool. I thank you very much for doing the leg work, I was not up to doing today. I firmly believe that having a program remove things like this is likely only going to cause more problems. Simple deletions and registry fixes are what have kept my machines running beautifully for years. Thank you so much for your professional and effective help. Brig. Gen Jolliver

By Debugger on Aug 7, 2008 | Reply

The word as I’ve seen it on removing AntiVirXP08

This particular piece of Spyware/Trojan is propogating itself through video codecs. It is quite unlikely that you will get it from a web page unless you have your security settings set very low. Video Codecs that have been hacked however are run in Memory when the codec is automatically installed due to the request from a video stream, MPG or WMV file, etc…

The Trojan installs itself in a randomly named folder. It initially runs a file called “scan.exe” that it then renames at runtime so that you cannot find it.

It also uses Mark Russinovich’ Sysinternal Blue Screen Screensaver. Mark wrote that screensaver years ago, and it simulates a Windows Blue Screen, with actual operating system data on it. It renames these files in your system32 directory. Like I said, look for files with current modified dates and odd filenames.

BTW … whoever said to delete SHLWAPI and WININT … Never remove those unless those files are infected. This trojan doesn’t directly modify these, however, if it downloads a virus, they could end up infected.

IMMEDIATLEY TERMINATE any unusual applications/processes that you can see in task manager, especially those that you don’t recognize. If you cannot run Task Manager, then download the debugging tools for Windows from Microsoft’s site and use TLIST.EXE to get a list of running processes. You can use KILL.EXE to terminate them. (this is how I do it, as I still prefer a command prompt). I understand that many people won’t know one process from another. All the more reason to have the Windows Debugging Tools on your machine. Use TLIST and save the output to a text file when your system is running normally. You will have a reference to look at when you have problems.

If you have the Debugging Tools for Windows, use the TLIST utility as follows…

Find the .SCR file that the trojan planted in your System32 directory. Use tlist to search for that module loaded in memory…

TLIST -m randomname.scr

TLIST will show you that SCAN.EXE or some other Executable has it loaded … SCAN.EXE was probably the randomname.exe.local file that was in the randomly anmed folder under your %program_files% folder. After identifying the module that has the randomname.scr file open, use the KILL.EXE utilty… “KILL SCAN.EXE” (or whatever executable has the module loaded). This will cause the scan.exe program to abort and release the handles on the two files in your system 32 directory. You can now delete those.

I don’t run spyware detection software on my machines ( I DO run eTrust Anti-Virus, but I’ve never had a virus on any of my workstations or servers), I merely keep the “Debugging tools for Windows” on it, and I have very extensive knowledge of the operating system. Most people don’t so BE CAREFUL and do your homework.

Look for files that were modifed the day (even the hour) that the problems started occuring. go to a command prompt (Start->Run, “CMD.EXE”).

Follow the instructions mentioned prior on the Windows Policies (using Regedit), you don’t need to change them to “0″ unless you want to be able to restrict the system at a later date, you can just delete those entries.

Kill the trojan’s files in the random folder under program files.

Clean out any unusual RUN entries in the registry, both in the Local Machine Hive and in the Current User Hive. They are under software\microsoft\windows\currentversion\run

If you were runnign as an administrator, it is possible that it was able to modify values in the other user’s hives on that computer. Just search for the filenames that you had already identified.

I don’t know if the Trojan does any COM registrations, I didn’t look.

This essentially cleans it up. There was already a lot of advice written on this, but since there were more recent requests for help, I figured that I would throw this together real quick. The trick on this is to eliminate it ASAP! Every time that this thing runs, it will download more friends … and then you will hve 20 to 40 times the work, to the point htat it would be more timely to flatten the box and re-install.

Of note … Always, keep a 2 or 3 week history of “System State” backups for your machine. In case you whack something fromthe registry, remove a critical file, etc… you can restore as long as you can boot and log on.

By Adam on Aug 7, 2008 | Reply

Great, sounds like fun!!

By Jerry on Aug 8, 2008 | Reply

hey debugger, i’m trying to follow your instructions on wat to do, but i’m hitting dead ends. for one, to kill ne of the trojans recently updated, my search function doesn’t look up all my files, just w/e it can find in 5sec or less. not only that, my task manager is shut off and tlist.exe shuts off immediately after i initiate it. can’t figure wat else to do other than hope and pray it doesn’t spread too fast..got this bugger bout 25hrs ago. dunno if it’s still early or just too late. get back to me asap plz

By Daniel on Aug 8, 2008 | Reply

These steps suck this is not how you do it. You need to search the registry for the word antivirus and delete all the entrys that have AntiVirXP08. Then you need to search the registry for what ever name it named itself in my case it was RHCR22J0EJFT. Delete all the entrys you find with that name. You then need to delete the folder in %root%prgram files AntiVirXP08. Also do what the instructions say above. Its a beast to get rid of.

By Kristi on Aug 8, 2008 | Reply

Daniel?

I got the same message you got….

The application has failed to start because SHLWAPI.dll was not found, Re-installing the application may fix this problem.

…how did you get it to start again, so you can go through the steps to remove?

Mine just shows that message and then restarts over and over.

Thanks.

By Lucas on Aug 9, 2008 | Reply

Hey this is a huge help, however once i changed the background and screen saver my icons seem to like to have kept the same blue background color surrounding them. What should I do?

By meeshell on Aug 9, 2008 | Reply

I have a message as my wallpaper saying I have a virus and need to install some kind of antivirus or spyware remover program on my computer. The tabs in the display properties to modify wallpaper and screen saver settings disappeared. How do I get that back?
Should I just buy a new PC?

Thank you,
Meeshell

By Marika on Aug 9, 2008 | Reply

removing the background picture is easy.

This is a bmp file (image) and once you find the file name and location, just delete this file.

To find out the image file name, right click on the desktop
and then click properties.

on the Display properties window, select ‘desktop’ tab. On the backgrond list, you’ll find the file name

By Marika on Aug 10, 2008 | Reply

Meeshell,
You do not have to buy new pc. Read this entire page. you have a solution here.

By 420 on Aug 10, 2008 | Reply

I Need Help I Need Step By Step Instructions On How To Remove AntiVirus XP 2008 I’ve Tried Everything N It’s Still Here I’m About To Slam My Work Computer To The Ground If THis THing Keeps Popping Up

By sarah on Aug 11, 2008 | Reply

I had this problem just then, I downloaded a torrent…silly me. Im not going to donwload ever again…and the virus took over…it wouldnt let me change my background….it was frustrating. My wallpaper was a big YOU HAVE A VIRUS DOWNLOAD NOW. So i restarted my system in safe mode… and then windows help appeared and suggested if I couldnt find the program to restore to a certain time…i forget the name but I am sure someone will correct me. I restored to this morning before I attempted to install and when it was done ( Didnt take that long) It opened up and IT WAS GONE and none of my files had disappeared either. So happy now!! yipee

By Lisa on Aug 11, 2008 | Reply

I contacted by antivirus provided (Symantec as I have Norton) and paid $99 for a virus expert to remove it and all the associated files, and believe me, there were PLENTY!!!

By Tomassito on Aug 11, 2008 | Reply

Yeah, I can’t get the Blue screen to stop playing (HIT ENTER to go back….) and the desktop has no mode for removing that thing on my desktop…..
Can’t even see it in Processes Running under Task Manager….I removed everything I could find too. DAMN!!!!!

By Tomassito on Aug 11, 2008 | Reply

….System Backup not working either………

By Tomassito on Aug 11, 2008 | Reply

It works……….Robbie B. and Rudi G.

AWESOME !!!!!!!!!!!!!

By Sammynodrive65 on Aug 12, 2008 | Reply

If you don’t terminate the program (ctrl+alt+delete = task manager = end process) before running SpyHunter, the AntiVirXP08 will still be present. And afterwards, SpyHunter doesn’t see it because the only items left are the .dll files, application file and the uninstall program file. Once you terminate the program / process, you can delete the files.

Got the bloody thing from a video codec not updated message.

May the fleas of a million camels infest the nostrils and anal cavity of the SOB who started this!!!

By co2 Dog on Aug 12, 2008 | Reply

Thanks for the help removing all the files and registry issues but I still have e-mails generated and sending to my SMTP port. The service closed because of spam detection and I can’t send my mail.
I found the entries in the start up that messes up the screen and killed all of these. The files should be gone too. I tried to unregister the dll’s but I get an error message stating that the dll’s are loaded but the unregister entry can’t be found. Is this because the files are gone? The message states that the dll cannot be registered.

My real problem is stopping the e-mails. How do I do that?

Thanks
CO2 Dog

By Tim S on Aug 12, 2008 | Reply

had this problem hit me 08-10-08.
Removed all the files but one keeps returning to the Registery.
KDCKF.exe
It also reappears in windows/system32 folder.
have used Tuneup Utilities to delete it, but it returns. and now EI7 sometimes will not search or still gets redirected.
tried to look for the file on the web, but i get IE7 cannot display this web page.
Like its been blocked from the search engine.
ANY ideas how to remove it permanently.

By Tim S on Aug 12, 2008 | Reply

correction to my last post. Tuneup Utilities says it is in Windows/system32 but i never can see it , like it is invisible.

By tim on Aug 12, 2008 | Reply

I have the same problem as Lucas

Hey this is a huge help, however once i changed the background and screen saver my icons seem to like to have kept the same blue background color surrounding them. What should I do?

By Marie on Aug 12, 2008 | Reply

I had this on my computer also. It had the blue screen and no no screen saver. My friend came over and fixed it and had it back to normal in 30 minutes. I will ask him what he did and will post it.

By Hanon on Aug 13, 2008 | Reply

hi guys
I’m japanese, and I have a same trouble here!
I am fighting with Anti Vir XP 08 for a couple of days…I’m very tired. ;(
Norton Internet Security don’t help me though it was expensive.
there was no solution in Japanese…so I gonna try
to follow instructions above, but if I couldn’t fix my computer, plz help me!
I’m afraid that there are some differences btw your computers and mine..(mine is not English.)

thanks

By KJ on Aug 13, 2008 | Reply

First, THANK YOU for all the info on here. I followed it and it worked. That %$^#@# of a virus is gone. My only remaining problem is I can’t get into the other two user accounts on XP. When I type in the password for say, my son’s account, the screen flickers and goes back to the screen with my 3 user accounts. My account is the only one that works. I’m assuming it’s a registry issue but I have no idea where to look. Any help would be greatly appreciated. Thank you.

By tdv on Aug 13, 2008 | Reply

Tim S,

KDCKF.exe may be one of its variant names. Mine was named “KDKIE.exe.” Download and install Threatfire and run a basic scan. You will see the file in the System32 folder, and Threatfire can even quarantine it. However, it reappears after reboot. Symantec and most others do not yet seem to detect it, although they will probably catch up soon.

If you want it out today, you must use either a BartPE or ReatogoXP boot cd. ReatogoXP is easier for me. You will need to build Reatogo using another uninfected XP computer and the Reatogo software, which you can download. Boot Reatogo, browse to the C: drive, which Reatogo should mount automatically. Go to your System32 folder and delete whatever filename Threatfire’s scan showed as a hidden file (mine was KDKIE.exe). Then go to Reatogo’s registry editor in the start menu. Load the remote registry for whatever username you wish, and check the box to load all remaining users.

In the registry field, perform a search for all keys named KDCKF.exe. Delete them all, EXCEPT FOR THE SYSTEM KEY WITH DATA = KDCKF.exe (or kdkie.exe, or whatever). The full path to this key is:

My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\
Microsoft\Windows NT\CurrentVersion\Winlogon
\System

Instead of deleting the System key, right click and choose “Modify.” Then erase the Value Data field, as it should be blank. Click OK.

This should give you a clean system. One final note, as I was searching my registry for KDKIE.exe, there was one subkey value where KDKIE and one other “KDK**” (I don’t recall the exact name) were the only values present. I deleted the other KDK** entry as well, as it appeared suspicious. Keep your eyes open for another KDK value like this.

By Themechanic on Aug 13, 2008 | Reply

Check your userinit program to be sure it hasnt been compromised. I have seen this several times.
here is a snipit
Win XP Winlogon settings! I’ve read through all of the threads about resetting the registry to point to the right file in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
with the userinit being set to \WINDOWS\system32\userinit.exe (it is a 24,00 byte file) but I still can’t login to either admin or user account.

By co2 Dog on Aug 13, 2008 | Reply

Well no one seemed to know a solution to the sending of e-mail by the virus so I kind of gave up.
I tried the XP check point restore and went back to the Friday before the stupid act of clicking on the CNN Alert link.
IT WORKED!!!! MY files and documents are all current but my programs, registry, boot, etc. are all back before the disaster. The XP restore really worked.
Gates and company really did something right.
By the way, an MSNBC Alert virus is out thesre.
Co2 Dog

By Lyza on Aug 13, 2008 | Reply

How do I get ride of AntivirXP08? I have tried several things and I can not remove it, please help!

By Surya on Aug 14, 2008 | Reply

Guys, I just can’t find “RestoreOpenIsSafe” in My Regedit, so can somebody tell me where is the location exactly so i can create it manually.
Regards,

By Donna on Aug 14, 2008 | Reply

Also showed up on my work computer this morning. Tried to delete, and it wouldn’t go away. Got the blue screen, what a scare. Restored back to yesterday and so far so good. No trace of it.

By Luke on Aug 14, 2008 | Reply

Ok… so in a nut shell, a customer of mine was infected with this AVXP.

I might be able to provide a strong ground of how to remove it. I will provide a complete list of manual instructions on how to remove below.

System Platform: Windows XP Professional

1. First, boot yourself into SAFE MODE WITHOUT network support.

2. Open the Add or Removal Programs. Uninstall the Antivirus08 that is in there.

Note: That when uninstalling it after trying some removal attemps, it re-installs itself again into your system. The removal may take 2 attemps, but it will ultimately get removed. Remember, only remove it in safe mode.

3. Once uninstalled, do a CTRL+ALT+DEL and select Task Manager and check your processes. There will be 1-3 .EXE processes that are running which is related to AVXP. They are usually a combination of numebrs and letters, about 10-12 characters (p4djh4dkjd8.exe) or something like that. WRITE DOWN the exact file names as we will need them later. End 1 or more of thoes processes. Close task manager.

4. Click start and select RUN. Type in MSCONFIG

5. Goto the STRATUP tab. In that list of item, scroll to the bottom and look for any strange file references. Most times, it will be in the last 8 entries and usually pointing to \Documents and Settings\All Users\Application Data\——–.exe … or something out of the sort. There should be nothing running from an ALL Users application folder, or Temporary Internet Files section. Once located, uncheck the fishy startup items and click APPYL then OK when done. DO NOT REBOOT at this point even though it asks you to right away.

6. Open up the My Computer and navigate to \Program Files. In here, there is generally 2 folders start with either R P or S with very stange folder names (Rh345kkjuelsh34) or something, look through and you will notice them. Select one of all of the garbage folders and delete them. (Tip: If you hold the shift key down when you delete, it doesn’t get sent to the recycle bin, they are gone for good).

7. Next, open an Internet Explorer window and get yourself into Internet Options. Delete ALL history, cookies and temp files. Once complete, click on the “SETTINGS” button in the “Browsing History”. Set the MB size to 8 (which is the min). Click OK. Now, goto the ADVANCED TAB and scroll almost to the bottom so you are looking at the “Security” section and ensure “Do Not Save Encrypted Pages to Disk” and “Empty Temporary Internet Files”. Save and close changes.

8. Click start and select Run. Type in REGEDIT.

9. Click on “COMPTUER” at the top of the tree. Now click on “EDIT” in the file menu and select FIND. The file names you are looking for are the ones you wrote down in Step 3. DO NOT type the FULL name of the file rather the first 5 characters as the files are constantly changing names. There will be any where from 3-12 entries for EACH of the file names you wrote down. Once it has has found a registry key with that name, delete it. In some cases, the name of the registry key it found will not be the name of the file you have searched, rather the value inside of the key. Delete the file it has found regardless. If you wanted to double check before delete, simply double click on the file it found and little box will open up displaying information, which will be the fiel you are searching for. Press F3 to keep searching. Repeate this process until the entire registry has been searched. ENSURE that when you search for the 2nd and 3rd file that you scroll to the TOP of the left hand pane and click on “COMPUTER” at the top so that it searches the entire registry. If not, Windows will search in a cascade order and start in the last folder you were in (which will be near the bottom of the list).

10. Stay in the registry and search for ANTIVIRXP … it should find many values for this entry. Since this virus takes on many forms of ANTIVIRXP08 or ANTRI VIRUS XP 2008… search different names for it. Please note that if you already have virus software in there, that it MAY find your legit stuff, becarefull not to delete keys for it. Close off the registry once complete.

11. NOW, before you exit safe mode, open your Spyware and Virus dection software and do complete scans. Delete anything that comes up.

12. Restart the machine normally and all should be well.

NOTE: SOMETIMES, after all that, when you open up Internet Explorer, a Re-Direct will still be in setup to initiate the AVXP08 stuff again… the Information Bar may come up… etc. At this point, AV08 is not full blown, rather, in your system still but in a dorment state for the more part and ready to start all over again if you click on it. So, this is where I would suggest trying another anti spyware program for removal.

Hope this helps.

By Ritvars on Aug 14, 2008 | Reply

check task manager and end process of antivirus xp 2008 who’s image name is braviax.exe…
then from safe mode find it in windows and delete…;) Thats how i did it..:))

By Ritvars on Aug 14, 2008 | Reply

If you need help…then write me on e-mail: Richus125@inbox.lv

By Deron Ruben on Aug 14, 2008 | Reply

The Simple Way Is To Get Spyhunter’s Spyware Detection Full Version (Whether You Get It Legally Or Illegally It Will Remove It) Ive Used That Software For Many Of My Clients. This New Antivirus 2008 Thing Is Getting Popular I Have A Least 5 Customers A Day With This Problem, And Spyhunters Spyware Detection Always Work.

By mike on Aug 16, 2008 | Reply

how do i change that stupid background that says i have a virus, once i’ve removed everything else.

By tara on Aug 17, 2008 | Reply

LUKE
in your step #9 you said:

“In some cases, the name of the registry key it found will not be the name of the file you have searched, rather the value inside of the key. Delete the file it has found regardless. ”

so i put in the file names and clicked Find, but there are dozens of other files that come up and im not sure if i should delete them.
even if i double clicked on them there’s no info that shows that its part of the virus file name or whatever it’s called

and i think the virus deleted some of my display options becuase i dont have the “desktop” or “screensaver” tabs anymore
so i can’t change my background, which says i have to install a program
Is there anyway to get that back?

By Jim on Aug 17, 2008 | Reply

Hi. I have been battling the same bug on my Father-in-law computer. I have not as yet succeed. However the blue screen you mentioned is part of their programming to ‘fake you out’. Whatever you were doing will continue to run in the background. Simply hit the ‘esc’ key and that will knock out the ‘fake you out’ blue page which goes into a loop with the black page XP.
Hope this helps some.
I plan to re-format if I cannot get it out some other way.
Jim

By Luke on Aug 18, 2008 | Reply

Tara:

In regards to the registry keys, if you used the EXACT file name when doing a resgiry search, and there is no string information in the keyt it found, probablity says that it was related to the virus. Keep in mind, we uninstalled the virus previously and I am sure that not ALL registry keys are removed. So, the values you are finding are garbage and can be removed.

Regarding your Screen Saver and Desktop issue, here is how to bring that back (Rudi posted it up above)

Open the registry and navigate to:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System

There is 2 values there…

NoDispBackgroundPage and NoDispScrSavPage

…modify them both by changing the value from 1 to 0

Thx!

By Luke on Aug 18, 2008 | Reply

Here is an update to my previous post…

I purposly infected a computer with the AntiVIRXP 08 virus with a complete log tracking system to see exactally what it damages…. and found the following works great to fix it. No software needed. You can have it fixed in about 5-10min.

1. Boot the computer into SAFE MODE
2. Uninstall WinAnitVR XP 08 from your add/remove list.

Note: Don’t flip if the uninstaller doesn’t work… mine didn’t. We will manually remove it.

3. Open My Computer and navigate to the follwing directories and delete them.

C:\Program Files\rhcedwj0ecev
C:\Program Files\pphcadwj0ecev

4. Click start and goto RUN. Type in MSCONFIG

5. Remove rhcedwj0ecev.exe and pphcadwj0ecev.exe from your statup items. Apply the changes and DO NOT restart yet.

6. Click start and goto RUN. Type REGEDIT

7. In the registry, ENSURE you are the top of the list (Computer is highlight). Click EDIT and then FIND.

Type in wj0ecev (the 0 is a zero). Search the registy and you will find a dozen items matching this name.

Note: The virus file name has “wj0ecev” as it’s consistanty, the “pph” and “rhc” etc… just keep changing.

8. Do a new registry search and put in: AntivirXP. Remove any and all instances of it in the registry. Close the registry once done.

9. Open the My Computer icon and do a search on your Hard Drive for: wj0ecev

Removal all files associated with this file name. Close once completed.

10. Ensure that ALL of the Temp internet files have been deleted.

11. Restart normally and remove any/all icons on your desktop/start menu that AntiVIRXP created.

Last, if your desktop screen has changed and your “Desktop and Screen Saver” tab is gone, use my above post (at the end) to modify the registry key to get it back.

Thanks!

By Soma on Aug 19, 2008 | Reply

Hi Luke,
Thank You very much for your instructions.
I have successfully removed this virus and got back to my original computer settings.

Thanks for your time to post such clear instructions.
Vandana

By Nick on Aug 20, 2008 | Reply

Thanks Luke and everyone who helped by posting instructions to get rid of this darned virus. I do have a problem that still persists however. I will go to the registry and modify both NoDispBackgroundPage and NoDispScrSavPage from 1 to 0. But when i turn my computer back on the familiar “warning virus…” background reappears (the program doesn’t run fortunately). I thought to have removed all the antivir xp files, perhaps I’m still missing a few? Any help? Also I noticed the screensaver I get is a similar virus warning notice…

any additional help would be great. thanks.

By Amanda on Aug 21, 2008 | Reply

Thank you soooo much Luke… after reading many posts and comments I thought your post’s on August 18th were quick, easy, and extremely helpful. I dont know if anyone has commented but when you write to search for “wj0ecev” as the virus file name, mine was a bit different. The file name on my computer ended with “fc0eeov” or something like that so I think it depends from computer to computer. Ad long as you find the file under Program Files and see what the last 7 characters are. Ok well thanks again for all the help!!!

By Robert on Aug 22, 2008 | Reply

I had both the XP Anti Virus, and blue screen infection…I removed all registry entries as indicated, tmp files, vbscripts, etc., but now, when I log on, the computer restarts without the blue screen, and when you log on again, it goes to the blue screen and locks….

Any ideas if I missed something?

By Trei on Aug 22, 2008 | Reply

This is the most annyoing Program I have encountered in a long time. My firend brought this PC to me to fix it. Without this Board it would have been very difficult to fix it. Thanks to everyone. Follow, Luke’s instructions and work on Safe Mode. After that, run Spyhunter and Malware. That should take care of all the problems. Windows functions that you have lost, you must fix those with registry access. Or you will have to repair the existing windows installation with a windows OS CD.

By Lisa on Aug 22, 2008 | Reply

Luke, I changed the NoDispBackgroundPage and NoDispScrSavPage from 1 to 0 and it didn’t change the desktop screen. I still have the “Spyware detected” screen on my desktop. Any suggestions?

Thanks so much!!!!

By Lisa on Aug 22, 2008 | Reply

Luke,

Thanks so much! You instructions worked great. The file names weren’t exact, but you provide more than enough information that I could delete the virus.

However, I can’t get the desktop screen to restore following your directions on setting NodispBackgroundPage and NoDispScSavPage to 0.

Thanks so much for your help!! You’ve made my weekend!!

By Anonymour on Aug 23, 2008 | Reply

Yea man i got rid of antivirxp08. I checked in add/remove programmes and its not there. But it still pops up

By Arne on Aug 23, 2008 | Reply

Hi, I bought to SpyHunter software and it removed the virus. However, I have also tried to follow the advice to change values from 1 to 0 in regedit without that helping much… next time i start my computer its back to 1. I also have a problem that the Start-menu disappears and the desktop/background goes blank. Anyone who have the same problem? Cheers

By Winter on Aug 25, 2008 | Reply

hello!!
i have read all post and i have yet to fix the problem.let me explain what i did …..
as soon as something installed itself in the pc and said i had 10,000+ virus i knew it was a virus i automatically when to control panel to remove it .This did not work so i went stray to program files on my pc and saw some strange folder with r…. fits the description perfectly i deleted this file and any other file that i could find relate to this virus.
then i had the bright idea to look on the net what it was and so i saw this =D it has help me a lot but i believe the virus is still in the computer i tried finding all files related and all of the files you guys tell me to delete are not there. i finally was able to restore my wallpaper by following all these steps. i am running my usual anti virus programs i.e. avg and adaware but neither of them is able to run smooth.
i now am able to work on the computer but i keep on getting fatal errors so far these 3 come up:

page fault in nonpage area
bad_pool_header dump_atapi.sys
no more irp stack locations rdpdr.sys & acpiec.sys

i am starting to give up.. what should i do??

buy antivirus or restore all of computer??

please help me i will greatly appreciated =D
THANKS AGAIN FOR ALL OF YOUR PREVIOUS HELP

By tugger on Aug 26, 2008 | Reply

Thanks Luke. Spot on, worked like a charm!

By Nit on Aug 26, 2008 | Reply

Thanks Luke. I was able to get rid of the virus as per your instruction, but still
I couldn’t found the NoDispBackgroundPage and NoDispScrSavPage either and other method typing -RestoreOpenissafe doen’t work either. Is there anything else we can do?

By Matt on Aug 27, 2008 | Reply

well the way i got rid of bloody Antivir Xp 08 was i just searched through my program files to see if there was something fishy. Funnily enough there was a program file which was a bunch of random numbers and letters. So then i looked in ctrl alt del under processes and there was the same process as the program file name, and so i terminated the process, deleted the program file and then did the whole change regestry thing so that i could get my background and screensaver back!

By Colin on Aug 28, 2008 | Reply

First of all thanks to Luke for the fix. Although on the computer I fixed the important part of the file name was j0e7dl

Also downloaded Adaware 2008 and that found other bits and pieces.

As for the NoDispBackgroundPage etc change value to 0 as Luke says but just in case you don’t realise it you need to reopen properties by right clicking on your desktop and you can now see the desktop and screen saver settings tabs. Just choose a different one for each and the it has gone.

All the best it is a real SOB to get rid of.

By MS on Aug 29, 2008 | Reply

After getting rid of all the other stuff, finally managed to get rid of the ‘Warning Spyware detected’ window.

Search for a .bmp image with a funny string (eg- p4djh4dkjd8)and delete. Check your desktop background setting and reset if needed too.

By Matthew on Aug 31, 2008 | Reply

THANK YOU!

Blessing to all who contributed to this blog, many thanks to Luke for the fixes.

I took a slightly different approach than the workflow presented here.

This antivirxp08 is very nasty. In addition to the issues posted here it also removed my restore points and continually redirected my browsers (IE and FF). The impact being if I had only one computer I’d be stuffed.

First, the operative 7 characters of my nasty was 0j0evde.

1) On another computer I downloaded Malwayrebytes’ Anti Malware.

2) Put on usb stick and installed on the infected machine, updated the signature database.

3) Booted into safe mode and ran MAM, took almost for hours for a comprehensive scan, found over 50 items; MAM deleted and quarantined.

4) Went through Luke’s August 14th workflow (listed below). Interesting to note that even after MAM there were still 0j0evde and antivir items in the registry. Also found a *ojoevde.scr* item in the prefetch. Followed the workflow and deleted everything.

5) Rebooted . . . et Voila! Nasty Gone!

So far so good. I’m continuing to run a few scans from various malware apps just to make sure.

Thank you everyone!

By graham on Sep 1, 2008 | Reply

i got caught with this but managed to delete it with help from here, however, im still getting page redirects in firefox, and a website blocker for obviously safe websites, like wikipedia, how can i stop these redirects and page blockers

By Ingela on Sep 2, 2008 | Reply

Thank you so much for the help. Filename changed to rhcp3uj0ep3o in my case but Lukes description on how to get rid of the file was totally on point! Much appreciated.

By Misty on Sep 2, 2008 | Reply

Thanks a million. At first, it took me forever to figure this out. It took me about 5 hours today but I think I finally got this little bugger off my computer. I have been freaking out! I am an online student and couldn’t use adobe or internet at all. This virus was on my computer because my husband and brother went to flickpeek. com and tried to watch saw 4. It did not get downloaded, however, I am not sure how it ended up on here. I am confused about one thing though, what does the RestoreOpenIsSafe thing for? I found it but don’t know what to do. Other than that, once I found the posts you guys left, I figured it out and got it taken care of. The instructions on the top is what I started using. Then, being the blond I should have been born as, I scrolled down and found what Luke and others have said. Thanks a million Luke and all others who have contributed. I didn’t have the luxury of money to buy any program that would knock that out.

By Shane on Sep 4, 2008 | Reply

I for the life of me can not find the registry files to return my desktop back to normal

By Christine on Sep 4, 2008 | Reply

Hi all, what a bugger this thing is. Just got attacked last night, not by downloading a video but by simply clicking on a website. (I had googled my business name and saw it come up on a site I didn’t recognize but was titled something reasonable — I clicked over and the antivirxp stuff started up. Evil.)

Luke, thank you so much for your clear instructions — totally on the money and I have all but one thing fixed (more on that in a second).

Meanwhile, for those who are having trouble finding the NoDispBackgroundPage and NoDispScrSavPage: it may be because you need to look in another subfolder. I ended up finding those files on the 4th folder attempt (under My Computer, I have 5 subfolders…). So keep looking. Changing those values fixed the problem immediately for me.

Also, for reference, my two antivirx files *ended* with the values “jj0e713″

Finally, the one problem I am having is that I can no longer get into Internet Explorer. I deleted all the temp files etc. per Luke’s instructions, but every time I try to launch, I get the “IE has encountered a problem and needs to close…” msg. This msg also pops up periodically when I haven’t clicked on IE, which makes me think antivirxp is still running in the background, trying to auto launch somehow?

Has anyone else encountered this? Any fixes to suggest? Thanks!

By Tal on Sep 4, 2008 | Reply

Luke – probably for you (help much appreciated!)

I removed the “virus” – hopefully it’s gone. However, I haven’t been able to recover from the following damage (this is what I found so far):
1. All restore points were lost – furthermore, unable to create new restore points.
a. Is there a way to “revive” those old restore points?
b. What do I need to do to get system restore to work again?
2. Skype configuration got corrupted – file unreadable.
3. uTorrent list of files and status corrupt – so it cannot really work any longer.

perhaps there are other corrupt files. It is suggesting “chkdsk” – but that may not recover everything correctly.

Any ideas?

Thx.
Tal

By None on Sep 7, 2008 | Reply

Hm. I seem to have a bit of a problem. The virus seems to be responsible for ugly black margins that have appeared on the sides, half an inch or so on both the left and right sides, and half a centimeter or so on the top. They aren’t just on the desktop background, my screen has essentially shrunk. It would be nice to know how to get rid of them. Thank you.

By E. J. on Sep 22, 2008 | Reply

Followed Luke’s August 18, 2008 posts (Many, many Thanks). Look for also, aj0ep4h. Saw three iterations: lphccaj0ep4h, Smrhc9eaj0ep4h, and rhc9eaj0ep4h.
Question: I still see an unexplained Microsoft Visual C++ Redistributable program that was installed ont he date of infection and it cannot be uninstalled. Help??

By Luke on Oct 2, 2008 | Reply

Haven’t checked back in awhile.. but just wanted to say “You are welcome” to everyone my Aug 18th post helped out!!!

Based on the comments, I guess the file names do rotate. It seems that in all cases there is a consistance factor to the file name convention, just look for it and removal any/all instances of it.

Regards,
Luke

By bala on Oct 4, 2008 | Reply

I did above mention all but still my system srestore point not funtion on earlier date pl. some give the idea

By Scott on Oct 5, 2008 | Reply

I cannot get past Change/Remove stage (step 2) in safe mode. When removing the stinking virus it brings up box that states “uninstall.exe has encountered a problem and needs to close, sorry for inconvienence” Thats been going on for twenty minutes of trying..any other way to remove this *^#+@)!+ ????

By James P. on Oct 27, 2008 | Reply

I have deleted all the contents I can find of this thing. Although, I still get that annoying pop-up! how to delete? Please,I need help.

By douda on Oct 28, 2009 | Reply

thank u really i need it

By bhavesh kumar panchal on Jan 17, 2010 | Reply

hi good

By Holly on Mar 3, 2010 | Reply

Hi Luke…was reading this information tonight but today I spent $139 to get Norton to remove this mess from my computer and to clean it up. I thought it was rather expensive but had many viruses/trojans (or so the window said). Don’t know if calling Norton was right thing to do or not considering what it cost but puter is running great. Any thoughts on this?