Maybe one of those factors is different on yours which is why you don’t get the “Run as…” option in Explorer. Or maybe you didn’t follow my instructions properly.

If you can’t find the “System Restore” application file called rstrui.exe in folder \windows\system\restore, try using Explorer’s “Search” facility, or see if you can get a copy of it from some other PC, or off the internet.

If running System Restore doesn’t get rid of XP Antispyware 2010 this can only be because the date you restored to was LATER than when you got infected. Choose an earlier date.

Wanted to ask whether after restore the XP Antispyware 2010 will be completetly gone from the system?

UNCHECK the “Protect my computer…” option, run the program as current user, and restore to the latest available date before you got the virus.

AND it changes several registry settings controlling how Windows actually runs ANY programs. In fact these malicious changes just make Windows run av.exe regardless of which program you’re trying to run.

If you find and delete all copies of av.exe, Windows behaves really oddly because mostly regardless of whatever you actually wanted to run, Windows still tries to run av.exe, which no longer exists!

THE SOLUTION (for me with WinXP, at least) is to right-click the program file you want in explorer, and use the “Run as…” option. YOU MUST uncheck the “Protect my computer…” option, and run the program as current user.

Obviously the best program to run is System Restore (filename rstrui.exe, which on my system was in \windows\system\restore). Using the “Run as…” method described above, I ran it and restored back to last night, then rebooted – all in less than a minute, after which all problems are gone.

Anyways, thanks for the help!

Thanks so much Daniel A

1) You can’t stop the process AV.exe is running in because you can’t start task manager.
2) My ZoneAlarm was halted via a registry update I found in my C: directory. That meant I no longer had any control over incoming or outgoing processes on my PC. So I disconnected my LAN cable.
3) You can’t run most executables, particularly by double-clicking. What you can do is rename or copy some of them to .com extensions. The virus redirects .exe extensions, but not .com. Also, you can right click on file icons and there is a start option you can use to make programs like regedit run.
4) You can’t delete the av.exe file because it’s “in use”, but you CAN rename it. When you restart your computer, it then can’t reload. The location is exactly where this article says it will be.
5) The guidance to use Safe Mode to turn off system restore before doing the registry edits wasn’t useful because I couldn’t get into the System Restore settings even in Safe Mode. Executable function and system tools were still blocked in safe mode.

Once I renamed the executable and restarted my PC, I forced the ZA client to restart. I scanned the system and had the file that originally loaded the AV trojan quarantined. Then I did the registry edits listed above. That cleared up my infection.

Pay attention to the MS article Shawn refers to. That will allow exe files to run again.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = c:\Program Files\Internet Explorer\iexplore.exe

Firefox and IE will now open.

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*”
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*”
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*”
HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “av.exe” /START “iexplore.exe”

But we just deleted it all and didn’t do it right and now she can’t run firefox and IE and can’t even run the registry in start run. We also can’t open any .exe files!

ANY HELP WOULD BE GREATLY APPRECIATED.

I’m in the same boat as the above guys. Sahwn’s solution worked for me and I can now run regedit from the the Run… comand but I can’t run any exe file it just brings up the “open with” window. I’m assuming one of the other instructed regestry entries to delete needs a proper setting. Can someone post the default value for all of those?

Many thanks in advance

Nish – With regard to Shawn’s comment, I couldn’t get that to work either. I couldn’t get the command to work to copy regedit.exe to regedit.com, so I just changed regedit.exe to regedit.com and then I was able to open regedit.com and fix the registry. (regedit.exe was auto-re-created for me) Hope that helps.

I followed all of your directions above completely and when I got to the delete registry files, I clicked on the “Read more how to delete XP Antispyware 2010 registry entries” link below that section because I didn’t know how to do this before. I did all the way through step D. After that it talks about adding a new value or new key… am I supposed to do any of this??

Thanks again for all your help! Those pop ups for “XP Antispyware 2010″ were making me nuts!

Now if I could just become a computer genius! =)