Comments on: Remove Antivirus 2008 Pro Fake Antivirus

By: Chris

Chris — Tue, 20 Jan 2009 04:33:13 +0000

Thanks, those steps above works on my laptop.

many thanks once again

By: Anthony

Anthony — Sat, 30 Aug 2008 20:41:02 +0000

I’ve been infected with antivirusxp etc. and I can’t download any of the removal programs. I’ve managed to download AVG but antivirusxp is still there. I even removed a couple of the files recommended but the internet doesn’t work properly; manyk pages won’t open. I will keep trying. If anyone can suggest anything?

By: MrMmills

MrMmills — Sat, 30 Aug 2008 18:30:27 +0000

For those who know how a “hosts” file works (c:\WINDOWS\system32\drivers\etc\hosts), you may want to put in the following entry to try to avoid being infected again.
“127.0.0.1 updatesantivirus.com”

The install on my machine created the following path in the registery:[HKEY_CURRENT_USER\Software\31193903159077776455629754546541\Options] (the # may be auto generated so the # on your pc may be different.

The registry entry above had the following references:
[HKEY_CURRENT_USER\Software\31193903159077776455629754546541\Options]
“Aff”=”880582″
“AdvancedScanType”=”1″
“FirstRunUrl”=”http://updatesantivirus.com/firstrun.php?product=%product%&aff=%aff%&update=%update%”
“AfterRegisterUrl”=”http://updatesantivirus.com/confirm.php?product=%product%&aff=%aff%&email=%email%&update=%update%&cookie_type=%cookie_type%&cookie=%cookie%”
“LabelUrl”=”"
“TermsUrl”=”http://updatesantivirus.com/terms.php”
“HelpURL”=”http://updatesantivirus.com/help.php”
“BillingURL”=”http://updatesantivirus.com/license.php?Email=%email%&AffiliateID=%aff%”
“BillingUrlApproved”=”"
“TransactionKey”=”XsHrUGEutblgVFNM”
“BillingRegURL”=”http://updatesantivirus.com/order_xp.php?ver=%aff%”
“BillingURL2″=”"
“BillingUrlApproved2″=”"
“LastRun”=”8/30/2008″
“InstallDate”=”8/30/2008″
“pPath”=”C:\\Program Files\\XP Antivirus\\xpa_2008.exe”
“pName”=”XP Antivirus 2008″
“SecurityVector”=”222222222222222222222222222222222222222222″
“Scans”=”1″
“LastScan”=”30.08.2008 12:45:09″

I deleted the entire parent key and all subkeys (but as standard practice calls, I made a backup of the key first!)

[HKEY_CURRENT_USER\Software\31193903159077776455629754546541\Options]

By: Beny

Beny — Sun, 24 Aug 2008 17:53:01 +0000

10x a lot…it helped me:D:D

By: Kevin

Kevin — Tue, 19 Aug 2008 05:30:07 +0000

well i found it and deleted the files. but on the reged… i couldn’t find them afterwards….. and then i tried looking for them but no sign… but when i do msconfig…. i can still see it on my start up… the files of lphcaenj0e1fn and rhceenj031fn are still there…… im not sure if they are doing anything… but i rather rid of them from the start up part of my msconfig. but i just can’t find any trace of them… so why would they still be there? =X

plz help me =[

By: Smith

Smith — Sat, 16 Aug 2008 18:35:56 +0000

Sorry that file was “rhcgw3j0ej28?

By: Smith

Smith — Sat, 16 Aug 2008 18:35:11 +0000

I found the spyware in the processes and directory, not under the name noted, but under “rhcgw3j)ej28″. I also downloaded Malware and it found it also. I now have to complete the rest of your steps. Thanks.

By: Dave Felt

Dave Felt — Sun, 10 Aug 2008 04:15:47 +0000

These all helped, but did not get rid of the fake AntiVirus warning on the desktop. I found that in System32/phc970j0eef3.bmp and in the registry:

And also have several variations in the registry under ??phc970j0eef3.xxx (various extensions like .scr, .bmp and so on.)

I also hijacked the logon screen, and currently the default user logs on automatically, even though there are several users defined on the system and all have passwords. Still working on that.

Thanks!!

By: Dieliz

Dieliz — Fri, 01 Aug 2008 21:18:10 +0000

Juste dire merci
pcq ca faisait 2 semaine que ce WAV 2008 m embetait mais grace vos conseils je l ai eliminer juste en allant sur l icone dans la bar de tache en cliquant ctrl+alt+delete et je n arrivais pas a le voir mais je me suis concentree et je fini par decouvrir que c etait ecris WAV lol
bonne chance a tous

By: Luis

Luis — Wed, 30 Jul 2008 21:54:51 +0000

Gracias
… por su ayuda… buena suerte en todo..

By: Alex

Alex — Sat, 19 Jul 2008 17:03:02 +0000

Thank you so much for these step by step instructions! Avast antivirus did not catch this before it infected my computer, and I had been working on the whole antivirus thing all morning before I found this page. Now the whole virus is gone and (hopefully) the porn popups and crap have stopped. One thing, though, is that the program that infected my computer was not under the name mentioned in the instructions, but under VAV.exe.
I found it funny that I had “Vista Antivirus 2008″ when I don’t even use Vista. :]

An interesting thing I just found as I was typing the majority of this comment- some letters and spaces seem to have been deleted. Could this be part of the virus? Maybe the problem is the keyboard or my typing… but it seems interesting that I’m having problems now when I was not having any before the “attack” this morning. So, if there happen to be any errors that I have not caught, I am sorry.
Question… could this virus possibly affect the keyboard? I had turned off the insert function, but as I was just typing this, it turned itself back on!
Oh boy.