Remove Antivirus XP 2008
Antivirus XP 2008 has been scamming many people off late. It installs on your pc shows false scanning showing that you have plenty of viruses and to remove them you will have to purchase the Antivirus XP 2008. Seeing this many people have already shelled out there hard earned money for this fake software. Besides this it also slows down your pc making it impossible to work. Well following are some of shots of this virus.
to remove the spyware (update) another option are this one: MaleWareBytes antivirus
Well if you have downloaded it from some website, here is the screen shot its website.
Browser Hijack by Antivirus XP 2008
REMOVAL PROCEDURE
1. Open task manager(Ctrl+Alt+Del) & kill the following processes by using right click in the following order(the exact names of the files will differ but they will be 12 character long. Also note the names of the files before deleting as at all places the variation of name will be there accordingly. Because of variation I will be using Virus1 for the first one and Virus2 for the second one)
- rhc1cdj0e12r.exe
- pphc5cdj0e12r.exe
2. Now open C:\windows\system32(Assuming you have windows installed in C drive) and trace Virus2 and delete it.

3. Next open c:\program files and find the folder named Virus1. Delete the entire folder.
4. Next delete all traces of Antivirus XP 2008 from desktop and start menu(shortcuts)
5. Empty recycle bin
The following steps require registry editing so follow them carefully. Improper editing could lead to system crash.
6. Go start menu->run-> type 'regedit' and press enter. Regsitry Editor will open up.
7. Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
Locate and delete virus1 using right click
8. Next Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Locate & delete SMvirus1 using right click
9. Now go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc1cdj0e12r
del key Virus1 using right click
10. Now
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
Locate 'AntivirXP08' on right side and delete it.
Now there is only one step left which can be performed only when you log in to windows next time.
11.Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\rhc1cdj0e12r
del key Virus1
12 Navigate to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Antivirus XP 2008
And delete the key Antivirus XP 2008
13 Now if your themes, appearance and settings are missing you can download small tool from here
Now your system is clean from this fake antivirus.
For any comments, questions or suggestions, please do comment in the comment section or click the contact me button above.Popularity: 5%
Written by magakos. Read more great feeds at is source WEBSITE
87 comments.
Read more articles on otherSoftware.
- [+] Digg: Feature this article
- [+] Del.icio.us: Bookmark this article
- [+] Furl: Bookmark this article
















#1. July 21st, 2008, at 12:06 AM.
Hi. I have to thank you for your help, you helped me about 99%. I have learned, after searching through forums for restoring my computer back to normal, that there are muliple versions of the same type of malware. For example i was taking advice from this site: http://www.windowsvistaplace.com/xp-antivirus-2008-removal-instructions-xp-antivirus-2008/spyware-removal , thinking that removal instruction are the same. I new that the picture was different but i figured that may be the malware has multiple versions of the same crap. Thank god i found your advice becasue it worked…but there is still only one problem. After following your advice step by step, i saw everything u wanted us to delete..and i deleted everything you told us to delete. Now the only problem that i have is the desktop backround. On my healthy computer, when i righ click on the desktop and select “Properties”, i get the option tabs, “Themes, Desktop, Screen Saver, Appearance, Settings”. On the “sick” computer just i get “Themes, Apearance, Settings”. I do not know if this happened to you, but once i got infected, it changed my backround to say “You have a virus” or something like that. After following your instruction, everything is gone, but the desktop with that stupid message remains, and i still do not have the option to change my backround.
After a little researching i found this:
NAME:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DATA:
“C:\WINDOWS\system32\lphcvw0j0en2a.exe”
This was all found in the Registry Editor. When i went to find “C:\WINDOWS\system32\lphcvw0j0en2a.exe”, i could not find it…i looked under the “L”, “I” and even “P” section of system32, i couldn’t find that “.exe” file.
My question:
Should i delete that registry file, specified above? The cautious side of me says it may screw up somehting on my computer…but another side says it is a registry file from the malware, since it has a very very similar name, if not the same.
If you can, please email me at, rtisma@gmail.com…your help is much appreciated
Rob
P.s…thanks so far!