Digital Divide » Personal

Recently I’ve been seeing a lot of help requests for such malware which attacks mainly Windows XP PCs which are browsing the internet using IE 7. Av.exe is part of one of many fake antivirus programs, which include Vista Antispyware 2010, Antivirus XP 2010, Vista Internet Security, Vista Internet Security 2010, Vista Antivirus Pro, Vista Guardian, Vista Guardian 2010, Antivirus Vista 2010, XP Internet Security, XP Internet Security 2010, Win 7 Antispyware 2010, Win 7 Internet Security, Win 7 Internet Security 2010, Win7 Guardian, XP Antivirus Pro, XP Antivirus Pro 2010, XP Guardian, XP Guardian 2010, and XP AntiSpyware 2010. If you either have a av.exe process running on your machine or an antivirus popup notice of one of those fake “names”, you you will be most probably be infected with such a malware. You can even notice that, while trying to run .exe files that result with file not found error messages. That is because this malware is modifying your windows register in order to bypass .exe file executions and avoiding the user to execute mostly any kind of software program. Luckily for you this malware is as annoying as easy to remove. You only need to follow those steps:

Reboot your system in SAFE MODE
go to C:\Windows\ and create a copy of regedit.exe named regedit.com
Reboot your system in NORMAL MODE
run regedit.com
open HKEY_CLASS_ROOT .exe and change Default secfile with exefile
now you should be able to execute .exe files but still being infected by the malware: to complete the cleaning procedure you therefore have to download and run a scan with the free version of Malwarebytes that you can find here.

Share/Bookmark