Antivirus XP 2008 Manual Removal Instructions
|
WARNING: This Antivirus XP 2008 manual removal process requires good computer skills, manipulations with Windows registry may cause system crash. Don’t forget to make system and registry backup before this operations. We cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. We decline any responsabilaty, Use this manual removal at your own risk. We highly recommend you to download our Recommended Automatic Spyware Remover. |
To manually remove Antivirus XP 2008, follow the steps below:
|
How to Stop malicious Processes |
|
How to find and delete harmful files |
|
How to find and remove malicious Registry entries |
Recommendation:
|
Wrong manual removing process can cause irreparable and serious damage to your computer operating system. You may need the use of a powerful anti-spyware utility such as our Recommended Automatic Spyware Remover to get rid of Antivirus XP 2008, to completely clean your computer of any invasive threat and to keep it protected from future spyware infections. |
Tags: Antivirus XP 2008, Antivirus XP 2008 manual removal, Antivirus XP 2008 removal, Antivirus XP 2008 removal Instructions, Antivirus XP 2008 Remover, AntivirusXP2008, Remove Antivirus XP 2008
July 22nd, 2008 at 10:59 am
I have Antivirus XP 2008, but the processes that this guide tells me to end do not exist. There are 4 similar ones (the first four letters are the same), but I can’t find these. I also can’t run the search function to find the files I need to delete. I think I have a combination of several types of malware, and any help removing them would be great. Thanks in advance
July 22nd, 2008 at 1:27 pm
Michael,
the problem with this “Antivirus XP 2008″ is that it creates random files on each PC.
so I suggest that you try to make a similarity between the files you found on your PC and those posted here.
Let’s say you found a [RANDOM NAME].exe as a process,
when this guide says delete this file: # C:\Program Files\rhcevfj0end5\MFC71.dll
What you will be looking for is # C:\Program Files\[RANDOM NAME]\MFC71.dll
Hope I helped.
July 23rd, 2008 at 4:11 pm
I noticed that the file name rhcevfj0end5 is different from mine, mine is: rhcjg9j0ee5l and I used Malwarebytes, Spybot, Ad-Aware and aVast and am still getting some lingering problems. After computer has been on awhile it goes to Blue screen with instructions to disable memory catching or shadowing which I didn’t have in my Bios, then it goes to Windows Black startup screen and back to the running program. The whole screen change is a fake. The program running in the background is ok. How do I get rid of that???
July 23rd, 2008 at 4:19 pm
Richard,
did you tried these steps in safe mode ?
July 28th, 2008 at 12:15 am
Hi, I had this problem once before and i had to do a complete system restore >_<. I recently bought Trend micro and spy sweeper, Both of them are alerting me and telling me that antivirus 2008 is on my cpu and i have quarantined and deleted it several times, however it keeps poping back up. Can you help? I followed your guid and the only files i wasn\\\’t able to find were, C:\\\\Documents and Settings\\\\All Users\\\\Bureau\\\\Antivirus XP 2008.lnk and C:\\\\WINDOWS\\\\system32\\\\pphcavfj0end5.exe, Thanks in advance
, If i every find the adress for the people who made this ooo i gotta present for them.
July 28th, 2008 at 7:09 am
John,
the “C:\\\\Documents and Settings\\\\All Users\\\\Bureau\\\\Antivirus XP 2008.lnk” is just the desktop icon for this malicious software.
and for the “C:\\\\WINDOWS\\\\system32\\\\pphcavfj0end5.exe” file, as I said to Michael earlier here, Antivirus 2008 creates random files on each PC so try to make a similarity between the files listed here in this guide and those who already exists on your computer.
Hope I Helped
July 28th, 2008 at 1:07 pm
Thanks Sarah this site, and you have been alot of help. I finally got rid of the antivirus 2008 however it left me without being able to change my background or my screen saver. Is there anything I can do to change this?
July 28th, 2008 at 4:14 pm
John,
you are very welcome.
and about your desktop background and screen saver, I think you might have left some malicious files outthere!
July 29th, 2008 at 1:07 am
Okay well sarah i did another search and i have several spyware, adware , malware and virus removers working to fix it but i can’t seem to get rid off it for good. This is what is currently happening, i deleted it, and the antivirus 2008 program dosen’t come up anymore however my desltop background is blue, it does not say i have a virus anymore however it still is blue and i still get a little resistance from it.
July 29th, 2008 at 6:12 am
John,
Try to restore your system. I cannot gaurantee that it will work but worth trying.
System Restore will allow you to restore your system’s configuration to a previous state. In some cases that means that viruses or spyware will be “undone” as part of the process. But system restore does not remove infected files from your system, and you can quickly get infected again. It also does nothing to prevent new threats from arriving.
So, if you restore to a previous date, perhaps that all the malicious files you deleted might come back !
here is “How to Start and Use System Restore”
To start System Restore, follow these steps:
1. Click Start, point to Programs, point to Accessories, point to System Tools, and then click System Restore.
The first time you use System Restore, there are two options on the Welcome page:
-> Restore my computer to an earlier time
-> Create a restore point
2. Click Restore my computer to an earlier time and click Next.
A calendar appears.
3. In the calendar, choose which Restore Point to roll your system back to.
4. Click Next.
You are prompted to close all applications before completing the Restore process because the computer will restart.
5. Upon completion of the restart, a confirmation screen appears. Click OK to continue using your computer.
The next time you start System Restore, you will see a third option, Undo my last restoration. This is available in the event that the Restore Point you rolled back to does not correct the original problem that you were having and so you can easily get back to the point in time that you started troubleshooting.
Hope I helped.
July 29th, 2008 at 11:17 am
The instructions didn’t help me and doing a McAfee scan from DOS made no difference. Here’s how I solved the problem:
1. Start/Run: msconfig
2. Startup Tab
3. I found “av2008XP” — removed startup “check mark.”
4. I wrote down the folder in which the “thing” existed (c:\documents and settings\all users\application data\Softland ltd
5. I navigated to the directory in No. 4 above (after I verified no program was installed in Control Panel) and deleted the folder
6. Rebooted — problem solved.
July 30th, 2008 at 4:14 am
I used Malwarebytes to remove anitvirus xp2008 but i am still haveing problems. When i view folders with pictures i cannot get thumbnails or filmstrip to display properly. Using power tools image resizer i also can\’t resize several images selected at once (i could before). I use yahoo as a home page at that no longer displays correctly in IE7 the right hand side of the page is missing, i can only see it all on narrow view. Firefox is fine.
I have beeen throughthe resgistry and can\’t find any more references to the random type names that antivirus XP generates. Maybe it has changed some of my settings, can anybody help please?
Also i cant do a system restore to any dates before i got antivirus XP 2008
July 30th, 2008 at 7:41 pm
I can not get rid of the Antivirus XP 2008. Someone please help. I\’ve located the files as instructed and tried to delete them but it won\’t let me.
July 31st, 2008 at 3:53 am
Amanda,
how is that ? aren’t you the administrator of your PC ?
July 31st, 2008 at 11:55 am
I just got this on my kid’s computer… this software also edits the group policy file to keep you from changing your screen saver see here: http://billjr.spaces.live.com/blog/cns!28CBD6442F406227!675.entry
August 4th, 2008 at 12:37 pm
John,
I’m guessing you are having problems changing your background screen, not that it is just blue. The Antivirus XP 2008 Virus had messed with some of my settings in control panel as well.
If you go:
Start>Run
Type: gpedit.msc [click enter]
Under “User Configuration” expand “Administrative Templates” then “Control Panel” then click the “Display” folder.
Change the “Prevent changing wallpaper” to “Not configured” or “Disabled”
(You might have to change “Hide Desktop Tab” as well, since that whole tab was gone from my display settings as well
Sarah,
Have you been able to completely get rid of this virus? I really do not want to reformat my PC, but it is looking more and more like I am going to have to. (I have needed to for a while anyway) At one point I got something that got rid of my msconfig(Can’t pull it up at all, “File not found”)
Also, everytime I try to go into System Restore it only shows the current date.
August 6th, 2008 at 4:37 pm
After I enabled the display settings just mentioned, I found that the phcgf7j0e99l.bmp was used as the desktop bitmap. I searched on this name, first mistakenly ending with a \"one\" (1), then with the letter \"l\". Between the two searches, I found the bitmap image, a screen saver, and an application with part of \"phcgf7j0e99l\" in their filename. All of them had the same modified date and time. I\’ve deleted them.
August 8th, 2008 at 7:05 pm
The Windows Task thing won’t open. So What do I do. I can’t remove it. It’s frustrating:-(
August 8th, 2008 at 7:06 pm
Help!
August 8th, 2008 at 9:30 pm
jay,
take a look at this comment here
August 9th, 2008 at 10:27 am
Lots of good info above — thanks to all.
Spent most of the night successfully removing Antivirus XP 2008. Lessons learned:
1. Im no pro, but my suite of Anti-Spyware & antivirus applications evidently detected problems but didnt remove anything (till the end of the following process).
2. Comment 2 is correct — my RANDOM name was phct1gj0eadr. I also was better able to find the culprit files once I discovered the TIME the attack occurred (Limit searches by time the file was modified).
3. The list of file names above is not all inclusive and lists some files I didnt have, but its a fair checklist and very good lead once you discover your RANDOM name.
4. I had to use safe mode to remove anything. Safe mode also was more conclusive in detecting files in searches.
5. After removing the culprit files, I still had Blue screen syndrome, so I tried Comment 11, above. I removed a startup check mark from an item bearing my RANDOM name (didnt have av2008), but no luck — I still have the syndrome.
6. Having removed the culprit files, I restarted in Normal mode and ran Norton 360, which then detected and evidently removed a number of items installed (on the same day as the attack). It listed the items under Blusod Trojan and Downloader (evidently, files, caches, etc) and classified these two buckets and their contents as high or severe risk.
7. I cant say Ive wrung out my computer, but it appears the virus is completely gone. I had two residual issues — had to re-designate my IE home page and … I have Blue screen syndrome. Its pretty clear that the virus damaged (ie, downgraded) the Display control panel. Ill keep playing with the Comment 10 procedure, above, but no luck so far. Any slick ideas??
August 9th, 2008 at 2:46 pm
Thank you. I have been fighting this all day, and I think I’ve found the problems. It got me when I tried to watch the olympics online this morning.
August 9th, 2008 at 7:43 pm
how can i get rid of these antivirus
can u tell me a step
August 13th, 2008 at 8:50 pm
First, thanks to whoever works on this site (Sarah?), it\’s really appreciated.
In case it helps, I\’m posting additional advice that I\’ve seen elsewhere on the Web – I\’m not sure where I got it, to be honest. I think I MAY have licked this problem; I used a combination of the instructions here, and the advice in the message below, as well as some of the additional comments.
One reason I\’m posting this also is that the latter half addresses how to fix the \"warning message\" wallpaper (Wil describes the same thing above, more or less). This seemed to work for me the first time around, but then that blue screen appeared again the next day. I searched for and found other files that I deleted, but frustratingly, the screen problem remained. What I found was that I had to return to the locations mentioned, and even though \"Disabled\" was already selected for each attribute, I had to select \"Apply\" for each one of those attributes once again, which seemed to finally allow me to access the controls to change the wallpaper. That\’s the main reason I\’m posting, I wondered if this is the same thing that\’s preventing people from fixing that screen (?).
Now, if this problem is back tomorrow, I\’ll come back and say it didn\’t work after all.
I can\’t vouch for the below, as they aren\’t my instructions – note also the same problem with random file names:
\"This is how I got rid of Antivirus XP 2008. It is different than the XP Antivirus 2008 most sites refer to.
First you need to stop the program from loading on startup. This is what you do to stop it:
Start, run
Type msconfig
Go to Startup tab
Uncheck lphc35dj0e1an
Uncheck rhc75dj0e1an
Click apply, then ok
Restart computer
Then you need to delete the main files this program uses. Delete the following files:
C:\\windows\\system32\\lphc35dj0e1an.exe
C:\\program files\\rhc75dj0e1an\\rhc75dj0e1an.exe
This should remove the program from your system but you probably still have a warning message displayed as your wallpaper in Windows and the virus removed the ability to change the wallpaper or your desktop settings.
To restore ability to change your desktop settings and select a different wallpaper and screen saver do the following:
Start, run
type Gpedit.msc
Navigate to User configuration, Administrative Templates, Control Panel, Display
Right click on Remove Display in Control Panel
Click on Properties and select Disabled
Do the same steps to change the following attributes to disabled:
Hide Desktop Tab
Prevent changing wallpaper
Hide Apperance and Themes tab
Hide Settings tab
Hide Screen Saver tab
You should now be able to use your computer normally and change the wallpaper to something other than the warning message Antivirus XP 2008 set it to.\"
August 14th, 2008 at 12:33 pm
It didn’t work. I have the blue screen again today.
This is really annoying.
August 14th, 2008 at 3:28 pm
Ow, thank god for people like you guys, i have been struggling all day with this spyware
But thanks to you everything is okay!
Taylor – Your godsent message of how to uncheck those files helped me get rid of it!
Thanks to people like you earth is a better place to live. Keep helping people, you guys rock! =D
Forever greatfull, Matt.
=)
August 15th, 2008 at 11:57 am
I am able to fix the wallpaper and screensaver prob after removing the spyware
In registry editor go to
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\ Windows\\CurrentVersion\\policies\\System
Change the value of these two keys NoDispBackgroundPage and NoDispScrSavPage to 0.
Close regedit and try changing your screensaver and wallpaper
August 16th, 2008 at 9:56 pm
I used Mary’s advice and it seems to have worked. She wrote hers on July 22. Check it out.
August 16th, 2008 at 10:01 pm
I am sorry Mary wrote hers on the 29 of july not the 22. My bad.
August 17th, 2008 at 7:07 am
Appreciate all of the info.. I have removed most, but am still unable to use the System Restore. It is not available! In other words, it “appears” to not exist.
Any suggestions appreciated. harve
August 22nd, 2008 at 12:10 pm
Hi.. thks to all for the istruction and various tips… as I think I have been able to remove this spyware…
Just one question.
The only remaining item is that when lstarting up the system, into the bottom icon tray of the desktop still remains a red circle with a white cross showing, from time to time, the following message: “Your computer is infected…Windows has detected spyware infections…..etc..”
How I can remove it ?
Thks a lot
Anna
August 22nd, 2008 at 2:46 pm
Thks to all for the istruction and support… I think I have been able to remove this virus.. I do need your support to fix the last item…
When the system start up, on the icon tray of the desk top, it continues to appear a warning (white cross in a red circle) stating: “Your computer is infected! Windows has detected spyware infections! It is recommended…….”
Do you have istruction on how to remove it ?
Thks a lot
August 24th, 2008 at 5:21 pm
I’ve got quite a few problems and perhaps maybe one that most people either don’t have or haven’t mentioned.
Like most people I have that blue screen syndrome. I’m unable to remove and I’ve tried several methods including the one where I have to use the Run Option on the Start Menu. I tried the “changing the value to zero” method at the..
“HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\System”
method only to find out that it doesn’t have the “NoDispBackgroundPage” or “NoDispScrSavPage” option there.
Whenever I go on google and search up something, every time I click a link it opens up a new tab on my Mozilla FireFox and it links me to one of those false search engines that you usaully run into when a site is shut down or something. I have to enter the link into the bar above in order to reach my destination. Its quite annoying having to copying and then pasting the link onto the bar above EVERY single time.
I downloaded some programs in an attempt to wipe out the virus, I tried this method that I saw on YouTube which required two programs that required to be downloaded in order for the method to be executed. The programs were Process Explorer and HiJackThis. I downloaded them, but something refused to let the 2 be installed. I believe Process Explorer was a RAR file so I had to use WinRAR to decompress it. It wouldn’t allow me to decompress it. HiJackThis was an installation program so I double clicked it for it to start, it wouldn’t even start. Since that didn’t work I tried to download SpyBot: Search & Destroy, it said it couldn’t connect to the internet because my firewall wouldn’t allow it or that my internet was not connected. Clearly my internet was connected otherwise I wouldn’t be able to download it or be downloading other programs at the same time and I don’t think my firewall would not allow a program that would do good for my computer to connect to the internet.
Any suggestions? I deleted all the files I was able to find that were mentioned up there. The processes you posted up there had different letters in them, but I just deleted whatever seemed close to it.
August 26th, 2008 at 8:38 am
I have the same problem sonny. it disable any antivir or antispyware to connect to server and download updates…
August 26th, 2008 at 9:22 am
Hey guys i have this problem too
i dont wanna break my pc and also what if there are good files in there mixed with the bad
i think i have detected the files in my registry but im terrified to delete them
please help:(
August 29th, 2008 at 2:02 pm
I got rid of the blue screen a few days ago by running 2 full system scans at the same time while I went outside. I came back and my wallpaper function began working properly again.
August 31st, 2008 at 7:14 am
i used windows live one care to remove it its free and seems to remove it but i’ve still got the blue screen syndrome any idea’s
August 31st, 2008 at 5:50 pm
On my sons computer the “C” drive is now hidden along with the option to access “regedit” and “Control Panel”…How can i restore these values? or at least enable the visibility of “C” drive?
September 2nd, 2008 at 9:40 pm
I tried runing gpedit.msc but I get an error saying it can’t be found. I did all the steps for fixing the desktop background up to that point, and I have the ablity to chenge my desktop image. Is there anything else I need to do?
September 3rd, 2008 at 6:59 pm
Okay, either I got hit with some other virus at the same time as AVXP 08, or it did this damage on its own.
At times I hear the “click” sound effect (the one you get when you click a link) even if my browser isn’t open. Also, I’m ubable to use both Photobucket and Imageshack to upload pics; I get the “Internet Explorer cannot display the webpage” error when I click upload. Finally my my browsers sometimes freeze like when they’re “Not Responding” and I’m forced to do a manual rebooot because the widnow gets frozen onto the screen making it impossible to do anyhting.
All of this started when AVXP 08 started wreaking havoc.
September 3rd, 2008 at 7:22 pm
Alright, now this is REALLY weird! After a few of those click sounds I heard some sort of clip playing with no picture…just the audio! The only applications I had open that I could see was a game I was playing. I opened the Task Manager, but it didn’t show anything unusual.
It was like someone else was on my computer, using an invisible browser than I could only hear. I’m worried that my computer, and maybe even the network it’s on, has been infiltrated somehow? Has ANYONE ever experienced glitches like the ones I’m having?
September 4th, 2008 at 4:10 pm
So, to recap, even after getting rid of the virus:
-The “link click” sound effect keeps radomly going off even when I’m not doing anyhitng
-Occasionally, everything freezes, and I’m forced to reboot. I’m still able to move the mouse cursor though. The cursor will still change to an hourglass when over a non-resposnive window, and then back to a pointer when over the destop toolbar…sometimes. But while I can still move the cursor, the computer doesn’t seem to respond when I click (no matter what I click on and with which mouse button)
-Image hosting sites act like I have no connection when I try uploading images. For example, Photobucket says a network error occured, while Imageshack send me to the “Internet Explorer cannot display the webpage” screen. Strangely, Photobucket had the image I was trying to upload displayed when I went back the next day.
-Some video clip started playing on its own, but I only heard the audio. This wasn’t a clip stored on my computer, and no applications were running except for a game I was playing. As I said before, with this clip playing and the click sound effects, it was as if the browser was surfing invisibly all on its own
One more to add: Just like Sonny, I keep getting redirected when I click search result links. Is this virus designed to try and stop you from searching for and downloading anything that might help you get rid it?
September 5th, 2008 at 9:53 am
help! i tried task manger but it been disable!!! what do i do?!
September 6th, 2008 at 2:30 am
Hi. I couldnt’ find the bureau and application data exe. but when i did get it at first. i deleted the antivirus folder and used hijackthis to delete its processes.
i did everything as you say but still i am redirected in my internet browswers. I can’t download anything because it says the files are corrupted. I can’t upload anything either. Please help me? What do i do next?
September 6th, 2008 at 11:31 am
this is probably the worst virus i have ever had. i just cant get rid of it, and it seems like someone else has control over my computer. HELP!
September 7th, 2008 at 8:48 am
i found that searching “j0e” is the best way to find it
hope that helps
September 9th, 2008 at 12:17 am
I followed the above steps, including editing automatic Startup of the antivirus XP stuff and I have no problem with my wallpaper or display tabs or the actual antivirus thing popping up anymore. However, I still can’t surf the net properly, pages load weirdly and google doesn’t work correctly. I also can’t do a system restore. please help!
September 12th, 2008 at 12:20 pm
I followed Mary’s Instructions dated Jully 22. Then I did a search for any files that had “glj0etfp”. Those letters were consistent in the couple of files I found. I found another 11 files and deleted them. It WORKED!!!! Thanks Mary and to everyone who gave their time and suggestions.
September 12th, 2008 at 12:22 pm
I meant dated July 29th. Sorry!
September 16th, 2008 at 8:41 pm
Searching for “j0e” allowed me to find other files previously unnoticed and with different letters at the beginning. If that makes since to everyone…
September 18th, 2008 at 8:33 am
Hi.
This site was very helpful. I got the virus yesterday afternoon. I did search j0e and got rid of the files asked after I disabled the annoying message in the beginning using start up option someone mentioned. I couldnt find the last registry file to delete..it just wasnt there.
Here are the remaining problems:
-the blue screen- I tried the method listed above up I couldnt find it.
-redirects my search result links into random fake search sites
-frequent clicky sounds and audio of tv show again when i turned on my computer this morning.
Is there any other place the files could be hiding? Please help. Thanks!
September 18th, 2008 at 1:02 pm
uhhh i did that thing at the top and did the search for “j0e” too and i got 9 other things that was not found. i deleted thme now i thing is almost back to normal.
now all that wrong is that my screen background is all blue but i cant still access icons and stuff
bur i can’t change my backgrounds. i opened display properties and both my screen saver and backgrouns options on the tab were missing plz help me solve this
September 18th, 2008 at 1:07 pm
ops i meant can still access
September 20th, 2008 at 12:05 am
So I got rid of XPAV’08 over the last day and now I can’t get to microsoft.com, mcafee.com, or symantec.com and no anti-spyware or windows updates are acessible.
September 26th, 2008 at 2:43 pm
The folder names were different on mine.I had the following: -
rhcpuaj0ea7g
inrhcpuaj0ea7g
C:\Windows\system32\lphctuaj0ea7g.exe
lphctuaj0ea7g
September 26th, 2008 at 11:11 pm
I do not seem to have rhc75dj0e1an.exe but I have removed it fine. It seems the only problem is the one u get after u remove it. The blue screen. However I am looking at something to solve this. Also How do u open key registery? Sorry if spelt wrong. Please email me holyxfire@yahoo.com if there is anything new.
October 6th, 2008 at 9:50 pm
THe virus is back but not installed its in the bottem right cornor. Anyone know how to get rid of it?
November 15th, 2008 at 1:44 pm
Antivirus 2008 has infected my computer and now when I try to even sign on it stalls at the \"Windows is starting up\" screen. Is this hopeless or is there another way to remove this virus. Any help is appreciated.
August 21st, 2009 at 3:35 pm
hi i downloaded the automatic thing. which is spyware doctor but i cant click anything and it just says “spyware doctor in restarting engine in 0s”. and it just says like that not working. if anybody can help i would really appreciate it