Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: HELP - Vista Guardian 2010 virus

15 Mar 2010   #1
canspec

Win 7 Home Premium-64bit
 
 
HELP - Vista Guardian 2010 virus

HELP!!!
I have this virus called "Vista Guardian 2010" and it won't let me run Malwarebytes, my anti-virus program or anything else. A box pops up telling me about all these infections and to buy their program! I can't even get into "safe-mode(F8) to try to run Malwarebytes to get rid of it like an article on the net said to do. Is there any way to get into safe-mode other than F*? I can't get into system restore either! Thanks for any help with this!


My System SpecsSystem Spec
.

15 Mar 2010   #2
brady

 

stop: av.exe
remove:
Code:
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
remove:
Code:
\%Documents and Settings%\[UserName]\Application Data\av.exe
%Documents and Settings%\[UserName]\Application Data\WRblt8464P
My System SpecsSystem Spec
15 Mar 2010   #3
Tews

64-bit Windows 8.1 Pro
 
 

It is strongly recommended that your backup your registry before you proceeding with this method.

Kill the following process:

av.exe

Delete the following registries entries:

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “av.exe” /START “iexplore.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1?

Delete the following if you have Firefox installed:

*HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode

Search and remove the following files:

av.exe
My System SpecsSystem Spec
.


15 Mar 2010   #4
canspec

Win 7 Home Premium-64bit
 
 

Quote   Quote: Originally Posted by Tews View Post
It is strongly recommended that your backup your registry before you proceeding with this method.

Kill the following process:

av.exe

Delete the following registries entries:

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “av.exe” /START “iexplore.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1?

Delete the following if you have Firefox installed:

*HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode

Search and remove the following files:

av.exe
Wouldnt backing up my registry also include backing up the virus into the registry?...Sorry just new at all of this...Thanks for your help.
My System SpecsSystem Spec
15 Mar 2010   #5
brady

 

technically yes, however if you ruin something, it's easier to recover with a virus filled registry then having nothing. /wink
My System SpecsSystem Spec
15 Mar 2010   #6
canspec

Win 7 Home Premium-64bit
 
 

Now it won't let me into the Registry to delete the keys u guys recommended. I don't have restore discs as well to restore the entire system
My System SpecsSystem Spec
15 Mar 2010   #7
Jacee
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

What this does....
How to remove FakeRean (FakeRean Removal) | Malware Help. Org

If you are still unable to get rid of this rogue security software, please visit one of the recommended forums for malware help and post about your problem.
My System SpecsSystem Spec
15 Mar 2010   #8
brady

 

Quote   Quote: Originally Posted by canspec View Post
Now it won't let me into the Registry to delete the keys u guys recommended. I don't have restore discs as well to restore the entire system
Did you get an error when trying to run "regedit"?
My System SpecsSystem Spec
15 Mar 2010   #9
Product FRED

Windows 7 Enterprise 64-bit
 
 

Try starting up in Safe Mode. Start up your computer and keep hitting F8 until the boot menu starts up. Hit Safe Mode. Unplug your internet cable so the virus doesn't try anything funny, and then try running Malwarebytes' and/or your Anti-Virus. Then, try running regedit.
My System SpecsSystem Spec
15 Mar 2010   #10
Jacee
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

He can't get into safe mode, plus The scareware executes (av.exe) every time a .exe file is run.

Please read my post above
My System SpecsSystem Spec
Reply

 HELP - Vista Guardian 2010 virus




Thread Tools





Similar help and support threads
Thread Forum
Whisper staff suspended amid investigations into Guardian report
Source A Guy
Security News
HDD Guardian
The purpose of HDD Guardian is to provide a graphical interface to smartctl, part of the S.M.A.R.T. Monitoring Tools, in order to make this nice utility accessible to all Windows users. http://hddguardian.googlecode.com/svn/main_window.png HDD Guardian requires .NET Framework 4.0 and...
Software
staring Windows Starter 2010 causes virus
When I open the Windows Starter 2010 to start a new blank page with text, it immediately detects a MALWARE on file: R:\140066.ENU\OFFICE14\OFFSPON.EXE which causes me to reboot the computer to take away the malware file(the same one every time) I am using the AVG virus program which takes it...
System Security
August 2010 Virus Bulletin Results Summary
The results have been posted for the August 2010 VB Tests. From Virus Bulletin : VB100 award - latest comparative Bolded below are some interesting failures from the summary, located at Virus Bulletin : VB100 results summary. If these products failed on Windows Vista, does anyone think...
System Security
F-Secure Anti-Virus 2010
more
Security News
Looking for a very good substitute for Peer Guardian 2
Peer Guardian 2 seems to have been abandoned. I feel that it's a very essential program to have working side by side with Vuze, so I've been looking for a very good anti-spying substitute for Peer Guardian 2, which are very effective in blocking off unwanted spam connections from malicious people....
Software

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 13:33.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App