How to manually remove XP Antivirus 2010

Antivirus 2010 not only it uses misleading advertisements to gain a purchase, but also it crashes a system and loads fake Blue Screen of Death

Step 1: Stop unwanted process running in background.
Click Start then Run and type taskmgr.exe
Click on Process tab in Task Manager and locate the following Image name(s).
AV2010.exe
svchost.exe
wingamma.exe
Highlight the Image name and click End Process to Stop.
Close Task Manager.

Step 2:- Delete the suspicious file(s) or folder(s) from the computer

Click on Start and Run, type
C:\Program Files\AV2010 c:\Program Files\AV2010\AV2010.exe c:\Program Files\AV2010\svchost.exe
C:\WINDOWS\system32\IEDefender.dll
c:\WINDOWS\system32\wingamma.exe c:\Documents and Settings\All Users\Desktop\AV2010.lnk c:\Documents and Settings\All Users\Start Menu\Programs\AV2010
c:\Documents and Settings\All Users\Start Menu\Programs\AV2010\AV2010.lnk c:\Documents and Settings\All Users\Start Menu\Programs\AV2010\Uninstall.lnk
Locate the following folder and Delete

c:\Program Files\AV2010
c:\Documents and Settings\All Users\Start Menu\Programs\AV2010
close the Window.

Step 3:- Uninstall the Suspicious program from the computer.

Click on Start and Run, type appwiz.cpl, press Enter.
Locate Antivirus 2010 in Add and Remove Program.
Click on Remove (Uninstall) button.
Close Add or Remove program.
Restart the computer.

Step 4:- Manual Removal of suspicious entries from Registry.

CAUTION: Changing the Registry incorrectly could cause your comuter to stop working. Please make sure to create backup of registry or create system point before proceeding.

Click Start, Click run and type regedit.
Create a registry backup.
Note: Some of these Registry keys and values may be random.
Locate the following registry keys, right click and Delete
HKEY_CURRENT_USER\Software\AV2010
HKEY_CLASSES_ROOT\AppID\{3C40236D-990B-443C-90E8-B1C07BCD4A68}
HKEY_CLASSES_ROOT\AppID\IEDefender.DLL
HKEY_CLASSES_ROOT\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
HKEY_CLASSES_ROOT\IEDefender.IEDefenderBHO
HKEY_CLASSES_ROOT\IEDefender.IEDefenderBHO.1
HKEY_CLASSES_ROOT\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}
HKEY_CLASSES_ROOT\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}
HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0013
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 'Windows Gamma Display'
Restart the computer.

How to manually remove XP Antivirus 2010?

To get rid of spyware such as Antivirus 2010 you must block Antivirus 2010 sites, stop and remove processes, unregister DLL files, search and remove all other Antivirus 2010 files and registry utility. Follow the Antivirus 2010 detection and removal instructions below.

The most typical spyware removal method is to remove Antivirus 2010 by using "Add or Remove Programs" service. However there may be hidden Antivirus 2010 files, running processes and registries in your computer, so Antivirus 2010 may recreate all other files after reboot.
Antivirus 2010 manual removal instructions


Stop and remove Antivirus 2010 processes:

wingamma.exe
AV2010.exe Read more how to kill Antivirus 2010 processes

Locate and delete Antivirus 2010 registry entries:

HKEY_CURRENT_USER\Software\AV2010
HKEY_CLASSES_ROOT\AppID\{3C40236D-990B-443C-90E8-B1C07BCD4A68}
HKEY_CLASSES_ROOT\AppID\IEDefender.DLL
HKEY_CLASSES_ROOT\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
HKEY_CLASSES_ROOT\IEDefender.IEDefenderBHO
HKEY_CLASSES_ROOT\IEDefender.IEDefenderBHO.1
HKEY_CLASSES_ROOT\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}
HKEY_CLASSES_ROOT\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0013
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windows Gamma Display" Read more how to delete Antivirus 2010 registry entries

Search and unregister Antivirus 2010 DLL libraries:

IEDefender.dll Read more how to unregister Antivirus 2010 DLL files

Detect and delete other Antivirus 2010 files:

c:\Program Files\AV2010
c:\Program Files\AV2010\AV2010.exe
c:\Program Files\AV2010\svchost.exe
c:\WINDOWS\system32\IEDefender.dll
c:\WINDOWS\system32\wingamma.exe
c:\Documents and Settings\All Users\Desktop\AV2010.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\AV2010
c:\Documents and Settings\All Users\Start Menu\Programs\AV2010\AV2010.lnk
c:\Documents and Settings\All Users\Start

These kind of "antivirus" software does cause a lot of problems and their names are misleading as well, anyway thanks for your tips.

Quote:

---

Originally Posted by checkUsOut

These kind of "antivirus" software does cause a lot of problems and their names are misleading as well, anyway thanks for your tips.

---

thanks for giving feed back.....

I tried looking under all the file sources and found nothing.
When I open task manager I find av.exe and that seems to be the source of the problem. when I search for it I cannot find it. Does anyone know where it would be located?

Well av.exe is actually a process which is registered as the W32/Alphx.worm.a virus. You may need to install an application called as Uniblue Speed up My PC. This would remove the threat and hence then you can follow the instruction as mentioned above.

thank you but i already fixed it
without an application
av.exe attached itself to registry so i just went through and deleted them manually

Quote:

---

Originally Posted by Alpha_Omega

thank you but i already fixed it
without an application
av.exe attached itself to registry so i just went through and deleted them manually

---

I have same problem. Cant find any of the files or registry key.

How did you fix it exactly?

Thanks in advance

At first I screwed up
I deleted all of the .exe registry
because that's where av.exe was
then i found some website
it had default registry keys
then I had another problem
it wouldn't let me import them
so i exported all of the registry
opened them in notepad
and opened the defaults in notepad
then i just copied and pasted
then imported the original back into the registry
good luck

I'm not sure but i think it's the same virus
that is attached to apollo ohno's site
which is mildly amusing...

Hello I am starting up a lawsuit against them. Microsoft is mad because they are using their logo and making them look bad. I contacted Microsoft and they said they were not affiliated with them or any other antivirus website unless if it's on their website. Again Microsoft is not affiliated with any of these fake virus' even though they go through some of their software to annoy you with their fake messages. I want to start up a lawsuit against them and found an ip address that is connected to their website 68.71.130.13.
They have used fake testimonials. It is real but they came from AVG. Here is their website...http://windows-live-care.com/buy.html. Go to AVG.com and find their testimonials and you will find that they are the same.

I got hit by this last week.
I was trying to get the 1980's remake of an old Agatha Christie movie.
I opened multiple windows and then closed when the description indicated it was not the 1980 movie.
On closing one of the windows McAfee antivirus opened a window indicating it blocked a fake anti-virus app. . GOOD
Then another window popped up:

XP Antivirus 2010 has found spyware on your computer, and then a scan started.

I knew I was in trouble. . Closed the app and everything else, but it kept coming back up.
The Windows firewall and McAfee anti-virus had shut down. I was not able to open malwarebytes or Ad-aware to do a scan. Using another computer I found info about this "XP Antivirus 2010" and found what files and registry entries to delete. Problem was none of these existed. I went to some of the sites that had software to remove this program from the infected system, but they were blocked saying they were "infected". Windows task manger would not open, so had to use a command line to open it. None of the processes or services mentioned about the program existed. What to do now.

Through hours of trial and error, I found the program only opened on the profile I was using at the time. I logged in with another admin account and renamed my profile folder, deleted the account and recreated it (had data in the profile to copy). I was then able to run Malwarebytes and adware to find multiple infected files. The key infected file was MSASCui.exe (which is a process belonging to Microsoft Windows Defender Antispyware). Looks like this was corrupted by XP Antivirus, but only ran with the one user profile (lucky for me).

Sounds like this is a new version of XP Antivirus 2010, as none of the suggestions to remove it applied.

DaveMauriceSr,

Thank sharing your experience.... You've saved me a lot of time!

I also tried several of the other solutions and they didn't work.

It appears as if there is a new version out there that is pretty hard to get rid of.

Thanks DaveMauriceSr... I created a new profile and the annoying popup and the icon on the toolbar seems to have vanished. Just curios does creating the new account remove this or is there anything else that needs to be done?

How to stop Antivirus 2010 processes:

1. Click the Start menu, select Run.
2. Type taskmgr.exe into the the Run command box, and click “OK.” You can also launch the Task Manager by pressing keys CTRL + Shift + ESC.
3. Click Processes tab, and find Antivirus 2010 processes.
4. Once you’ve found the Antivirus 2010 processes, right-click them and select “End Process” to kill Antivirus 2010.
How to remove Antivirus 2010 registry keys:

Backup your registry before you edit it. Then…

1. Click the Start menu, and click “Run.” An “Open” field will appear. Type “regedit” and click “OK ” to open up your Registry Editor. In Windows 7, just type “regedit” into the “Search programs and files” box in the Start menu.
2. Registry Editor opens as a two-paned window: the left side lets you select registry keys,the right side shows the values of any selected registry key.
3. To find a Antivirus 2010 registry key, select “Edit,” then select “Find,” and in the search bar type any of Antivirus 2010 ‘s registry keys.
4. When the Antivirus 2010 registry key appears, to delete the Antivirus 2010 registry key, right-click it, and select “Modify,” then select “Delete.”


Thanks