Comments on: XP Guardian

By: ANAYELI

ANAYELI — Sun, 07 Mar 2010 17:31:36 +0000

hola intente hacer lo que ustedes mencionan pero no me funciono esq yo tengo un ciber y la verdad si me urge una solucion porfis

By: Chris W.

Chris W. — Wed, 03 Mar 2010 14:04:00 +0000

hey ive been doing the removal of registry items but instead of av. mine always says MSASCui. just thought id mention the difference

By: Derek

Derek — Wed, 03 Mar 2010 04:08:04 +0000

Hey new update I finally got in safe mode and did a system restore back to feb 21st and everything is looking good running scans and stuff I might be out of the hook hopefully if you think otherwise I would love to hear!

By: Dr. D. S. Moody

Dr. D. S. Moody — Wed, 03 Mar 2010 01:37:12 +0000

Neophites should NEVER go into the Registry for any reason! Leave it to the Pros. I’m an MCSA and tell all users to save this kind of work for those of us who do IT work for a living.

By: Derek

Derek — Tue, 02 Mar 2010 23:57:46 +0000

So I got XP guardian like 2 days ago and tried malware to get rid of it and did not work so I tried a couple of other programs and this one found it and got rid of XP guardian (SUPERAntiSpy). When it found the trojans it made my computer restart then when I got back on I did not see XP Guardian but when I try to open a program I get a box saying ” Open with ” ^^^^(what others said above I think)^^^^. So a couple of questions I guess do I still have XP guardian and how can I fix this I can’t even system restore or DL anything without an error message or the open box but I can access the internet when I get the open box and it gives me and option to look on the web for an appropriate program.

By: momgeek545

momgeek545 — Tue, 02 Mar 2010 01:26:47 +0000

much appreciated everyone!

admin & JBRO: I did not need to download the .zip file, only to open the Task Manager, open the File menu, hold the CTRL key and select New Task (Run) – that got me into the registry where I could restore the correct values to all the keys I just deleted.

thanks again, everyone!

By: admin

admin — Mon, 01 Mar 2010 08:36:35 +0000

JBRO : Try downloading and using this fix. Unzip on another PC and right-click on that file : http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip
press CTRL-ALT-DEL and open Task Manager. Once there, click File, then hold down the CTRL key and click New Task (Run). This will open a Command Prompt window. Enter REGEDIT.EXE and press Enter.

By: JBro

JBro — Sun, 28 Feb 2010 20:07:50 +0000

So, I deleted all the XP Guardian registry entries as defined in the information above…only to read the reviews/help AFTER deleting INSTEAD of EDITING. I am on a company laptop so I don’t have access to everything, most likely. Any advice on how to correct the problem, as I can’t run the “regedit” any longer…PLEASE HELP!

By: killerbonnar

killerbonnar — Sun, 28 Feb 2010 17:36:16 +0000

Where do you put all this code ?

By: ionstorm

ionstorm — Thu, 25 Feb 2010 15:16:56 +0000

Don’t remove the entries, modify them.

By: ionstorm

ionstorm — Thu, 25 Feb 2010 15:06:54 +0000

TO BE MORE CLEAR

Stop and remove XP Guardian processes:
======================================
av.exe

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application

Data\av.exe” /START “%1″ %*
=========================
!!! “%1″ %* MUST STAY !!!
=========================

HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application

Data\av.exe” /START “%1″ %*
=========================
!!! “%1″ %* MUST STAY !!!
=========================

HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application Data\av.exe” /START “%1″

%*
=========================
!!! “%1″ %* MUST STAY !!!
=========================

HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “%UserProfile%\Local Settings\Application Data\av.exe” /START

“%1″ %*
=========================
!!! “%1″ %* MUST STAY !!!
=========================

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “%UserProfile%\Local

Settings\Application Data\av.exe” /START “C:\Program Files\Mozilla Firefox\firefox.exe”
================================================================
!!! “C:\Program Files\Mozilla Firefox\firefox.exe” MUST STAY !!!
================================================================

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “%UserProfile%\Local

Settings\Application Data\av.exe” /START “C:\Program Files\Mozilla Firefox\firefox.exe” -safe-mode
===========================================================================
!!! “C:\Program Files\Mozilla Firefox\firefox.exe” -safe-mode MUST STAY !!!
===========================================================================

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “%UserProfile%\Local

Settings\Application Data\av.exe” /START “C:\Program Files\Internet Explorer\iexplore.exe”
===================================================================
!!! “C:\Program Files\Internet Explorer\iexplore.exe” MUST STAY !!!
===================================================================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1″
================
!!! SET TO 0 !!!
================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1″
================
!!! SET TO 0 !!!
================

Detect and delete other XP Guardian files:
==========================================
%UserProfile%\Local Settings\Application Data\av.exe
%UserProfile%\Local Settings\Application Data\WRblt8464P

By: Sharon Yeates

Sharon Yeates — Thu, 18 Feb 2010 14:45:06 +0000

First sign I had the virus was last night when it popped up.
It must have been running stealth for awhile though because it has already halted many processes. I cannot bring up explorer on that comp at all. It asks me what I want to run the program with. If I tell it the ie exe it comes back and tells me that rundll32 is missing or corrupt. Its blocking malware editors, nortons, etc.. and I can’t even get into my computer.

By: Socal

Socal — Wed, 17 Feb 2010 00:20:43 +0000

Rob, I used the exefix solution, found a confirming message here http://www.computing.net/answers/digitalphoto/computer-cant-run-any-files/2005.html

seems to have worked, thanks

By: Socal

Socal — Wed, 17 Feb 2010 00:13:34 +0000

Well, it would have been nice if the warning was posted in the beginning of this fix. I deletec the values, so I can fix this by adding this back in those keys?

“%1″ %*
I read that as quote percent one quote space percent asterix

is that correct? Thanks

By: E Genna

E Genna — Tue, 16 Feb 2010 18:11:30 +0000

Rob when I got to the link, I run it and it takes me to the homepage where it doesn’t run. Any advice?

By: E Genna

E Genna — Tue, 16 Feb 2010 18:04:47 +0000

Thanks Rob, I will try to fix it with the download. You’re right, I got rid of the “%1″ %* Unfortunately I cannot open regedit when I go to run b/c I get the same can’t open message. will let you know.

By: Rob.L

Rob.L — Mon, 15 Feb 2010 10:49:13 +0000

**Note to all when removing these keys from the registry don’t delete the “%1″ %* from end, you will wind up with an error when trying to lauch all .exe programs. The error that appears is “this file does not have a program associated with it for performing this action”

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %
HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %

You have been warned. I have just spent the best part of 2 hours giving a user local admin rights and editing the registry trying to fix this.

E Genna: If you have local admin rights you can download and run this file http://www.winhelponline.com/exefix_xp.com to automatically fix the problem. If you want to manually correct the issue then use the following Start->Run “regedit.cm” This will get you into the registry to correct the keys.

By: E Genna

E Genna — Sat, 13 Feb 2010 02:28:33 +0000

My fiancee has this virus. I removed everything as stated from registry, and now when I try to restore my computer or edit my registry, It tells me that

“This file does not have a program associated wit it for performing this action. Create an association in the folder options control panel”

So now I can’t access the registry b/c when I run regedit I get the above message.

I CAN get online now, the messages are gone. I can run everything so far. But I cannot associate with them. I had to create an association for a lot of other shortcuts, like my control panel, and firefox and IE, but I was able to do so. PLEASE advise! Thanks