End Infected Processes

• 1). Press "Ctrl" + "Alt" + "Delete."
  
  
• 2). Click on the "Task Manager" and then click on the "Processes" tab.
  
  
• 3). End the following processes. To end a process, right-click on it and select "End Process."
  
  "XPAntispyware2009.exe"
  "setup_100527_3_.exe"
  "setup.exe"
  "as2008xp.exe"
  "antispyware-2009.exe"
  "profile\application data\secure solutions\XPAntispyware2009\as2008xp.exe"
  
  

Remove Infected Registry Values

• 1). Hold down the Windows key and press "R." The Run box opens.
  
  
• 2). Type "regedit" into the Run box and click "OK." The Registry Editor opens.
  
  
• 3). Locate the following registry values in the left pane of the Registry Editor and delete them. To delete a registry value, right-click on it and select "Delete."
  
  "HKEY_CURRENT_USER\software\secure solutions\XPAntispyware2009\2.1 start counter"
  "HKEY_CURRENT_USER\software\secure solutions\XPAntispyware2009\2.1 installtime"
  "HKEY_CURRENT_USER\software\secure solutions\XPAntispyware2009\2.1\config"
  "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run ieupdate"
  "HKEY_CURRENT_USER\software\secure solutions\XPAntispyware2009 lid"
  "HKEY_CURRENT_USER\software\secure solutions\XPAntispyware2009 pid"
  "HKEY_CURRENT_USER\software\secure solutions\XPAntispyware2009 lgid"
  
  

Remove Infected DLL Files

• 1). Hold down the Windows key and press "R." The Run box opens.
  
  
• 2). Type "cmd" into the Run box and click "OK." The Command Prompt opens.
  
  
• 3). Type "regsvr32 /u ntdll64.dll" (without the quotation marks) into the Command Prompt and press "Enter." This removes the infected DLL file.
  
  

Remove Infected Directories

• 1). Hold down the Windows key and press "R." The Run box opens.
  
  
• 2). Type "cmd" into the Run box and click "OK." The Command Prompt opens.
  
  
• 3). Type "rmdir xpantispyware2009" (without the quotation marks) into the Command Prompt and press "Enter." This removes the infected directory.