My father in law accidently installed a programme called Antivirus 2008 XP.
I have looked at tutorials for removing Antivirus XP 2008 however, this is slightly different software. It looks very similar but it doesn't have any of the same processes running. There are no obvious processes when i look in task manager.
When the PC starts it loads the Antivirus 2008 XP prompting me to buy a licence or keep using the evaluation. It goes when I end task it. When I use IE it keeps coming up with rubbish like you are browsing and it could be unsafe, buy our programme.
I ran a McAfee scan which was about as useless as I expected, it came with nothing.
I downlaoded Spybot Search and Destroy, it found some tracing cookies but nothing specifically relating to the software.
I installed Ad-Aware, it found a few things but they were mostly tracing cookies again.
I checked the startup options in Spybot and found this:
Located: HK_CU:Run, s9201 (DISABLED)
command: "C:\Documents and Settings\All Users\Application Data\SoftLand Ltd\Antivirus 2008 XP\av2008xp.exe" /autorun
file: C:\Documents and Settings\All Users\Application Data\SoftLand Ltd\Antivirus 2008 XP\av2008xp.exe
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
So I disabled it from startup.
I went to: C:\Documents and Settings\All Users\Application Data\SoftLand Ltd\Antivirus 2008 XP\av2008xp.exe and scanned the file with Spybot and McAfee but they came up with nothing.
I restarted and it didn't launch the Antivirus 2008 XP which seems good.
I decided to use Spybot's file shredder to delete all the entries in Antivirus 2008 XP. I ran regedit but couldn't find any related entries.
I think that it may be running from within IE but nothing bad is happening. I have switched to firefox now.
Is there anyway I can be sure that it has gone?