Windows XP Security: Manually Remove

Viruses from Your PC

ByDino Londis
Last Updated on October 27, 2011

If you have a lot of popups or an advertisement for fake antispyware, you have malware of on your PC.
Here’s how to manually remove the virus from running in the first place. The majority of viruses in
Windows XP are easy to find — and they’re more conspicuous than you would think.
Start in the registry. Most viruses launch when you log into Windows — they typically call an executable
from the registry. In fact, that call will tell you exactly where the virus resides.

Click Start. Click Run and type: regedit.exe

Click OK.
Registry Editor opens. Expand HKEY_CURRENT_USER.

Then expand Software.

Next expand Microsoft.

Now expand Windows.

Then expand CurrentVersion.

Click on the Run folder. Here you’ll find some of the programs that launch on startup. A rule of thumb: a
virus is a randomly generated string that makes no sense. Usually software writers title their files with
names that describe what they do. At first glance — this is an example from a real virus I uprooted — it’s
VpKspPwxlCbXa. This is likely a virus.

The real giveaway that this is a virus is the location of the application it’s calling. It’s in the Application
Data folder. It launches every time you log in. So no matter how many times you reboot, it comes right
back.

Write down where the virus resides. In this case, it’s in the All Users Application Data folder. Then simply
right-click the registry key and delete it. Now you haven’t actually deleted the virus, you’ve only deleted
the call that launches it, which is doing the minimum. A virus is just a program, after all, so if the virus
doesn’t launch it does no harm. But delete the file system anyway.

Now it’s time to go to the Application Data Folder. There is more than one — follow the path exactly as
you wrote it down.
Now right-click My Computer. Select Explore.

Expand Documents and Settings.

Expand All Users

Click on Application Data.

Try to delete the virus — just right-click and delete it. It’s not likely you can because it’s running in
memory. Do rename it, though. You want to rename that .exe to anything else.

After you rename it, reboot the PC and return to the same location.

Because you’ve deleted the call from registry the virus won’t run in memory. Now you are able to delete it.
Do it!
This set of steps comes in really handy when you have a virus or malware that your antivirus software
doesn’t catch. Remember to always keep your PC and antivirus software up-to-date.