By Jim
Updated on Saturday, March 20th, 2010
Ever heard of Ave.exe? No, I didn’t mean av.exe. There’s not much difference between the two though. That’s right, ave (just like ‘av’) is just a member of a set of files that make up certain rogue programs.
Antivirus XP, XP Smart Security, XP Antimalware, XP Defender Pro, XP Security, Vista Antimalware, Total Vista Security, and Vista Defender Pro are just some of the many programs that require ave.exe in order to run. All of these programs are actually fake anti-spyware tools. That means, they’ll trick you into thinking they’ve got what it takes to remove certain spyware and other threats. But in reality, these programs are actually the threats!
Although you can remove Ave.exe manually (and we’ll show you how in a short while), the steps are pretty tricky. So I strongly suggest you go for automatic removal on this one.
Just like most fake-antispyware, the programs that rely on Ave.exe install themselves through trojans you might have downloaded from rogue sites. Therefore, beware of obscure websites that offer free downloads of video codecs, Flash player updates, or mp3s, as these sites may have a trojan ready to pounce on you. Once inside, they can attack you Windows registry and gain full control.
What if Virus Will Not Let You Open Spyware Doctor or Blocks The Internet?
- Download Spyware Doctor and save to your Desktop (if you cannot download then bookmark this page and skip to Step 3 to restore your internet)
- Rename the file iexplorer.exe
- Restart your Computer in Safe Mode with Networking (keep tapping F8 while your system boots up)
- Launch Internet Explorer, click on Tools and then Internet Options.
- Click on the Connections tab and select LAN Options
- Uncheck the box Use a Proxy Server For Your LAN and click OK
- Launch iexplorer.exe (Spyware Doctor)
- Update Malware Definitions and click Start Scan
- Click the Fix Checked button and remove Ave.exe
Remove Ave.exe In Minutes With an Automatic Removal Tool.
Simply Click “Start Download Now!” to Begin!
Symptoms Of Infection
- Your computer is acting slow. Ave.exe slow down your system significantly. This includes starting up, shutting down, playing games, and surfing the web.
- You are getting pestered with pop ups. Ave.exe infects your registry and uses it to launch annoying pop up ads out of nowhere.
- Searches are redirected or your homepage and desktop are settings are changed. This is a symptom of a very serious Ave.exe infection.
Dangers Of Infection
Viruses like Ave.exe will infect your registry and other important system files. If the infection is not treated it can cause a complete collapse of your system.
Some Ave.exe infections contain spyware and keyloggers which can be used to record sensitive data like passwords, credit card, bank account, and social security numbers. The longer you allow the infection to fester, the greater the chance of identity fraud.
How To Remove Infection Manually
Uninstall Ave.exe Processes
Delete Ave.exe Files
Remove Ave.exe Registry Files
HKEY_CLASSES_ROOT\.exe\shell
HKEY_CLASSES_ROOT\.exe\shell\open
HKEY_CLASSES_ROOT\.exe\shell\open\command
HKEY_CLASSES_ROOT\.exe\shell\runas
HKEY_CLASSES_ROOT\.exe\shell\runas\command
HKEY_CLASSES_ROOT\.exe\shell\start
HKEY_CLASSES_ROOT\.exe\shell\start\command
HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\.exe\shell
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start\command
HKEY_CURRENT_USER\Software\Classes\secfile
HKEY_CURRENT_USER\Software\Classes\secfile\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\secfile\shell
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command
HKEY_CURRENT_USER\Software\Classes\secfile\shell\runas
HKEY_CURRENT_USER\Software\Classes\secfile\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\secfile\shell\start
HKEY_CURRENT_USER\Software\Classes\secfile\shell\start\command
HKEY_CURRENT_USER\Software\Microsoft\Windows\Identity=1117626655
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\ StartMenuInternet IEXPLORE.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\ StartMenuInternet\IEXPLORE.EXE\shell\open\command “C:\Documents and Settings\malwarehelp.org\Local Settings\Application Data\ave.exe” /START “C:\Program Files\Internet Explorer\iexplore.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\ “C:\Documents and Settings\malwarehelp.org\Local Settings\Application Data\ave.exe” /START “C:\Program Files\Mozilla Firefox\firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\ C:\Documents and Settings\malwarehelp.org\Local Settings\Application Data\ave.exe” /START “C:\Program Files\Mozilla Firefox\firefox.exe” -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride=1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall=0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications=1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall=0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions=0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications=1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall=0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications=1
Popular Search Terms
Remove Ave.exe
Delete Ave.exe
Uninstall Ave.exe
How to get rid of Ave.exe
How to remove Ave.exe
Ave.exe removal
Ave-exe
Warning! If Spyware Doctor is blocked by the virus then run your system in safe mode and try again. To do this reboot your system and tap F8 repeatedly as your computer starts up. Then run Spyware Doctor as normal.
Posted under Fake Antispyware | 3 Comments
Posted by james on Friday, April 16th, 2010
Thank you!!!
Posted by Christina on Thursday, April 22nd, 2010
Thank you! We don't know what website we got it from, we were just searching for camp grounds.
Posted by TMG3 on Sunday, April 25th, 2010
This is an odd one, it's on a friends computer and I've not been able to remove it, usually I don't have any trouble deleting these sorts of things but this one's a nightmare.
Registry and whatnot isn't a problem, the issue is that the ave.exe files are hidden, they don't show up with hidden files on or during a search (both on windows and using cmd). Thus I can't delete them. Any idea how to view the files?