XP Internet Security 2010

I worked on a machine tonight with the virus XP Internet Security 2010. This thing is a pain just like it's predecessors.

Most instructions out there to manually clean the virus ask you to look for and kill the av.exe process and files and then go out and delete a handful of registry entries. The machine I was working on had those same registry entries, but instead of av.exe it was using MSASCui.exe.

So when trying to fix a machine that has been infected with XP Internet Security 2010 you should now be aware of at least two exe files it's using.

av.exe
MSASCui.exe

More variants are sure to follow.