In Need Of Advice On Manually Removing Spyware

[Tribe171]

Last night I was infected with XP Guardian. I immediately recognized that it was a fake security program. With help from this site and by using Malwarebytes Anti-Malware I was able to eliminate and neutralize most effects.

 I also downloaded a free version of Spyware Doctor. I had Malwarebytes, AVG Free 9.0, Spybot - Search & Destroy, and CCleaner installed prior to the attack. I scanned my PC with all 4 and was able to remove all infections. However, Spyware Doctor scanned and came up with about 20 infections that the others didn't pick up. It's good that it found the infections, but since the free trial version doesn't remove infections my only choice was to get rid of the viruses manually.

The scan results listed 6 Adware infections, 5 Trojans, and 9 spyware infections by the name "RogueAntiSpyware.XPAntispyware". By editing the registry I was able to get rid of the Adware and Trojans no problem. But the problem is removing the spyware.

7 spyware infections are listed as "Registry Value to be Repaired":

- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile, EnableFirewall

- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile, EnableFirewall

- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile, DoNotAllowExceptions

- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile, DisableNotifications

- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile, DisableNotifications

- HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command, (Default)

-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess, Start

As previously stated, editing the registry is not a problem. I'm cautious because it says "Registry Value to be repaired". My question is, can I get rid of the spyware by deleting the registry values? Or do I really have to repair the values? If I do have to repair the values, how do would I do that?

My second question is about the other 2 spyware infections. They are listed as "Startup Program":

- HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command, (Default) = "C:\Documents and Settings\family\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Fi.../firefox.exe"

- HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command, (Default) = "C:\Documents and Settings\family\Local Settings\Application Data\av.exe" /START "C:\Program Files\Intern

How do I go about removing these? I really have no idea how. Thanks for any help ahead of time.