Mar 09

Threat Description:

Win 7 Internet Security 2010 is a sample of rogue anti-spyware at its worst. This unsafe program infects Windows 7 based Operating Systems that turn out to be incapable of resisting the attack of a trojan downloader carrying the dangerous load of the scam software in question. Win 7 Internet Security 2010 adds some registry keys that subsequently compel the compromised system to execute the associated corrupt process known as ‘Av.exe’. Once this is done, every boot of your system will be followed by an automatically launched alleged security scanner that pops up regardless of whether the user likes it or not. This scan will mimic a virus check on your PC. It will report tons of infections when through with the scan procedure. Then, Win 7 Internet Security 2010 recommends its victims to purchase its full version after clicking on the ‘Registration’ button. In that case, people get rerouted to Win 7 Internet Security 2010 official site that appears to be tied up to the billing (payment) system serving this scareware campaign. We have mentioned only one annoying component of Win 7 Internet Security 2010 activity – its scanners. There is much more though; this rogue software also tends to trigger many popup ads (system tray notifications, balloon messages etc.) to make it yet more obvious to the user that he/she needs to take care of some serious security threats and similar issues. These alerts are not trustworthy either. We advise that you treat Win 7 Internet Security 2010 with great caution. This program is a wicked parasite and needs removing.

Determine if your system is infected with Win 7 Internet Security 2010 and related threats:

Win 7 Internet Security 2010 Screenshot:

Win 7 Internet Security 2010

How to remove this threat manually:

Win 7 Internet Security 2010 manual uninstall procedure:

Get rid of the related corrupt files:

  • %Documents and Settings%\[UserName]\Application Data\av.exe
  • %Documents and Settings%\[UserName]\Application Data\WRblt8464P

Delete the associated registry entries:

  • HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1″ %*
  • HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1″ %*
  • HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1″ %*
  • HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1″ %*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “av.exe” /START “iexplore.exe”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1″
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1″

Please note that Win 7 Internet Security 2010 manual removal is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may cause irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download Win 7 Internet Security 2010 Removal Tool

Leave a Reply