Win 7 Home Security 2011 virus – how to get rid

February 20, 2011 By

Theres a new malicious program known as Win 7 Home Security 2011. This piece of software belongs to fake antivirus and antispywares of rogue virus family that keep changing names and interface but use the same tactics to trick users into buying these bogus tools. Win 7 Home Security 2011 malwares gets into a computer with the help of downloader trojans and worms from malicious websites that drop this parasite into a computer secretly. After getting into a computer, this virus installs its additional components and then it runs its fake scanner utility on the infected computer each time the system is rebooted. The fake antivirus scan of Win 7 Home Security 2011 virus generates some scan results with fake error reports. It frequently displays warnings messages and threat alert popups to scare user. These popups tell the user that Win 7 Home Security 2011 has detected some viruses and spywares onto your computer that must be removed very soon to protect your system from further damages. All these Alerts and warning messages are fake, they do not belongs to the infected computer as they are tricky messages to convince user buying Win 7 Home Security 2011 to get rid of those viruses.

Remember! warning messages and alerts displayed by Win7 Home Security virus are fake. This program is specially designed to extort your money by offering you to buy its fake system security and optimization products. it has no ability to detect and remove viruses from your computer. You should ignore these warnings, avoid buying this program, avoid its installation and immediately remove it from your computer upon detection.

How to get rid of Win 7 Home Security 2011 virus manually:

To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.
Stop Win 7 Home Security 2011 processes:
[random name].exe

Remove 7 Home Security 2011 Registry Entries:
HKEY_CURRENT_USER\Software\Classes\.exe “(Default)” = ‘exefile’
HKEY_CURRENT_USER\Software\Classes\.exe “Content Type” = ‘application/x-msdownload’
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon “(Default)” = ‘%1′ = ‘”%UserProfile%\Local Settings\Application Data\[random 3 letters].exe” /START “%1″ %*’
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “IsolatedCommand” = ‘”%1″ %*’
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command “(Default)” = ‘”%1″ %*’
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command “IsolatedCommand” = ‘”%1″ %*’
HKEY_CURRENT_USER\Software\Classes\exefile “(Default)” = ‘Application’
HKEY_CURRENT_USER\Software\Classes\exefile “Content Type” = ‘application/x-msdownload’
HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon “(Default)” = ‘%1′
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command “(Default)” = ‘”%UserProfile%\Local Settings\Application Data\[random 3 letters].exe” /START “%1″ %*’
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command “IsolatedCommand” = ‘”%1″ %*’
HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command “(Default)” = ‘”%1″ %*’
HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command “IsolatedCommand” – ‘”%1″ %*’
HKEY_CLASSES_ROOT\.exe\DefaultIcon “(Default)” = ‘%1′
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = ‘”%UserProfile%\Local Settings\Application Data\[random 3 letters].exe” /START “%1″ %*’
HKEY_CLASSES_ROOT\.exe\shell\open\command “IsolatedCommand” = ‘”%1″ %*’
HKEY_CLASSES_ROOT\.exe\shell\runas\command “(Default)” = ‘”%1″ %*’
HKEY_CLASSES_ROOT\.exe\shell\runas\command “IsolatedCommand” = ‘”%1″ %*’
HKEY_CLASSES_ROOT\exefile “Content Type” = ‘application/x-msdownload’
HKEY_CLASSES_ROOT\exefile\shell\open\command “IsolatedCommand” = ‘”%1″ %*’
HKEY_CLASSES_ROOT\exefile\shell\runas\command “IsolatedCommand” = ‘”%1″ %*’
HKEY_CLASSES_ROOT\exefile\shell\open\command “(Default)” = ‘”%UserProfile%\Local Settings\Application Data\[random 3 letters].exe” /START “%1″ %*’
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = ‘”%UserProfile%\Local Settings\Application Data\[random 3 letters].exe” /START “C:\Program Files\Mozilla Firefox\firefox.exe”‘
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = ‘”%UserProfile%\Local Settings\Application Data\[random 3 letters].exe” /START “C:\Program Files\Mozilla Firefox\firefox.exe” -safe-mode’
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = ‘”%UserProfile%\Local Settings\Application Data\[random 3 letters].exe” /START “C:\Program Files\Internet Explorer\iexplore.exe”‘

Remove Win 7 Home Security 2011 files:
%AllUsersProfile%\t3e0ilfioi3684m2nt3ps2b6lru
%AppData%\Local\[random].exe (look for 3-letter names)
%AppData%\Local\t3e0ilfioi3684m2nt3ps2b6lru
%AppData%\Roaming\Microsoft\Windows\Templates\t3e0ilfioi3684m2nt3ps2b6lru
%Temp%\t3e0ilfioi3684m2nt3ps2b6lru

Auto Removal

To remove this virus Automatically, We suggest following tools:

Malware Bytes Anti-Malware

download Win 7 Home Security 2011 virus how to get rid
OR

Super Anti Spyware

download Win 7 Home Security 2011 virus how to get rid

Filed Under: 1: Spyware Removal Tagged With: , , , ,

Windows Express Help virus- how to get rid manually

February 18, 2011 By

Windows Express Help is another fake computer security software which claims to be a powerful spyware and virus removal tool although it is a virus itself. Windows Express Help is a part of rogue software scam that is designed by hackers who are trying to earn some extra money from innocent internet users by selling fake system security products. If your computer is infected with Windows Express Help, you must uninstall this virus immediately as this crap is totally useless and a bogus tool which has no ability to detect and fix virus or computer problems.

After getting into a computer with the help of trojans and malwares via malicious websites, Windows Express Help virus starts displaying popup alerts and warning messages telling you about virus detection and security threat alerts. It tries to scare user and convince user buying the full version of Windows Express Help tool to get rid of viruses. To promote its product, it display this fake error:

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a serious possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press ‘OK’ to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.


How to get rid of Windows Express Help virus manually:

To remove this virus manually, complete the following set of tasks. Do not forget to create a backup before getting started to the manual removal guide.
Stop Windows Express Help processes:
[random name].exe

Delete Windows Express Help Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = ‘%UserProfile%\Application Data\[random].exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’

Find and delete Windows Express Help files:
%UserProfile%\Application Data\[random].exe

Auto Removal

To remove this virus Automatically, We suggest following tools:

Malware Bytes Anti-Malware

download Windows Express Help virus how to get rid manually
OR

Super Anti Spyware

download Windows Express Help virus how to get rid manually

Filed Under: 1: Spyware Removal Tagged With: , , , ,