Vista Security 2011

Vista Security 2011 Image

Vista Security 2011 is one of the titles being used by the name-changing rogue security program currently plaguing the Internet. Although Vista Security 2011 is just one piece of malware, this particular rogue security program names itself differently according to what Vista Security 2011 finds on each computer Vista Security 2011 infects; therefore, Vista Security 2011 will only occur on PC's running Windows Vista.

Signs that your Computer is Infected with Vista Security 2011

Because Vista Security 2011 is identical to so many of the other fake anti-virus applications out there, the symptoms of an infection with Vista Security 2011 are very run-of-the-mill. The phony home screen for Vista Security 2011 will appear every time you start your computer, and Vista Security 2011 will pretend to run a scan of the system. Do not let the interface's appearance fool you; it uses stolen Windows logos and icons to make itself appear more realistic – the results that Vista Security 2011 gives you are completely made up. In fact, every time a fake scan runs, Vista Security 2011 will say the same thing, which is Current PC State: Infected! Vista Security 2011 will tell you that the only way Vista Security 2011 can remove the "threats" Vista Security 2011 claims to have found is to purchase a license for the so-called full version of Vista Security 2011's software.

Vista Security 2011 will remind you to purchase a bogus license, and Vista Security 2011 will do it as frequently as it possibly can. You will see the same few error messages popping up over and over, and they always start with System hijack, Stealth intrusion, System danger, or even Security breach. The information provided in these alerts is always very nonspecific, but all of the warning messages will recommend that you "activate" Vista Security 2011. Vista Security 2011 will really provide a website you can visit in order to pay for Vista Security 2011, but it is nothing less than the endpoint of a scam. There are no licenses to be had, so please don't give the crooks your money!

In case you think that the ability to go online to a payment site is a sign that your Internet browser will work, allowing you to get help and remove the malware, think again. Vista Security 2011 will make sure that you can only visit Vista Security 2011's own malicious sites, and Vista Security 2011 will label all others as security risks. Similarly, Vista Security 2011 will do what it can in order to prevent you from removing Vista Security 2011 from your computer, by preventing all other programs from running. When you try to run another program, Vista Security 2011 will give you an error message that says that the program in question was shut down because it is malicious or somehow infected. Vista Security 2011 even says this about Task Manager, which is ridiculous. Of course, Vista Security 2011 is just making sure that Vista Security 2011 stays installed on your computer for as long as possible.

Where Does Vista Security 2011 Come From?

Like other rogue security applications, Vista Security 2011 typically infects PC's by way of a Trojan. The Trojan may be bundled with programs that you download from freeware sites or with files downloaded from peer-to-peer file sharing services, or it may be hidden in a fake security program update or video codec. The point is that you download the Trojan without being aware of it, so that the Trojan can then set up all of the necessary files for Vista Security 2011. After Vista Security 2011 is set up, Vista Security 2011 will be running the next time you start your computer.

As previously mentioned, Vista Security 2011 only infects machines that are running Windows Vista. This is because the malware does not name itself until it has evaluated your computer, and discovered which version of Windows you are using. Once it knows which version you are running, the malware names itself according to that version of Windows, and then selects from lists a combination of two words or a word and a year. Regardless of what Vista Security 2011 may call itself, this malware has been around since 2008, and Vista Security 2011 is generically referred to as Trojan.Win32/FakeRean. FakeRean has gone through several different versions, with the most recent appearing towards the end of February 2011.

File System Details

Vista Security 2011 may create the following file(s):
# File Name Detections
1. c:\Program Files\Vista Security 2011\VS2011.exe
2. c:\WINDOWS\system32\winlogon86.exe
3. c:\[RANDOM CHARACTERS].exe
4. c:\WINDOWS\system32\winupdate86.exe
5. %AppData%\Local\[RANDOM CHARACTERS].exe
6. Vista Security 2011.exe
7. c:\WINDOWS\system32\[RANDOM CHARACTERS].exe
8. c:\WINDOWS\system32\winhelper86.dll
9. %Temp%\t3e0ilfioi3684m2nt3ps2b6lru
10. %AllUsersProfile%\t3e0ilfioi3684m2nt3ps2b6lru
11. %AppData%\Roaming\Microsoft\Windows\Templates\t3e0ilfioi3684m2nt3ps2b6lru
12. c:\Program Files\Vista Security 2011
13. %AppData%\Local\t3e0ilfioi3684m2nt3ps2b6lru

Registry Details

Vista Security 2011 may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vista Security 2011
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "winupdate86.exe"
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile "(Default)" = 'Application'
HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon "(Default)" = '%1'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 LETTERS].exe" /START "%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\runas\command "IsolatedCommand" = '"%1" %*'
HKEY_CLASSES_ROOT\exefile\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 LETTERS].exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"'
HKEY_CURRENT_USER\Software\Vista Security 2011
HKEY_CURRENT_USER\Software\VS2011
HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'exefile'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "IsolatedCommand" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command "(Default)" = '"%1" %*'
HKEY_CLASSES_ROOT\.exe\DefaultIcon "(Default)" = '%1'
HKEY_CLASSES_ROOT\.exe\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CLASSES_ROOT\exefile\shell\runas\command "IsolatedCommand" = '"%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 LETTERS].exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Vista Security 2011"
HKEY_LOCAL_MACHINE\SOFTWARE\Vista Security 2011
HKEY_CURRENT_USER\Software\Classes\.exe "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "(Default)" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon "(Default)" = '%1' = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 LETTERS].exe" /START "%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 LETTERS].exe" /START "%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command "IsolatedCommand" - '"%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\runas\command "(Default)" = '"%1" %*'
HKEY_CLASSES_ROOT\exefile "Content Type" = 'application/x-msdownload'
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 LETTERS].exe" /START "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 LETTERS].exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'

1 Comment

internet security Reply

I read that fake antivirus software is making companies hundreds of millions of dollars and that the conversion rate of people purchasing the full version of the fake software is over 2%. These companies are so convincing they sometimes offer telephone technical support.

Trending

Most Viewed

Loading...