Vista Total Security 2011

Vista Total Security 2011 is malware, plain and simple. Not only is Vista Total Security 2011 totally incapable of detecting threats on your PC, but Vista Total Security 2011 also can't remove them, either. So when Vista Total Security 2011 suddenly tells you that your computer is infested with dozens of viruses, it's a good idea to be skeptical. Vista Total Security 2011's purpose is to scare you into paying for a Vista Total Security 2011 license, which doesn't exist. Of course, Vista Total Security 2011 has no affiliation with Microsoft, and its use of the Vista name and the Windows logo are part of the Vista Total Security 2011 scam.

What Vista Total Security 2011 Really is, and What it Will Do to Your Computer

Vista Total Security 2011 is what is generally referred to as malware. Vista Total Security 2011 is not a virus, and Vista Total Security 2011 doesn't want to go undetected. Rather, Vista Total Security 2011 wants you to notice Vista Total Security 2011, and it wants you to believe that Vista Total Security 2011 is something that Vista Total Security 2011 is not. Once Vista Total Security 2011 has installed itself on your computer, Vista Total Security 2011 cannot be ignored. Some of the signs that Vista Total Security 2011 has infected your PC are:

  • A fake home screen for Vista Total Security 2011 will load every time you start your computer. At this interface, Vista Total Security 2011 will run a fake scan of the system, and Vista Total Security 2011 will report a very large number of infections. None of these infections is actually on your computer. However, Vista Total Security 2011 will tell you that these bogus threats are very dangerous, and Vista Total Security 2011 will urge you to buy a license for the "full" version of Vista Total Security 2011 so that Vista Total Security 2011 can remove them.
  • While you try to use your computer, Vista Total Security 2011 will be constantly running in the background, generating phony security alerts. The alerts are very vague, and they always include frightening reports of attacks on your computer. Just like the scan results, these claims of attacks are false, and Vista Total Security 2011 uses them to try to scare you into buying a license.
  • Vista Total Security 2011 will do a few things to keep you from removing the malware from your PC, including preventing all of your other programs from running – except your web browser, which Vista Total Security 2011 will severely limit. When you try to view a website, Vista Total Security 2011 will redirect you to its own payment page. That payment page will be the only site you can visit.
  • Task Manager, Regedit, and the Control Panel will be unavailable, meaning that you will not be able to use them to remove Vista Total Security 2011. Also, Vista Total Security 2011 may run even while Windows is in Safe Mode.

So, as far as Vista Total Security 2011 is concerned, what you should watch out for are not the attacks that Vista Total Security 2011 reports; rather, you should distrust Vista Total Security 2011 itself. No amount of money or effort can turn Vista Total Security 2011 into a working security application, and you should always be suspicious about any program that can't be uninstalled.

Where Does Vista Total Security 2011 Come From?

Vista Total Security 2011 is sometimes referred to as a "clone" of other malicious programs, or as "related" to other rogue anti-virus applications, but both of those claims are wrong. Yes, there is other malware in the family of Vista Total Security 2011, but Vista Total Security 2011 is not just cloned from or related to that other malware – Vista Total Security 2011 is literally identical to that other malware. This is because there is one Trojan dropper, known as Win32/FakeRean, which names itself different things based on what it finds on the computers it infects, making up all of the malware in this family. Win32/FakeRean uses at least thirty-three different names. When it installs itself on your computer, it takes the first part of its name from the version of Windows that you're using, and the rest of its name is randomly selected from a list of phrases. Vista Total Security 2011 is simply one of the names that Win32/FakeRean can use when it infects a PC that is running Windows Vista.

If you're wondering where the Trojan dropper for Vista Total Security 2011 came from, there are many possibilities. The Trojan is generally hidden in something else that you download, such as a file from a peer-to-peer file sharing service, or a fake video codec required for viewing content on a questionable website. It is also possible for the Trojan to be downloaded to your computer when you view a malicious advertisement or a fake free scanner site. Once the Trojan is downloaded, it names the malware, drops the files for the fake security program, and uses a random string of three letters to name the main executable file for the malware. The Trojan may make it appear as if your PC is receiving a Windows Update; therefore these actions can be carried out without suspicion.

Vista Total Security 2011 and Win32/FakeRean go back to spring 2010, but with time, infections with this fake security application have become more common. Regardless of whether the malware calls itself Vista Total Security 2011 or something else, it is part of a large-scale Russian fraud.

File System Details

Vista Total Security 2011 may create the following file(s):
# File Name Detections
1. %UserProfile%\Local Settings\Application Data\[3 RANDOM LETTERS].exe
2. %AppData%\Local\[3 RANDOM LETTERS].exe
3. %AppData%\Local\t3e0ilfioi3684m2nt3ps2b6lru
4. %UserProfile%\Templates\t3e0ilfioi3684m2nt3ps2b6lru
5. %AppData%\t3e0ilfioi3684m2nt3ps2b6lru
6. %AllUsersProfile%\t3e0ilfioi3684m2nt3ps2b6lru
7. %Temp%\t3e0ilfioi3684m2nt3ps2b6lru
8. %AppData%\Roaming\Microsoft\Windows\Templates\t3e0ilfioi3684m2nt3ps2b6lru

Registry Details

Vista Total Security 2011 may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "IsolatedCommand" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon "(Default)" = '%1'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command "IsolatedCommand" - '"%1" %*'
HKEY_CLASSES_ROOT\exefile\shell\runas\command "IsolatedCommand" = '"%1" %*'
HKEY_CLASSES_ROOT\.exe\DefaultIcon "(Default)" = '%1'
HKEY_CLASSES_ROOT\.exe\shell\runas\command "(Default)" = '"%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[3 RANDOM LETTERS].exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"'
HKEY_CURRENT_USER\Software\Classes\.exe "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "(Default)" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CLASSES_ROOT\exefile "Content Type" = 'application/x-msdownload'
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[3 RANDOM LETTERS].exe" /START "%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[3 RANDOM LETTERS].exe" /START "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[3 RANDOM LETTERS].exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"'
HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'exefile'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[3 RANDOM LETTERS].exe" /START "%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile "(Default)" = 'Application'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command "(Default)" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon "(Default)" = '%1' = '"%UserProfile%\Local Settings\Application Data\[3 RANDOM LETTERS].exe" /START "%1" %*'
HKEY_CLASSES_ROOT\exefile\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\runas\command "IsolatedCommand" = '"%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[3 RANDOM LETTERS].exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'

Messages

The following messages associated with Vista Total Security 2011 were found:

Attention: DANGER!
ALERT! System scan for spyware, adware, trojans and viruses is complete.
Vista Total Security 2011 detected 35 critical system objects.
System danger!
Your system is in danger. Privacy threats detected.
Spyware, keyloggers or Trojans may be working in the
background right now. Perform an in-depth scan and removal
now, click here.
Vista Total Security 2011 ALERT
Internet Explorer alert. Visiting this site may pose a security threat to your system

1 Comment

That's a genuinely impressive answer.

Trending

Most Viewed

Loading...