Win 7 Anti-Spyware 2011

The crooks behind Win 7 Anti-Spyware 2011 apparently think that they can fool people into thinking that their malware is a security program by adding "2011" onto the end of its name. Win 7 Anti-Spyware 2011 is nothing but a scam, created specifically to scare PC users into thinking their computers are infected with malware that only a paid version of Win 7 Anti-Spyware 2011 can remove. The truth is, Win 7 Anti-Spyware 2011 can't detect or remove malware, because Win 7 Anti-Spyware 2011 is completely fake. Win 7 Anti-Spyware 2011 has no affiliation with Microsoft, and Win 7 Anti-Spyware 2011 is not a pre-installed Windows program, contrary to what Win 7 Anti-Spyware 2011 wants you to think.

What Win 7 Anti-Spyware 2011 Will Do to Your PC

In order to convince you to buy a worthless license for its fake security software, Win 7 Anti-Spyware 2011 uses a combination of scare tactics and disabling of your PC. While Win 7 Anti-Spyware 2011 is present on your computer, you really will not be able to do much with Win 7 Anti-Spyware 2011. Win 7 Anti-Spyware 2011 causes the following symptoms:

  • When Windows starts, Win 7 Anti-Spyware 2011 will load its fake user interface, which will use a Windows logo and may even mimic the appearance of the Action Center. This interface will show the progress of a fake scan, and then Win 7 Anti-Spyware 2011 will tell you that Win 7 Anti-Spyware 2011 has found dozens of serious threats on your computer. None of these threats is actually present, but Win 7 Anti-Spyware 2011 will urge you to remove them, and then tell you that Win 7 Anti-Spyware 2011 can't remove the bogus infections unless you purchase a license for Win 7 Anti-Spyware 2011.
  • Win 7 Anti-Spyware 2011 will run in the background while Windows runs, and Win 7 Anti-Spyware 2011 will generate constant pop-up security error messages or alerts. The pop-ups will start with phrases like "Severe damage!" or "System hijack!" and then include some very vague descriptions of threats that Win 7 Anti-Spyware 2011 claims to detect. One way or another, the pop-up alerts will try to get you to purchase a license for Win 7 Anti-Spyware 2011, in order to protect your PC from these bogus attacks.
  • Win 7 Anti-Spyware 2011 will make changes to the Registry, in order to make the malware removal very difficult. For example, Win 7 Anti-Spyware 2011 will prevent Windows from using Explorer to run .exe files, so that every time you try to use a program other than Win 7 Anti-Spyware 2011 or your web browser, the program will fail to run. Win 7 Anti-Spyware 2011 will also hijack your web browser, preventing you from visiting any sites other than the payment site for the Win 7 Anti-Spyware 2011 scam
  • Win 7 Anti-Spyware 2011 may run while Windows is in Safe Mode, indicating the presence of a rootkit infection alongside the rogue anti-spyware program.

Win 7 Anti-Spyware 2011 is a grave threat to your computer's security, rather than offering you any protection. In order to remove Win 7 Anti-Spyware 2011, you will need proper anti-virus software or very experienced technical support. Don't be fooled into thinking that paying the money that Win 7 Anti-Spyware 2011 asks for will somehow change things or make anything easier. If you pay the money, Win 7 Anti-Spyware 2011 will continue to demand money, and you will not be any closer to getting this fake security program off of your PC.

Where Did Win 7 Anti-Spyware Come From, Anyway?

Win 7 Anti-Spyware 2011 is one name that is used by a Trojan dropper called the "multi-rogue," or more formally, Win32/FakeRean. The Trojan is usually hidden in a freeware or pirated download, a fake video codec, or a spam email attachment, so that you will download the Trojan without knowing. Once it is downloaded, the Trojan checks to see which version of Windows you have installed, and it names the fake security software that it installs in order to match your operating system. So if you have Windows 7 on your computer, the Trojan will use a name that starts with "Win 7" and uses a phrase taken at random from a list in order to round out the name. The Trojan will drop the files for Win 7 Anti-Spyware 2011, and name its main application file randomly, using a string of three letters. Win 7 Anti-Spyware 2011 is known to disguise this installation process as a Windows update, in order to avoid suspicion.

Win32/FakeRean has been around since early 2010, and it has been very problematic ever since. Win 7 Anti-Spyware 2011 is only one of more than thirty names that Win32/FakeRean can use, which creates the illusion that there is more than one fake security program at work. What is really going on with Win 7 Anti-Spyware 2011 is that Win 7 Anti-Spyware 2011 is a huge money-making operation for Russian con-artists. If you think about it, why would you ever pay the people who screwed up your computer? Win 7 Anti-Spyware 2011 is simply not trustworthy.

File System Details

Win 7 Anti-Spyware 2011 may create the following file(s):
# File Name Detections
1. %UserProfile%\Local Settings\Application Data\MSASCui.exe
2. %UserProfile%\AppData\Local\MSASCui.exe
3. %UserProfile%\AppData\Local\pw.exe
4. %UserProfile%\Local Settings\Application Data\pw.exe
5. %UserProfile%\Local Settings\Application Data\opRSK
6. %UserProfile%\AppData\Local\opRSK

Registry Details

Win 7 Anti-Spyware 2011 may create the following registry entry or registry entries:
HKEY_CLASSES_ROOT\pezfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_CLASSES_ROOT\pezfile
HKEY_CURRENT_USER\Software\Classes\pezfile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"

1 Comment

computer repairs melbourne Reply

Common symptoms of spywares include popup ads on our desktop, redirection to particular pages when we open our browser, changes in system or browser settings such as our browser home page .To protect our data backup should be maintain and different tools should be used, thanks a lot

Trending

Most Viewed

Loading...