Win 7 Antivirus 2012

Win 7 Antivirus 2012 Description

Type: Trojan

ScreenshotWin 7 Antivirus 2012 is a dangerous application that affects users with the Windows 7 operating system. To be more accurate, Win 7 Antivirus 2012 is one of numerous possible names and skins for the Ppn.exe file process, which can affect most Windows systems. However, this process is known for changing its name and downloading skins specific to the user's operating system, with the Win 7 Antivirus 2012 rogue security application being one of those, corresponding to Windows 7.

Win 7 Antivirus 2012 Clones and Copies

There are dozens of known clones and copies of this rogue anti-virus application, all belonging to the FakeRean family, with new ones being released every day. However, most of these fake security tools correspond to the same underlying process, Ppn.exe. There are other similar files, usually with names that are three seemingly random letters long. Ppn.exe and similar processes download specific themes and skins when they are installing themselves into a user's computer. There are three sets of Win 7 Antivirus 2012 clones that are currently known. Each of these sets has dozens of different possible names and skins that correspond to three of the most common Windows operating systems. These are Windows XP, Windows Vista, and Windows 7. Win 7 Antivirus 2012 will only show up on Windows 7 machines, and the corresponding programs for other operating systems can be named something like XP Anti-Virus 2012, or Vista Anti-Virus 2012.

Other clones of Win 7 Antivirus 2012 include Windows Antivirus 2008, Vista Antivirus 2008, Antivirus Pro 2009, AntiSpy Safeguard, ThinkPoint, Spyware Protection 2010, Internet Antivirus 2011, Palladium Pro, XP Anti-Virus 2011, CleanThis, PC Clean Pro, XP Home Security 2012, Windows Clear Problems, XP Security 2012, Antivirus PRO 2015.

Background and Foreground of Win 7 Antivirus 2012 Actions

Win 7 Antivirus 2012 performs two main functions. On the foreground, completely visible to the user, is a series of escalating system alerts and fake virus scans. These alerts are designed to alarm, causing the panicked computer user to enter his credit card information to save the data on his computer. On the background, completely hidden, Win 7 Antivirus 2012 uses its partner, a Trojan, to perform dangerous modifications to the user's system. These modifications can compromise the computer's security, report the user's browsing habits and personal information to a third party, and make it next to impossible to remove manually Win 7 Antivirus 2012.

Special Removal Considerations for Win 7 Antivirus 2012

The best way to get rid of Win 7 Antivirus 2012 is by using a trustworthy anti-virus or anti-malware utility. It is also possible to remove Win 7 Antivirus 2012 manually, by deleting the registry entries, DLL files, and processes associated with Win 7 Antivirus 2012. However, this can be somewhat difficult because the Trojan that installed Win 7 Antivirus 2012 blocks the Task Manager and essential system files, under the pretext that they have been infected. There's a couple of steps specific to the removal of the Ppn.exe process that can be also used to remove Win 7 Antivirus 2012. First of all is entering a registration key proven to work. These registration key changes every day, and can be found with a quick search on the Internet. This will not remove Win 7 Antivirus 2012 but will remove most of the system alerts and annoying pop-up notifications. Another step that can help is changing the system date, setting it one full week ahead. If an infected user does these two things, he/she may gain access to the necessary parts of the computer for removing Win 7 Antivirus 2012.ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

Technical Information

Screenshots & Other Imagery

Win 7 Antivirus 2012 Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

Win 7 Antivirus 2012 creates the following file(s):
# File Name Detection Count
1 %AppData%\Local\[RANDOM CHARACTERS].exe N/A
2 %AppData%\Roaming\Microsoft\Windows\Templates\[RANDOM CHARACTERS] N/A
3 %AppData%\Local\[RANDOM CHARACTERS] N/A
4 %AllUsersProfile%\[RANDOM CHARACTERS] N/A
5 %Temp%\[RANDOM CHARACTERS] N/A

Registry Details

Win 7 Antivirus 2012 creates the following registry entry or registry entries:
Registry key
HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon "(Default)" = '%1'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "IsolatedCommand" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon "(Default)" = '%1' = '"%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS].exe" /START "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS].exe" /START "%Program Files%\Internet Explorer\iexplore.exe"'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command "IsolatedCommand" – '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command "(Default)" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "(Default)" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\.exe "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\exefile "(Default)" = 'Application'
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS].exe" /START "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS].exe" /START "%Program Files%\Mozilla Firefox\firefox.exe"'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS].exe" /START "%1" %*'
HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'exefile'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "IsolatedCommand" = '"%1" %*'
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS].exe" /START "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS].exe" /START "%Program Files%\Mozilla Firefox\firefox.exe" -safe-mode'

More Details on Win 7 Antivirus 2012

The following messages associated with Win 7 Antivirus 2012 were found:
Attention: DANGER!
ALERT! System scan for spyware, adware, trojans and viruses is complete.
Win 7 Antivirus 2012 detected 35 critical system objects.
System danger!
Your system is in danger. Privacy threats detected.
Spyware, keyloggers or Trojans may be working in the
background right now. Perform an in-depth scan and removal
now, click here.
Win 7 Antivirus 2012 ALERT
Internet Explorer alert. Visiting this site may pose a security threat to your system

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.