Win 7 Antivirus Pro

Win 7 Antivirus Pro is seeing a resurgence in popularity. Make no mistake; Win 7 Antivirus Pro is malware, and Win 7 Antivirus Pro is far from unique or new. Don't buy into the Win 7 Antivirus Pro scam, and don't give your money to the crooks behind this malware.

The Strange Malware “Family” of Win 7 Antivirus Pro

Win 7 Antivirus Pro is part of a rogue security program infection that behaves in a very distinctive, relatively sophisticated way. Win 7 Antivirus Pro is one of 33 fake security applications which – rather than being cloned from each other or from some earlier malware – are just the same malware naming itself differently on each computer Win 7 Antivirus Pro infects. So, actuality, there is just one threat that goes by these 33 different names, and Win 7 Antivirus Pro is only one of those names, and not a separate malware threat. The real name of this threat is Win32/FakeRean, and Win32/FakeRean has been around since at least spring 2010.

Win32/FakeRean names itself after Win32/FakeRean infects your PC, after Win32/FakeRean has detected which version of Windows you have. So, if you are running Windows 7, Win32/FakeRean will name itself something that includes "Win 7," followed by one of eleven different endings. Win 7 Antivirus Pro is just one of eleven names that Win32/FakeRean can take when Win32/FakeRean infects a Windows 7 system. Likewise, Win32/FakeRean has eleven different names that Win32/FakeRean uses for computers running Windows XP, and eleven names for computers running Windows Vista. Therefore, the symptoms for all of these seemingly separate infections are the same, because they are literally identical with the exception of their names.

Signs of Infection with Win 7 Antivirus Pro

Win 7 Antivirus Pro will make changes to the system registry, and those changes will become evident the first time you start Windows after the malware has installed itself. Win 7 Antivirus Pro will run every time Windows starts, and in order to simulate a scan of your computer, Win 7 Antivirus Pro will display a fake scanner interface, where Win 7 Antivirus Pro will show a progress bar animation. This phony scan will always, without fail, return lists of results, indicating that your computer is at risk from multiple viruses and malicious programs. Then, Win 7 Antivirus Pro will tell you that Win 7 Antivirus Pro has not been "activated," and in order to remove the threats Win 7 Antivirus Pro claims to have found, you need to pay a license fee. Sometimes, Win 7 Antivirus Pro will even display a fake interface that looks like the Windows 7 Action Center, with a status warning that your anti-virus protection has been turned off. As realistic as it may at first appear, the fake Action Center interface and its status indicators are just another way that Win 7 Antivirus Pro tries to convince you that Win 7 Antivirus Pro is a Windows component and that you have to pay the money that Win 7 Antivirus Pro demands.

If you wait through the fake scans, the Win 7 Antivirus Pro interface will eventually clear, allowing you to view the desktop. However, that doesn't mean that you are free from the hassle or danger created by having Win 7 Antivirus Pro on your system. You will not be able to open any other program, except your web browser, because Win 7 Antivirus Pro will make changes to the registry that cause all .exe files to be associated with Win 7 Antivirus Pro, and not with Explorer. If you think that the availability of your web browser is cause for hope, think again; Win 7 Antivirus Pro only leaves it alone so that Win 7 Antivirus Pro can be manipulated. When you try to go online, Win 7 Antivirus Pro will redirect you to Win 7 Antivirus Pro's own payment site, and that will be the only site that you are able to view without getting redirected or seeing an error message.

When it comes to scary-sounding error messages, Win 7 Antivirus Pro takes the cake. Win 7 Antivirus Pro tries very hard to get you to believe that purchasing a Win 7 Antivirus Pro license is your only hope of avoiding disaster. Pop-up security alerts will appear extremely frequently, with text that begins with things like "Firewall alert," "Severe damage," "Stealth intrusion," or "Tracking software found." These alerts will tell you that your computer is under attack in one way or another, but all of that is false. The alerts only exist in order to scare you into going to the payment page for Win 7 Antivirus Pro, so that you will hand over your credit card number in exchange for a nonexistent software license.

How Win 7 Antivirus Pro Infects a PC

Win 7 Antivirus Pro typically is installed by a Trojan. What happens is that the Win32/FakeRean Trojan is hidden in a fake update for a video player or other program, or Win 7 Antivirus Pro is bundled with a freeware download or a file downloaded from a peer-to-peer service. Occasionally, Win 7 Antivirus Pro may even be installed by a fake online virus scan or some other browser exploit. In any case, once you have downloaded the Trojan, it checks to see which version of Windows you are using, names itself, drops the files that it needs, and changes the registry. You will not know that you have downloaded anything unusual, or that anything unusual has happened, until you restart your computer and find that Win 7 Antivirus Pro is holding it hostage.

Win 7 Antivirus Pro needs to be treated with caution, because it is not enough to remove the malware and the alterations that Win & Antivirus Pro has made to the registry. You have to restore your settings to the way they were before, just to get basic functions of the Windows operating system to work again. The best prevention against infection with Win 7 Antivirus Pro and the best way to remove Win 7 Antivirus Pro, is to use real, legitimate anti-virus software.

File System Details

Win 7 Antivirus Pro may create the following file(s):
# File Name Detections
1. %UserProfile%\AppData\Local\av.exe
2. %UserProfile%\AppData\Local\WRblt8464P

Registry Details

Win 7 Antivirus Pro may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command =/START -safe-mode

Related Posts

Trending

Most Viewed

Loading...