Win 7 Internet Security is a rogue anti-spyware program. It usually spreads via Trojan installed to your computer. Once the PC is started the parasite loads fraudulent scans and displays imaginary real warnings and numerous security alerts. Those pop-ups are fake and you are fully safe to ignore it.

The aim of the malware is to trick user into paying small fees for buying full version of Win 7 Internet Security anti-spyware program. This is really not a good idea and it is not worth of spending your money. However, you have to choose decent anti-spyware program and remove the bogus system from your PC.

Manual removal:

Stop and remove Win 7 Internet Security processes:
av.exe

Locate and delete Win 7 Internet Security registry entries:
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "av.exe" /START "%1? %*"
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command "(Default)" = "av.exe" /START "%1? %*"
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "av.exe" /START "%1? %*"
HKEY_CLASSES_ROOT\secfile\shell\open\command "(Default)" = "av.exe" /START "%1? %*"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "av.exe" /START "firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "av.exe" /START "firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "av.exe" /START "iexplore.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"

Detect and delete other Win 7 Internet Security files:
av.exe
WRblt8464P

 

Related Topics :