(Thanks to rogueamp)
AntiVirus Solution 2010 is a typical rogue security program. Once installed, it will constantly display fake security warnings and popups about non-existent infections or system security problems. It will claim that your computer is being used as spamming machine or that your sensitive information can be stolen. Please ignore the fake AntiVirus Solution 2010 alerts. They were made only to scare you into thinking that your computer is infected. Furthermore, AntiVirus Solution 2010 will hijack Internet Explorer and block certain websites. It will display a fake message about insecure browsing. The fake message reads:
Reported Insecure Browsing: Navigation BlockedAs you can see, AntiVirus Solution 2010 is nothing more but a scam. It goes without saying that you should remove it from your computer as soon as possible. You can choose to remove it manually or use anti-malware software. If you have unadvisedly purchased it, then you should contact your credit card company and dispute the charges. If the payment was already made, then consider canceling your credit card. If you have any additional information or questions about AntiVirus Solution 2010, please leave a comment. Good luck and be safe online!
Insecure Internet Activity. Threat of virus attack
Due to insecure Internet browsing your PC can easily get infected with viruses, worms, and trojans without your knowledge, and that can lead to system slowdown, freezes and crashes. Also insecure Internet activity can result in revealing your personal information.
AntiVirus Solution 2010 removal instructions (in Safe Mode with Networking):
1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm
NOTE: Login as the same user you were previously logged in with in the normal Windows mode.
2. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as Auto Infoistrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
AntiVirus Solution 2010 removal instructions using HijackThis or Process Explorer (in Normal mode):
1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it.
2. Search for such entry in the scan results:
O4 - HKCU\..\Run: [AntiVirus Solution 2010] "%UserProfile%\Application Data\AntiVirus Solution 2010\AntiVirus_Solution_2010.exe" /STARTUP
Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.
OR you may download Process Explorer and end AntiVirus Solution 2010 processes:
- AntiVirus_Solution_2010.exe
- securitycenter.exe
- securityhelper.exe
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as Auto Infoistrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
AntiVirus Solution 2010 associated files and registry values:
Files:
- %UserProfile%\Application Data\AntiVirus Solution 2010\
- %UserProfile%\Application Data\AntiVirus Solution 2010\AntiVirus_Solution_2010.exe
- %UserProfile%\Application Data\AntiVirus Solution 2010\securitycenter.exe
- %UserProfile%\Application Data\AntiVirus Solution 2010\securityhelper.exe
- %UserProfile%\Application Data\AntiVirus Solution 2010\taskmgr.dll
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Solution 2010.lnk
- %UserProfile%\Start Menu\Programs\AntiVirus Solution 2010.lnk
- %UserProfile%\Start Menu\Programs\AntiVirus Solution 2010\
- %UserProfile%\Start Menu\Programs\AntiVirus Solution 2010\Activate AntiVirus Solution 2010.lnk
- %UserProfile%\Start Menu\Programs\AntiVirus Solution 2010\AntiVirus Solution 2010.lnk
- %UserProfile%\Start Menu\Programs\AntiVirus Solution 2010\Help AntiVirus Solution 2010.lnk
- %UserProfile%\Start Menu\Programs\AntiVirus Solution 2010\How to Activate AntiVirus Solution 2010.lnk
- %Temp%\02c9c3c35bdx5.exe
- %Temp%\17dkf.exe
- %Temp%\1iowieoo.exe
- %Temp%\2010yo.exe
- %Temp%\472a10e2ebxd9.exe
- %Temp%\56493.exe
- %Temp%\8gmsed-bd.exe
- %Temp%\a75wef8e0e7.exe
- %Temp%\ae0965a7157cd.exe
- %Temp%\al3erfa3.exe
- %Temp%\aler3fa.exe
- %Temp%\alerfa.exe
- %Temp%\alerfa2.exe
- %Temp%\alerfa322.exe
- %Temp%\aqfitrlxi2.exe
- %Temp%\backd-efq.exe
- %Temp%\brdss.exe
- %Temp%\bzqa43d.exe
- %Temp%\cffd4.exe
- %Temp%\cosock.exe
- %Temp%\cowceb.exe
- %Temp%\cunifuc.exe
- %Temp%\dc_3.exe
- %Temp%\dd10x10.exe
- %Temp%\ddhelp.exe
- %Temp%\ddoll3342.exe
- %Temp%\destroyer.exe
- %Temp%\dkfjd93.exe
- %Temp%\ds7hw.exe
- %Temp%\dwl_bqz.exe
- %Temp%\eelnvd13.exe
- %Temp%\eephilpe.exe
- %Temp%\exppdf_w.exe
- %Temp%\fadz43.exe
- %Temp%\fe.exe
- %Temp%\format.exe
- %Temp%\g_dx234.exe
- %Temp%\gedx_ae09.exe
- %Temp%\gpdfsws_bbg.exe
- %Temp%\gpupz2a.exe
- %Temp%\hardwh.exe
- %Temp%\hhbboll_2.exe
- %Temp%\hiphop.exe
- %Temp%\hjkgfddd.exe
- %Temp%\hodeme.exe
- %Temp%\htfad4.exe
- %Temp%\hvipws9.exe
- %Temp%\jdhellwo3.exe
- %Temp%\jofcdks.exe
- %Temp%\kgn.exe
- %Temp%\kilslmd.exex
- %Temp%\kjdh_gf_jjdhgd.exe
- %Temp%\kjh102k3.exe
- %Temp%\kn.a.exe
- %Temp%\kock.exe
- %Temp%\ljts-23.exe
- %Temp%\lkhgg_ea.exe
- %Temp%\lols.exe
- %Temp%\lorsk.exe
- %Temp%\ploper.exe
- %Temp%\poertd.exe
- %Temp%\ppddfcfux.exxe
- %Temp%\pswwg3c.exe
- %Temp%\puzpup.exe
- %Temp%\qwedvor.exe
- %Temp%\qwklrvjhqlkj.exe
- %Temp%\r0life.exe
- %Temp%\rator.exe
- %Temp%\rsrtd12.exe
- %Temp%\rtfme.exe
- %Temp%\safe.exe
- %Temp%\snowif.exe
- %Temp%\sycre.exe
- %Temp%\test.exe
- %Temp%\timem.exe
- %Temp%\w32-reno-c.exe
- %Temp%\warsddd_w.exe
- %Temp%\wefgetn_00.exe
- %Temp%\wergfq.exe
- %Temp%\wined.exe
- %Temp%\winlogoff.exe
- %Temp%\wqefqw7e.exe
- %Temp%\wrcud12.exe
- %Temp%\wrfwe_di.exe
- %Temp%\wwautrsd.exe
- %Temp%\wwwsssgen.exe
C:\Documents and Settings\[UserName]\ (in Windows 2000/XP)
C:\Users\[UserName]\ (in Windows Vista & Windows 7)
%Temp% refers to:
C:\Documents and Settings\[UserName]\Local Settings\Temp (for Windows 2000/XP)
C:\Users\[UserName]\AppData\Local\Temp (for Windows Vista & Windows 7)
Registry values:
- HKEY_CURRENT_USER\Software\AntiVirus Solution 2010
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirus Solution 2010
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "2kowmeuswvw3"
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "AntiVirus Solution 2010"Share this information with other people:
No comments:
Post a Comment