Home Malware Programs Rogue Anti-Spyware Programs Win 7 Anti-Spyware 2011

Win 7 Anti-Spyware 2011

Posted: November 12, 2010

Win 7 Anti-Spyware 2011 uses different names to avoid being recognized as a malicious rogue anti-spyware product it is in reality. Any system dealing with a Win 7 Anti-Spyware 2011 infection will have security programs disabled, browsers hijacked and will be subjected to a stream of fake alerts and errors. The main purpose of Win 7 Anti-Spyware 2011 is to acquire your credit card number, but even as a passive resident on your hard drive it can cause serious damage. You should avoid all websites related to this rogue scanner and delete Win 7 Anti-Spyware 2011 no matter what it takes if your computer becomes its victim.

Avoiding the Win 7 Anti-Spyware 2011 Threat Before It Becomes a Problem

The best recourse is simply to avoid getting infected by Win 7 Anti-Spyware 2011 at all. This can be more difficult than it would be for other kinds of malware, because Win 7 Anti-Spyware 2011 uses a tremendous amount of alternate names! Win 7 Anti-Spyware 2011 may be known as:

  • Win 7 Anti-Virus 2011.
  • Win 7 Home Security 2011.
  • Win 7 Total Security 2011.
  • Win 7 Security 2011.
  • Win 7 Internet Security 2011.
  • Any of the above variants, with 'Win 7' replaced by 'Vista' or 'XP,' as is appropriate for your operating system.
  • Any of the above, only without the 2011!.

All of these products are, in fact, the same rogue anti-spyware infection, and should be treated the same. Many use trojans and free file-sharing websites to spread and most maintain malicious websites. Thus, generally applicable security settings and safe browsing habits will do a great deal for helping your system avoid the many heads of the Win 7 Anti-Spyware 2011 hydra.

Consequences to Letting Win 7 Anti-Spyware 2011 Bite You

If your system does become infected by Win 7 Anti-Spyware 2011, you'll immediately notice frequent error messages and an unfamiliar process running in Task Manager. Win 7 Anti-Spyware 2011 uses registry abuse to run without your permission and creates these preset errors to force you to give away your money and financial information. It's advised to ignore all Win 7 Anti-Spyware 2011's attempts to get you to buy it, since even the registered version is definitely a problem rather than a problem-solver.

Win 7 Anti-Spyware 2011 can also use a proxy server to redirect your searches from search engines like Google, and may ultimately block every other website but its own via fake insecure website errors. This has been reported to occur in all popular browsers, including Chrome.

The other significant attack by Win 7 Anti-Spyware 2011 is focused on your security and diagnostic software. If you try to run any genuine security software, Win 7 Anti-Spyware 2011 will attempt to shut it down with an error similar to this one:

Win 7 Anti-Spyware 2011 Firewall Alert
Win 7 Anti-Spyware 2011 has blocked a program from accessing the internet
Internet Explorer is infected with Trojan-BNK.Win32.Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.

These two problems can escalate to the point of making your computer about as functional as a rock, so don't feel any guilt about deleting Win 7 Anti-Spyware 2011, regardless of what it claims about its own value as a supposed 'security' product! The registration key 1147-175591-6550' may also help if you need to register this malware to remove Win 7 Anti-Spyware 2011 properly.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\AppData\Local\MSASCui.exe
    2 %UserProfile%\AppData\Local\opRSK
    3 %UserProfile%\AppData\Local\pw.exe
    4 %UserProfile%\Local Settings\Application Data\MSASCui.exe
    5 %UserProfile%\Local Settings\Application Data\opRSK
    6 %UserProfile%\Local Settings\Application Data\pw.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*HKEY_CURRENT_USER\Software\Classes\pezfileHKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-modeHKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*HKEY_CLASSES_ROOT\pezfileHKEY_CLASSES_ROOT\pezfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*

5 Comments

  • Ryan says:

    It seems another one is out there called MS Removal Tool...something like that
    It is basically the exact same thing as the Win 7 one but just diff name...probably the same program renamed. Be aware and carefull.

  • Emaline says:

    What if I already accepted and paid for it, how do I get a refund?

  • japrink says:

    I need win 7 anti spyware 2011

  • Eric says:

    Thanks for all of the info! I just went through this, and it's really frustrating and stressful. I could not use the internet at all. Eventually though, NORTONS deleted this trojan.

  • Jen says:

    I have never had Nortons on my computer system what so ever and I have this program on my laptop and i can\\\'t seem to remove it 🙁

Loading...