Vista Anti-Virus 2011

Vista Anti-Virus 2011 is a rogue anti-virus product that uses fake alerts and inaccurate scans to terrify you into spending money on registering it. Among other problems it can cause, Vista Anti-Virus 2011 is highly likely to block genuine scanning software and hijack your web browser through a proxy server. You should avoid having anything to do with Vista Anti-Virus 2011 or its websites, since its existence is solely for sucking up money while giving you zero actual malware-fighting functions in exchange.

A Multitude of Names, But Just One Purpose

Vista Anti-Virus 2011 primarily spreads through Trojan infections, although it can also be downloaded intentionally from generic file-sharing sites with poor upload security. Vista Anti-Virus 2011 actually changes its name and appearance slightly depending on the system it's installed on, so you may also see it by many other nicknames. In all cases, the name of the operating system (XP, Vista, or Windows 7) will precede the rest of the title. The '2011' at the end is also a variable and may not appear in every individual infection.

Unlike the majority of rogue security products that run automatically when Windows starts up, Vista Anti-Virus 2011 restricts itself to running only when you start an application (or executable file). You shouldn't think that this makes Vista Anti-Virus 2011 a less harmful rogue anti-virus product, though, because it causes plenty of problems for any computer unfortunate enough to be its host.

Vista Anti-Virus 2011's Browser Hijacking and Other Deceitful Attacks

Although Vista Anti-Virus 2011 attacks the host system in various ways, a common theme to all tactics is the essential thread of deception. Vista Anti-Virus 2011 relies on lying to the user about the state of his or her computer to create fear and urgency, which the rogue anti-virus product attempts to capitalize on by getting you to buy a registration key. Since even the registered version of Vista Anti-Virus 2011 is completely unable to detect or fight malware threats, there's no reason to avoid deleting it. However, the registration key '1147-175591-6550' may prove useful in disabling some of Vista Anti-Virus 2011's functions to ease deletion.

You'll quickly feel the impetus to want to remove Vista Anti-Virus 2011 in short order, too, since it hampers both your web browsing and your ability to use your computer in general! Here's the potential damage tally:

• Vista Anti-Virus 2011 will close programs with fake infection error messages. Although it's most likely to occur with security software and system maintenance tools, any program can be shut down this way.
• Besides being a rogue anti-virus product, Vista Anti-Virus 2011 is also a browser hijacker. So far, Vista Anti-Virus 2011 has been confirmed to target Internet Explorer and Firefox, using a proxy server and more fake error message obfuscation to redirect you towards malicious sites.
• As a final irritant, Vista Anti-Virus 2011 will periodically annoy you with extra error messages about infections that aren't real, just to keep you on your toes. These files being pointed at are usually preexisting ones that your computer needs to keep running, so don't delete them hastily.

No matter what else you choose to do, Vista Anti-Virus 2011 will continue to display these messages and interfere with your computer use until you finally delete it. Since Vista Anti-Virus 2011 blocks many security programs, you may need to stop this rogue anti-virus product from running at all before you can successfully delete Vista Anti-Virus 2011 from your machine.

File System Modifications

• The following files were created in the system:
  

  #	File Name
  1	%AppData%\hee.exe

Registry Modifications

• The following newly produced Registry Values are:
  HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Classes\.exeHKEY_CURRENT_USER\Software\Classes\.exe | @ = "pezfile"HKEY_CURRENT_USER\Software\Classes\.exe | Content Type = "application/x-msdownload"HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIconHKEY_CURRENT_USER\Software\Classes\.exe\shellHKEY_CURRENT_USER\Software\Classes\.exe\shell\openHKEY_CURRENT_USER\Software\Classes\.exe\shell\open\commandHKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | @ = ""%AppData%\hee.exe" /START "%1? %*"HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | IsolatedCommand = ""%1? %*"HKEY_CURRENT_USER\Software\Classes\.exe\shell\runasHKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\commandHKEY_CURRENT_USER\Software\Classes\.exe\shell\startHKEY_CURRENT_USER\Software\Classes\.exe\shell\start\commandHKEY_CURRENT_USER\Software\Classes\pezfileHKEY_CURRENT_USER\Software\Classes\pezfile\DefaultIconHKEY_CURRENT_USER\Software\Classes\pezfile\shellHKEY_CURRENT_USER\Software\Classes\pezfile\shell\openHKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\commandHKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command | @ = ""%AppData%\hee.exe" /START "%1? %*"HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command | IsolatedCommand = ""%1? %*"HKEY_CURRENT_USER\Software\Classes\pezfile\shell\runasHKEY_CURRENT_USER\Software\Classes\pezfile\shell\runas\commandHKEY_CURRENT_USER\Software\Classes\pezfile\shell\startHKEY_CURRENT_USER\Software\Classes\pezfile\shell\start\command