Win 7 Home Security 2011

Win 7 Home Security 2011 is a rogue security program that creates fake infection warnings instead of finding real infections. The name of your operating system will change the name of the Win 7 Home Security 2011, since Win 7 Home Security 2011 matches its name to the OS that Win 7 Home Security 2011 is trying to infect. Win 7 Home Security 2011 may look like a normal anti-virus and security program, but as a rogue security application, Win 7 Home Security 2011 will cause numerous forms of damage to your computer. Removing Win 7 Home Security 2011 is considered an advanced technique best left to anti-malware software designed to combat PC threats.

Win 7 Home Security 2011: A Complete Lack of Security for Your Home PC

Win 7 Home Security 2011 is a chameleon-like rogue security program with a name that changes to avoid easy detection. Other rogue security program names from the family and clones of Win 7 Home Security 2011 include OS variations like

The names may be different, but all of these rogue security programs, including Win 7 Home Security 2011, behave and are distributed in identical ways. You can accidentally get infected by Win 7 Home Security 2011 if you visit a dangerous website or a website that hosts dangerous advertisements with drive-by download code. Another common method of exposure to Win 7 Home Security 2011 is when you trust a fake online scanner that prompts you to download software to remove infections that don't really exist on your PC.

Win 7 Home Security 2011 will try hard to make you think that Win 7 Home Security 2011 is a worthwhile part of your PC security, but all of its errors, like the ones you can see below, are false positives and, therefore, wholly worthless:

"Stealth intrusion!
Infection detected in the background. Your computer is now attacked by spyware and rogue security software. Eliminate the infection safely, perform a security scan and deletion now."

"Privacy Threat!
Spyware intrusion detected. Your system is infected. System integrity is at risk. Private data can be stolen by third parties, including credit card details and passwords. Click here to perform a security repair."

"Win 7 Home Security 2011 Firewall Alert!
Win 7 Home Security 2011 has blocked a program from accessing the Internet.
Internet Explorer is infected with Trojan-BNK.Win32.Keylogger.gen. Private data can be stolen by third parties, including credit card details and passwords."

"Windows Security Center
Win 7 Home Security 2011 reports that it is currently turned off. A firewall helps to protect your computer from potentially harmful content on the Internet. Click Recommendations to learn how to fix this problem."

System Hijack!
System security threat was detected. Viruses and/or spyware may be damaging your system now. Prevent infection and data loss or stealing by running a free security scan.

System danger!
Your system security is in danger. Privacy threats detected. Spyware, keyloggers or Trojans may be working the background right now. Perform an in-depth scan and removal now, click here.

Security breach!
Beware! Spyware infection was found. Your system security is at risk. Private information may get stolen, and your PC activity may get monitored. Click for an anti-spyware scan.

Uninstalling Win 7 Home Security 2011's Fake Security

As you can see from the above errors, Win 7 Home Security 2011 will even pretend to be a natural part of your Windows security and will alert you to fake threats like Trojan-BNK.Win32.Keylogger.gen. You may also find that your browser shows signs of being hijacked (redirecting to malicious websites, changed homepage settings, inaccurate errors blocking website access) or that the errors above are used to block your ability to use certain applications.

Since these attacks make it difficult to remove Win 7 Home Security 2011, you may want to consider registering Win 7 Home Security 2011 with the freely-distributed code '1147-175591-6550.' This code is known to work on most simple variants of Win 7 Home Security 2011, and may deactivate some of its most harmful attacks.

You can also switch to Safe Mode, accessible during startup with F8, boot a non-Windows operating system, or boot your computer from a removable device. These options will all skirt around Win 7 Home Security 2011's startup Registry entries, so you can delete Win 7 Home Security 2011 with the assistance of a good anti-malware program.

File System Modifications

• The following files were created in the system:
  

  #	File Name
  1	%AllUsersProfile%\t3e0ilfioi3684m2nt3ps2b6lru
  2	%AppData%\Local\[RANDOM CHARACTERS].exe (look for 3-letter names)
  3	%AppData%\Local\t3e0ilfioi3684m2nt3ps2b6lru
  4	%AppData%\Roaming\Microsoft\Windows\Templates\t3e0ilfioi3684m2nt3ps2b6lru
  5	%Temp%\t3e0ilfioi3684m2nt3ps2b6lru

Registry Modifications

• The following newly produced Registry Values are:
  HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'exefile'HKEY_CURRENT_USER\Software\Classes\.exe "Content Type" = 'application/x-msdownload'HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon "(Default)" = '%1' = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 CHARACTERS].exe" /START "%1" %*'HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "IsolatedCommand" = '"%1" %*'HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "(Default)" = '"%1" %*'HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command "IsolatedCommand" = '"%1" %*'HKEY_CURRENT_USER\Software\Classes\exefile "(Default)" = 'Application'HKEY_CURRENT_USER\Software\Classes\exefile "Content Type" = 'application/x-msdownload'HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon "(Default)" = '%1'HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 CHARACTERS].exe" /START "%1" %*'HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "IsolatedCommand" = '"%1" %*'HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command "(Default)" = '"%1" %*'HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command "IsolatedCommand" - '"%1" %*'HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 CHARACTERS].exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"'HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 CHARACTERS].exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 CHARATERS].exe" /START "C:\Program Files\Internet Explorer\iexplore.exeHKEY..\..\..\..{RegistryKeys}"'HKEY_CLASSES_ROOT\.exe\DefaultIcon "(Default)" = '%1'HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[random 3 letters].exe" /START "%1" %*'HKEY_CLASSES_ROOT\.exe\shell\open\command "IsolatedCommand" = '"%1" %*'HKEY_CLASSES_ROOT\.exe\shell\runas\command "(Default)" = '"%1" %*'HKEY_CLASSES_ROOT\.exe\shell\runas\command "IsolatedCommand" = '"%1" %*'HKEY_CLASSES_ROOT\exefile "Content Type" = 'application/x-msdownload'HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[RANDOM 3 CHARACTERS].exe" /START "%1" %*'HKEY_CLASSES_ROOT\exefile\shell\open\command "IsolatedCommand" = '"%1" %*'HKEY_CLASSES_ROOT\exefile\shell\runas\command "IsolatedCommand" = '"%1" %*'