Win 7 Total Security 2011

9 April 2011 Rogue 20 Comments

Win 7 Total Security is a fake computer anti-virus application. Win 7 Total Security 2011 virus offers a variety of computer protection features such as virus scan, Internet security, personal security, proactive defense and firewall. However, all of these are non-performing and was just an odd display on its graphical user interface. After deep analysis, it was found that Win 7 Total Security 2011 does not have the essential parts to act as fully functional security software. In fact, this rogue program is a piece of malware from a large group of fake AV products. Members of this family are able to detect victim’s operating system and install necessary version of the malware. In this case, the targeted PC is operated under Windows 7.  Windows XP systems will have XP Total Security 2011 while Windows Vista will cover Vista Total Security 2011. These rogue programs are able to propagate through unfair promotional method like fake online virus scanner and spam email messages. Presence of Win 7 Total Security 2011 on one’s system will provide severe damages that will result to browser redirection, block execution of any software and modified desktop wallpaper.

It is important to remove Win 7 Total Security 2011 virus immediately and prevent any more harm on the computer. You may never notice it, but as long as Win 7 Total Security 2011  is residing on the system, it will attempt to connect to a remove server and download more threats. It may carry out several system settings that may fully disable the current security setup of your PC. At this point, it is necessary to thoroughly scan the computer with anti-malware program and delete any detected threats. Repeat the process while in SafeMode to find all files that are still hiding on the system.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Malware Behavior
The only obvious symptoms from this virus are a barrage of fake security warnings and recurring virus scanning. Aside from this, Win 7 Total Security 2011 may perform other malicious activities like the following:

• Contact a remote server to download more threats.
• Update its configuration file to strengthen its presence.
• Open a backdoor port to allow unauthorized remote control.
• Find and end processes that belong to security software.
• Disable Internet connection particularly wireless network transmission on the infected computer.

Added Registry Entries:

HKEY_CLASSES_ROOT\.exe\DefaultIcon "(Default)" = '%1'
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[random 3 letters].exe" /START "%1" %*'
HKEY_CLASSES_ROOT\.exe\shell\runas\command "(Default)" = '"%1" %*'
HKEY_CLASSES_ROOT\exefile "Content Type" = 'application/x-msdownload'
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[random 3 letters].exe" /START "%1" %*'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[random 3 letters].exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[random 3 letters].exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[random 3 letters].exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"'
HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'exefile'
HKEY_CURRENT_USER\Software\Classes\.exe "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon "(Default)" = '%1' = '"%UserProfile%\Local Settings\Application Data\[random 3 letters].exe" /START "%1" %*'
HKEY_CURRENT_USER\Software\Classes\exefile "(Default)" = 'Application'
HKEY_CURRENT_USER\Software\Classes\exefile "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon "(Default)" = '%1'
HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%UserProfile%\Local Settings\Application Data\[random 3 letters].exe" /START "%1" %*'

Associated Files and Folders:

%AllUsersProfile%\[random]
%AppData%\Local\[random].exe
%AppData%\Local\[random]
%AppData%\Roaming\Microsoft\Windows\Templates\[random]
%Temp%\[random]

File Location for Windows Versions:

• %AllUserProfile% for Vista/7 user is C:\ProgramData while for Windows XP/2000 this is C:\Documents and Settings\All Users\
• %AppData% for Vista/7 refers to C:\Users\<Current User>\AppData\Roaming, while for Windows XP/2000 user it is C:\Documents and Settings\<Current User>\Application Data.
• %Temp% refers to C:\Windows\Temp\.

Restore Windows Components

If this virus enters your system, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If you have a saved restore point before Win 7 Total Security 2011 virus infiltrates the computer, please restore Windows to previous settings.

Manual Removal Procedure

1. Press Ctrl+Alt+Del on keyboard to stop the process associated to "Win 7 Total Security 2011". When Windows Task Manager opens, go to Processes tab. Find and end this process.
(random characters).exe

2. You need to update your installed antivirus software. Please connect to the Internet and download the most recent database. This is a one-click process from your AV program’s console.

3. Thoroughly scan the computer and remove any threats found by your antivirus program. If delete option is not available, your best next choice is to quarantine the infected file. There is also a need to manually locate and delete malicious files. Please see the file section for items that are relevant to Win 7 Total Security 2011.

4. Next, you need to remove registry entries created by Win 7 Total Security 2011. Please refer to registry section to view entries related to the rogue program.
- (Windows 2000/XP) Go to Start > Run, type "regedit" on dialog box then press Enter on keyboard.
- (Windows Vista/7) Go to Start > Search Program and Files, type "regedit" and press Enter.

5. Exit registry editor when you are done.

6. Get rid of Win 7 Total Security 2011 start-up entry by going to Start > Run, type msconfig on the "Open" dialog box. It will launch a new window containing System Configuration Utility. Click on the Startup tab and uncheck the following item.
(random characters).exe

7. Click Apply. You need to restart the computer.

Win 7 Total Security 2011 Removal Tool

In order to remove the threat completely, you need to download and run Malwarebytes Anti-Malware. This is a free malware removal tool. If Trojan infection blocks the downloading of this program, get it using a clean computer. Rename the executable file before executing on the infected PC.