Windows 7 Repair

19 June 2011 Rogue 0 Comment

Windows 7 Repair is a fake hard drive and system optimization software that was created to mislead computer users with fake information regarding errors on the system. Usually, Windows 7 Repair virus is installed on victims computer without users consent by means of a Trojan that will try to exploit security vulnerabilities. Symptoms that Windows 7 Repair was successfully installed are continuous pop-up of fake alerts and warning messages followed by an advise to obtain the licensed version of the program. Also, browser hijacking is employed that will redirect search results to unknown web sites.

Since Windows 7 Repair falls under the category of rogue programs, users must be aware that it is a must-removed program. It should not be purchase or even give more time to occupy space on the system. Remove Windows 7 Repair immediately with a trusted anti-virus and anti-malware program only. Presence of this potentially unwanted application may bring more damages when it connects to a remote server and download more harmful files. Worst, it may held the computer hostage and make it unusable until such time that a registered version of Windows 7 Repair was purchase.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Windows 7 Repair Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Windows 7 Repair”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Windows 7 Repair Virus.
4. Registry entries created by Windows 7 Repair must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Windows 7 Repair start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

Windows 7 Repair Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Scan with Portable Antivirus:
Most of the time, Trojan associated with a rogue program will disable Windows functionalities and prevent execution of any application including antivirus program locally installed. If this happens, you can try using a McAfee Portable Antivirus called Stinger. You can download it for free.

Technical Details and Additional Information:

Malicious Files Added by Windows 7 Repair:
%Documents and Settings%\All Users\Application Data\[random].dll
%Documents and Settings%\All Users\Application Data\[random].exe
%Documents and Settings%\All Users\Application Data\[random].exe
%Documents and Settings%\[UserName]\Start Menu\Programs\Windows XP Repair\
%Documents and Settings%\[UserName]\Start Menu\Programs\Windows XP Repair\Uninstall Windows XP Repair.lnk
%Documents and Settings%\[UserName]\Start Menu\Programs\Windows XP Repair\Windows XP Repair.lnk

Windows 7 Repair Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”