Win 7 Internet Security 2011

Uninstalling the rogue program ‘Win 7 Internet Security 2011’ requires an effective anti-malware tool. You can find a quick removal guide on this page and a useful tool to instantly delete this malware.

Win 7 Internet Security 2011 is believed to be a member of the rogue anti-virus program family. It is observed that is Trojan utilized to spread the software to computers connected to Internet. Win 7 Internet Security 2011 virus may enter the computer freely by spotting security weaknesses. It can install itself without the need for user’s interaction. After acquiring a place on the system, Win 7 Internet Security 2011 causes several annoyances including frequent display of forged warning messages attempting to make users believe of transpiring infections on computer. Fake virus scan conceive by the same product also claims that system files were infected and propose for instant removal.

Before any of the classified threats can be taken out from the system, Win 7 Internet Security 2011 notifies users to obtain the registered version first. This is carried out in the form of pop-ups and task bar alerts. Additionally, Internet browsers is redirected to an online payment processing web site that force users to give out credit card data to purchase full version of this rogue tool.

Remove Win 7 Internet Security 2011 and other computer threats and virus only with a legitimate application. Having a paid version of useless program will not help resolve computer issues.

Screenshot Image:

Image of Win 7 Internet Security 2011

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

How to Remove Win 7 Internet Security 2011

Systematic procedures to get rid of the threat are presented on this section. Make sure to scan the computer with suggested tools and scanners.

Option : Activating Win 7 Internet Security 2011

The malware will block running of any programs. It also prevents access to Internet particularly anti-virus web sites. Execution of Windows tools like Task Manager, Registry Editor and Control Panel is similarly block by the rogue program. Activating the program using the registration key below will regain access to the mentioned services.

Once activated, downloading of necessary program to scan and remove Win 7 Internet Security 2011 is now possible. Use the registration code below. If it prompts for email address, you can input any email address.

Registration Key:

REGISTRATION CODE: 1147-175591-6550

Step 1 : Scan the computer with recommended removal tool

1 First thing you should do is reboot the computer in Safe Mode with Networking to avoid Win 7 Internet Security 2011 from loading at start-up.

NOTE: You will need to PRINT or BOOKMARK this procedure, as we have to restart the computer during the removal process.

Remove all media such as Memory Card, cd, dvd, and USB devices. Then, restart the computer and please do the following:

Boot in Safe Mode on Windows XP, Windows Vista, and Windows 7 system
a Before Windows begins to load, press F8 on your keyboard.
b It will display the Advanced Boot Options menu. Select Safe Mode.

Start computer in Safe Mode using Windows 8 and Windows 10
a Close any running programs on your computer.
b Get ready to Start Windows. On your keyboard, Press and Hold Shift key and then, click on Restart button.
c It will prompt you with options, please click on Troubleshoot icon.
d Under Troubleshoot window, select Advanced Options.
e On next window, click on Startup Settings icon.
f Lastly, click on Restart button on subsequent window.
g When Windows restarts, present startup options with numbers 1 - 9. Select "Enable Safe Mode with Networking" or number 5.

Startup Options

h Windows will now boot on Safe Mode with Networking. Proceed with virus scan as the next step.

2 Download our malware removal tool and save it on your Desktop or any location on your PC.

Download Tool

3 Click on the button to start downloading our recommended anti-virus tool. Save it to an accessible location inside your hard drive or clean USB drive if you are downloading from a different PC.

4 When finished downloading, locate and double-click the file to install the application. Windows' User Account Control will prompt at this point, please click Yes to continue installing the program.

5 Follow the prompts and install as 'default' only. There are no changes needed during the installation process.

6 Malwarebytes Anti-Malware will launch for the first time. It is necessary to proceed with software update.

7 After downloading updates, please click on Scan Now button.

8 The tool willl run Threat Scan to ensure that it thoroughly check the PC for any presence of Win 7 Internet Security 2011 and other forms of threats.

MBAM Scan

9 Once the scan has completed, Malwarebytes Anti-Malware will issue a list of identified threats. Mark all threats and click on Quarantine Selected.

10 If it prompts to restart the computer, please reboot Windows.

Step 2 : Ensure that no more files of Win 7 Internet Security 2011 are left inside the computer

11 Click on the button below to download Norton Power Eraser from official web site. Save it to your desktop or any location of your choice.

NPE Download

12 After downloading, navigate its location and double-click on the NPE.exe file to launch the program.

13 Norton Power Eraser will run. If it prompts for End User License Agreement, please click on Accept to proceed.

14 On NPE main window, click on Advanced Scans. We will attempt to remove "Win 7 Internet Security 2011" by thoroughly scanning your current operating system.

Advance Scan

15 On next window, click System Scan to perform standard scan on your computer.

Scan the System

16 NPE will proceed with the scan. It will search for Trojans, viruses, and malware like Win 7 Internet Security 2011. This may take some time, depending on the number of files currently stored on the computer.

17 When scan is complete. All detected risks are listed. Click on Fix Now to remove Win 7 Internet Security 2011 and other known threats. Then, restart Windows if necessary.

Step 3 : Remove the Rootkit Trojan that installs Win 7 Internet Security 2011

Rootkit Remover is a stand-alone utility developed by McAfee. It can be used to detect and remove rootkit Trojan that is associated with Win 7 Internet Security 2011. This tool can detect rootkit that is part of ZeroAccess, Necurs, and TDSS family.

18 Download Rootkit Remover and save it to your desktop or any accessible location. Click the button below to begin the download.

click to download

19 Locate the file rootkitremover.exe and double-click to run the program.

20 When User Account Control prompts if you want to allow the program to make changes on the computer, please click Yes.

Rootkit Remover Scan

21 Rootkit Remover instantly scans the computer and look for presence of Trojans, viruses, and rootkit that is related to Win 7 Internet Security 2011 .

22 Once it finishes scanning the computer, the tool will require you to restart Windows.

Alternative Removal Procedures for Win 7 Internet Security 2011

Use Windows System Restore to return Windows to previous state

During an infection, Win 7 Internet Security 2011 drops various files and registry entries. The threat intentionally hides system files by setting options in the registry. With these rigid changes, the best solution is to return Windows to previous working state is through System Restore.

To verify if System Restore is active on your computer, please follow the instructions below to access this feature.

Access System Restore on Windows XP, Windows Vista, and Windows 7

a Go to Start Menu, then under 'Run' or 'Search Program and Files field, type rstrui.
b Then, press Enter on the keyboard to open System Restore Settings.

rstrui-win7

c Windows will display list of saved restore points. Select the most recent one to restore Windows to previous working and clean state.
d It may take some time to fully restore back-up files. Restart Windows when done.

Open System Restore on Windows 8 and Windows 10

a For Windows 8 user, go to Start Search, while on Windows 10, use the Start Menu Search and type rstrui.
b Click on the located program to open System Restore window.

rstrui-win8

c Windows will display list of saved restore points if it is active. Select the most recent one to restore Windows to previous working and clean state.
d It may take a while to fully restore back-up files. Restart Windows when done.

If previous restore point is saved, you may proceed with Windows System Restore.

Option 2 : Win 7 Internet Security 2011 manual uninstall guide

IMPORTANT! Manual removal of Win 7 Internet Security 2011 requires technical skills. Deleting system files and registry entries by mistake may result to total disability of Windows system. We advise you to perform a backup of registry before proceeding with this guide.

1 Kill any running process that belongs to Win 7 Internet Security 2011.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for Win 7 Internet Security 2011 files (refer to Technical Reference) and click End Process.

End Task

2 Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit and press Enter. This will open registry editor.
- Find and delete registry entries as mentioned in Technical Reference section.
- Close registry editor. Changes made will be saved automatically.

Run Regedit

3 Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.
- Thoroughly scan the computer with your updated antivirus software.

4 Delete all files dropped by Win 7 Internet Security 2011.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Technical Reference'. Make sure that you execute 'End Task' first before deleting the file. Otherwise, the system will not let you perform this action.

Associated Files and Folders:
File Location for Windows Versions:
  • %UserProfile% for Vista/7 user is C:\Users\<Current User> for Windows Vista/7, for Windows XP/2000 this is C:\Documents and Settings\<Current User>.
Added Registry Entries:

Troubleshooting Guides

Did Win 7 Internet Security 2011 blocks your Internet access?

It is usual that rogue program prevents user from downloading removal tools from the Internet. Thus, infected computer may be denied to access the Internet by making changes to computer's proxy, DNS, and Hosts file. To solve Internet connection problem, please see our guide in fixing a virus-blocked Internet access. Also, make sure that your Windows Host File is free from any malicious entries. View steps in cleaning Windows host file.

Avatar

About Marco Mathew

Marco Mathew works as Windows Network administrator before establishing precisesecurity.com. Now, Marco is dedicating full-time to help computer users' fight viruses, malware, trojan, worms, adware, and potentially unwanted programs.

37 Comments

  1. AvatarLilian

    good info

  2. AvatarJim

    Just cleaning this off of a machine tonight. It also remove or renamed msconfig, regedit, taskmgr and eventually removed the file association for .exe files.

    In the end I needed to perform a system restore to a week ago, just so I could get msconfig running to block all startup programs and services. Only then could I get malwarebytes installed and eventually cleaned everything out.

  3. Avatarmellyanya

    Thank you very much!

  4. Avatarmartyn

    I simply used system restore after hours of trying other things and it worked!!

  5. AvatarAnne

    Going to try this on my mom’s computer. This virus also eithere trashed or blocked access to her restore points, so that doesn’t seem to be an option for us at this time. Many fingers crossed that it will work!!!!

  6. AvatarMDRV

    Hi i found a solution not the best but it works i searched the process in tskm and changed the file ending from exe to txt so this program was unable to start i actually didnt found this prog actually any where on my pc but it seems to be completly disabled

  7. AvatarKeris

    I’m on here on my iPhone cause my computer it’s blocking me from visiting the site! Thanks

  8. Avatarlisa

    what program did you find in task manager that you changed from exe to txt to stop it from running? I can’t logon to any internet site to run any fixing program.

  9. Avatarshayla

    The Win 7 Security 2011 has blocked my internet . So i cannot do anything to remove it . Help please ?

  10. AvatarLisa

    Hi, this virus has also blocked me access to internet. How do we get rid of this. Step by step instructions please as I am not that computer savy. thanks.

  11. AvatarLisa

    I contacted Win 7 Internet Security 2011 about this and this was their response…

    I am really sorry that your computer has been infected. So, these pop-ups and are not the part of our product,
    they are a some kind of a virus from the internet and don’t belong to our program. It was done by our advertising
    partner and he’s already banned.
    This program will be self-removed in 6 days. There would be no problems after it is deleted.
    Also you can just set date and time setting in your windows control panel 6 days later according to current date.

    Is this true… will setting the date ahead by 6 days remove this virus?

  12. Avatarsteve macke

    I removed it with avast – downside was I also removed the exec files that it infected – so I had to do a repair in safe mode after saving all the files – it took two hours to go through the repair wizard – then another two hours updating the windows 7 os and downloading avast and other security software so that does not happen again.

    Did send a message to the scum bags that created the virus – they did not keep me down

  13. AvatarMichelle

    I was infected with this virus just last night. After trying several things to get rid of it and after numerous times trying to get on the internet only to have it blocked by this virus, I clicked on “online support” on the menu bar of Internet Explorer. When I clicked on this option, the Microsoft webpage opened up and I was able to go to the forums and find out about fixes for this virus. Then I discovered that I was able to go online from the Microsoft website and onto the internet to confirm fixes. I ended up downloading the Malwarebyte shareware and got rid of this annoying virus. Where there’s a will, there’s a way! :-)

  14. Avatarmike s

    i tried to get rid of this virus many times using superantispyware and it didn’t work now every time i try to access the internet and open with pops up can you help me out with something elese i tried also using safe mode by pressing f8 and nothing evry help is appreciated thank you reply a.s.a.p

  15. Avatarmike s

    i was infected yesterday just today got access to another computer any advice is grateful

  16. Avatarmike s

    now my comp. just turned off and wont turn on what has happened help me please !!!!!!

  17. Avatari will help you

    Press CTRL+ALT+DEL & Select START TASK MANAGER . THEN SELECT PROCESSES & HIGHLIGHT ON yto.exe . AFTER THAT SELECT END PROCESS.

  18. AvatarDave

    I used MBAM to remote an infection of Windows Internet Security 2011 from a Windows 7 (enterprise) 64 bit system. Although alerts, reg keys and files seems to have been removed, I can now no longer run many programs as the infected user (click Run As Administrator works)

    Re-running MBAM to see if it finds anything else. Otherewise this system is screwed and i will probably have to reimage it.

  19. Avatarbill

    infected by win 7. struggled for hours. local office depot offered to remove for $180. to avira knowledge database. to support for home. to line 7 “i have a virus…”. to see also. to how can i get an avira rescue cd. i downloaded and burned cd. installed cd in infected computer. instant success!

  20. AvatarPeggy

    It is a bad virus that does not allow internet access. Also if you buy the software, it does not work but my Credit card company told me that it was being charged to some place in Iraq!!!!! I put a fraud alert on and had my card discontinued!!

  21. AvatarSean

    Thanks Carlos – your solution is the only one that worked quickly – I couldn’t access system restore without using the repair option in safe mode.

  22. AvatarDwight

    hi friends,

    I fixed this problem as follows:

    a) Restart Computer
    b) Press F8
    c) Repair Computer
    d) System Restore to earlier check point
    e) Start Windows
    f) Launch Google Chrome
    g) Download Malware Bytes
    f) Run scan.

    If you want to do manual process:

    a) Restart computer
    b) Press F8
    c) Safe Mode with Command Prompt

    The files you need to delete will be in a folder like this:

    c:\users\user\AppData\Local\Temp\
    C:\users\user\AppData\LocalLow\Sun\Java\deployment\cache\6.0
    c:\users\user\AppData\Roaming\bitrix security\

    you can try

    a) del *.*
    b) rmdir [directory name]

    I was not successful from the command line because I couldn’t find where the programs were hiring until I used the scan tool.

    Good Luck………

  23. Avatarstuie

    does using the system restore method delete everything else off the system??any answers would be great cheers

  24. AvatarDJ

    Just got infected with Win 7 Security 2011. It didn’t let me access the internet to get rid of it so my solution was to go on a clean computer, download Malwarebytes Anti-Malware to a CD, put the CD into my infected cpu and run the program as the administrator, it was removed within 5 minutes.

  25. Avatartembo

    -The only browser that will work if you have this is I.E.

    -Do not try to log in to anything.

    -Un-plug your internet connection.

    Here are a few of tricks:

    The file name is unique based on your computer, and usually takes the name of another program.

    Find the name via taskmanager, ctrl-alt-del.

    Now name a random exe file on your computer the same name then place that file in the appdata\local folder of your user account name.

    When the window pops up right click it on the taskbar and go to properties. Proceed to edit the settings, change the file extention, etc change the right, etc. This will render it useless.

    Malewarebyes is a good way to get rid of it, Norton free is also.

    Norton won’t get rid of it via a scan, but rathere through it’s sonar technology. This examines suspicious behaving programs. After a bout 30-minutes to an hour Norton will detect that it’s malicious and remove it.

    Norton also tells you exactly everything the program did (e.g. which deleted registry keys, how many times it started up by itself, what is blocked) since it had been monitoring it.

    All of this is as a result of removing it from other people’s systems.

    Also note the file is more than hidden. Even if you allow hidden files to be viewed simply going to appdata\local to delete it might not work. But you should try setting your folder options to view hidden (via control panel–>appearance and personalization—>folder options and seeing it it’s there. Always look at the date last modified if you do see a file there.

    Good luck

  26. AvatarArmando

    Easiest fix:

    Jus change the date on your computer for 7 days ahead of
    Current date. Restart; Gone!!!!

  27. AvatarEdward

    I am an IT tech for a mid sized co. I mainly deal with hardware installtion and minor software. My boss recently had this problem with his laptop. Unfortunatelly he had already purchased the fake removal tool from the infected site. So the only way to remove after this was to have the PC scanned with a good virus scan and remval tool. Trying to restore it back a few days after he had already purchased the fake scan was impossible. If you get this messege on your PC the best thing to do is to not open or close any of the messeges and run the virus protection that you purchased or own on your PC. If anytime you get a messege that says you need to buy there product to remove a virus, it’s a scam don’t do it. And if your not sure the best thing to do is don’t touch anything and ask some one you trust to take a look at your PC. Most of the time it’s not fully infected to the point it cant be fixed. But once you open or purchase it then your probs. begin. Hope this helps

  28. AvatarHenry

    Armando, You are right! It is the EASIEST way! :-)

  29. AvatarRamal

    Again,microsoft screws the consumer.There was another virus similar to this one last year and i’m sure we’ll have to keep dealing with them yearly until microsoft gets their act togethere.I can’t wait to switch to mac.

  30. AvatarAlex

    Thanks all – will try the system restore tonight and report back

  31. AvatarAlex

    Tried this last night, but there was no option for F8 when restarting, only F2 and F12 – neithere of which offer a ‘Repair Computer’ or ‘System Restore’ option. Nor am I able to start the computer in safe mode. I tried hitting/holding F8 on start up anyway, but nothing happened. Is it possible that the virus has prevented me from perfroming the system restore function?

    Or am I just doing it wrong? :)

  32. Avatarchelle

    we had this virus after looking in google images and know a freind who picked it up from there as well. we restored our system to and earlier date and it seems to have cleared. however the only worry is if there is anything still in the background of the computer watching for any sort of financial activity? Can anyone say if the restore method has cleared it completey. we did not click on buy when it came up and since restoring have managed to reinstall our macafee security?

  33. AvatarAlex

    tried using the System Restore in Control Panel yesterday… of course the last restore point was after the date of infection – and there were no alternative dates! The work of the virus again? I don’t know.

    Any advise would be gratefully received

  34. AvatarMaddy

    Hey ! just put a good antivirus thing on a cd from a clean computer and then put it right into the infected comeputer. works goood

  35. AvatarGhislain

    I saw this thing on a friends computer sometime ago. In a matter of a few hours, she was stuck with the constant pop-ups and wasn’t able to launch much applications.

    Here’s how I got rid of it, manually:
    Restart the computer, hit the F8 key from right after POST and jump in safe mode.

    Once there, open the Task Manager and look through the processes list. Normally in safe mode, only the essential processes are on, which should lead to a very small list of programs to look at. In my case, the malicious program was 3 letters long, and seemed to mean nothing whatsoever, like enl.exe or ypu.exe.

    Next step, in the start menu search for regedit in the programs bar right over the start menu logo.

    Once in the registry do a global search using as your keyword the name of the program, including the .exe. It should lead you to the extensions association list, on an entry located under the exeFile group I think. There you will have the path leading to the actual location of the file!

    It also explains why, whichever program you try to start will immediately launch a pop-up. It bypasses the standard procedure for handling exe files and instead, tells windows: “Hey, to know what to do with any of em’ exe files, you must use that kjh.exe or apw.exe over there!”

    (Note, if you know your way into the registry, you can start right away by searching under the .exeFile in the file association part)

    Now, let’s put that registry aside a bit. To get everything back in order, you must delete the exe at its current location and while at it, why not clear off all the temporary files too. You should also make a regular search then and get rid of any other related files that are at different locations (shouldn’t be much)

    Then the horrible part: you must reverse all the damaged registry keys back to their original values! You can do it by let’s say… compare it to that of another computer and match the values. Or by hitting this link:
    http : //www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html

    and saving the reg key for the EXE extension. Once you execute that on the affected computer, the keys will be restored to their original values!

    Now the computer will be able to boot and work normally outside of safe mode! If you are at ease doing it, you can clean the registry by yourself by removing any entry involving the malicious programs name, or run a stardard anti-virus and anti-spyware scan to finish it up for you (and probably find more stuff).

    I hope, that any part of this lengthy post can be of help to anyone here. And that I didn’t actually forget some important stuff XD

    G

  36. AvatarJunior

    Armando: Thanks it worked.

  37. AvatarTony

    Armando, Lisa and Junior have it right. Just change the date on your computer for 7 days ahead. I also followed up with Norton Erase Program. Has anyone seen the virus rear it’s ugly head again after this fix?

Leave a Comment

Your email address will not be published. Required fields are marked *