Tuesday, January 26, 2010

How To Remove Internet Security 2010 and other Rogue/Fake Antivirus Malware

Friendly Computers would like to help you to clean up your computer from Internet Security 2010 and we found this article very useful for that.

If you have a PC infected with Internet Security 2010, you’re probably reading this article so you can understand how to get rid of it. Thankfully we’ve got the instructions to help you get rid of this awful thing.

Internet Security 2010 is just one of many fake antivirus applications like Antivirus Live, Advanced Virus Remover, and others that hold your computer hostage until you pay their ransom money. They tell you that your PC is infected with fake viruses, and prevent you from doing anything to remove them. image67Note: If you just want the instructions to get rid of it, you’ll want to scroll down a bit.

Anatomy of an Infection

Normally these infections start with a popup message like this onimage68

Moving Forward…

Once you click the popup message, you’ll be presented with a page that looks like your My Computer view, telling you that your PC is infected. Nevermind that no real antivirus looks like this, regular PC users don’t know any better. image69After a few seconds of this, you’ll be presented with a popup dialog in the web page that says your PC is infect, and you can click the button to Remove all. The dialog looks real, and can even be dragged around the page—in my research, this seems to be the point where most regular users get confused. image70Once you’ve clicked it, you’ll be prompted to run an installer—which you might note has a number of warnings. image71As soon as the installer is able to execute, you are infected. image72You won’t be able to open up any applications. And you can’t remove it from Control Panel. image74 Removing Rogue Fake Antivirus Infections (General Guide)

There’s a couple of steps that you can generally follow to get rid of the majority of rogue antivirus infections, and actually most malware or spyware infections of any type. Here’s the quick steps:

  • Try to use the free, portable version of SUPERAntiSpyware to remove the viruses.
  • If that doesn’t work, reboot your PC into safe mode with networking (use F8 right before Windows starts to load)
  • Try to use the free, portable version of SUPERAntiSpyware to remove the viruses.
  • Reboot your PC and go back into safe mode with networking.
  • If that doesn’t work, and safe mode is blocked, try running ComboFix. Note that I’ve not yet had to resort to this, but some of our readers have.
  • Install MalwareBytes and run it, doing a full system scan. (see our previous article on how to use it).
  • Reboot your PC again, and run a full scan using your normal Antivirus application (we recommend Microsoft Security Essentials).
  • At this point your PC is usually clean.

Those are the rules that normally work.

Let’s Get to Removing Internet Security 2010

The first thing we’ll want to do is kill the virus that’s currently running on the system, and there’s a really easy way to kill Internet Security 2010 without downloading any special software just to kill it (we’ll still need to download something to clean it, however).

Open up the Start menu, click the Run button (or use the Win+R shortcut key), and then type in the following:

taskkill /f /im is2010.exe image75Hit the Enter key, and the main virus window should go away. After you’ve done that, you’ll want to quickly execute the following commands:

taskkill /f /im winlogon86.exe

taskkill /f /im winupdate86.exe

At this point the virus isn’t currently running on your system—but it’s still lurking in the shadows, but you can actually run any malware removal tools that you’d like.

Use SUPERAntiSpyware to Clean the Malware

Now that we’ve killed off all those processes, we’ll get to removing the actual malware from the system by downloading SUPERAntiSpyware and installing it. You should be able to grab the full version, or you can use the portable variety. image481If you grabbed the full version, make sure to use the Check for Updates button, and then click the Scan Your Computer button… make sure to perform a Complete Scan, and select all of your drives.  image511It should easily find and kill all of them. You’ll probably note that on this particular machine that I was using in the screenshot, there was a lot of other bad stuff that it caught as well. Woot! image541Once it’s done, it’ll let you remove them all in a click, and then prompt you to reboot. Job isn’t done, however!

Install Malwarebytes and Scan

Next you’ll want to install MalwareBytes and run it, making sure to run a full scan. The main reason to do this is because there’s no way a single malware removal tool can know about every single piece of malware out there, and you may as well make sure your system is clean. image76Install Microsoft Security Essentials

You should definitely install Microsoft Security Essentials and run another full scan once you’re done.

Note: If you used a thumb drive at any point during this process, you should make sure and scan that as well—I’ve had viruses hop over to the thumb drive, ready to infect the next machine.

Source: http://www.howtogeek.com/howto/9487/how-to-remove-internet-security-2010-and-other-roguefake-antivirus-malware/