{"id":626,"date":"2011-03-08T13:25:27","date_gmt":"2011-03-08T00:25:27","guid":{"rendered":"http:\/\/www.c2s.co.nz\/blog\/?p=626"},"modified":"2011-08-08T12:57:09","modified_gmt":"2011-08-08T00:57:09","slug":"removing-xp-home-security-2011-malware","status":"publish","type":"post","link":"http:\/\/www.c2s.co.nz\/blog\/removing-xp-home-security-2011-malware\/","title":{"rendered":"Removing XP Home Security 2011 \/ 2012 malware"},"content":{"rendered":"<div class=\"8781ca4f97038dd0d58a1ad8af045721\" data-index=\"3\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script type=\"text\/javascript\"><!--\r\ngoogle_ad_client = \"ca-pub-6411751809866006\";\r\n\/* BlogHorizontalSlim *\/\r\ngoogle_ad_slot = \"6442664612\";\r\ngoogle_ad_width = 468;\r\ngoogle_ad_height = 60;\r\n\/\/-->\r\n<\/script>\r\n<script type=\"text\/javascript\"\r\nsrc=\"http:\/\/pagead2.googlesyndication.com\/pagead\/show_ads.js\">\r\n<\/script>\n<\/div>\n<p><strong>NOTE:<\/strong> This malware comes under many similar names, they pretty much all do the same thing, some marginally worse than others. Removal is easy and straight-forward either way.<\/p>\n<p><strong>EDIT:<\/strong> Added XP Home Security 2012 updated info. The newer ones are getting more and more clever at hiding!<\/p>\n<p>Unfortunately I&#8217;m still not sure where this sneaky bugger originates from, but I&#8217;m pretty sure that it could be avoided by using a decent browser such as Chrome or Firefox. So far everybody I know of who&#8217;s been infected has been using Internet Explorer, and I&#8217;ve seen about 30 infections at the time of updating this to include info on the 2012 &#8216;edition&#8217;. (June 2011)<\/p>\n<p>That said, it&#8217;s not too difficult to remove the XP Home Security 2011 fake antivirus software.<\/p>\n<p>If you&#8217;re getting popups like this:<\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Infection2.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-630 aligncenter\" title=\"Infection2\" src=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Infection2-300x215.jpg\" alt=\"\" width=\"300\" height=\"215\" srcset=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Infection2-300x215.jpg 300w, http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Infection2.jpg 739w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-627 aligncenter\" title=\"Infection1\" src=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Infection1-300x153.jpg\" alt=\"\" width=\"300\" height=\"153\" srcset=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Infection1-300x153.jpg 300w, http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Infection1.jpg 643w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/p>\n<p>Then congrats, you&#8217;re infected.<\/p>\n<p>Thankfully, the current editions don&#8217;t do any key logging at all (From what I can tell), they&#8217;re just horribly annoying and bug you for your credit card details etc.<\/p>\n<p>Whatever you do, don&#8217;t pay for it!<\/p>\n<p><!--more--><br \/>\n<strong>NOTE:<\/strong> Before we begin, grab this:\u00c2\u00a0<a href=\"http:\/\/www.c2s.co.nz\/files\/exefix_xp.com\">exefix_xp.com<\/a> -\u00c2\u00a0It will restore the file association for EXE files which this software likes to hijack, amongst other things. Ideally save this to your Desktop so it&#8217;s easy for you to double-click without having to fire up Windows Explorer to navigate to it.<\/p>\n<p>First things first, you need to kill it off. You may or may not need to be in safe mode when you do this, I&#8217;ve had good success without needing to be in Safe Mode. I&#8217;d *strongly* suggest that all other applications are closed though.<\/p>\n<p>The easiest way to kill it is to press Ctrl + Shift + Esc to bring up Task Manager.<\/p>\n<p>Under the Application tab, right-click on the fake security software and choose &#8220;Go to process&#8221;. This is the file name of the culprit. Write the name down on some paper, then right-click on it and choose &#8220;End Process&#8221;.<\/p>\n<p>Now, run the aforementioned EXE Fix.<\/p>\n<p>Then, click Start &#8211;&gt; Run &#8211;&gt; Regedit (And click OK)<\/p>\n<p>If you&#8217;re running Vista or Windows 7, just click Start, type &#8220;regedit&#8221; and hit Enter<\/p>\n<p><strong>NOTE:<\/strong> If the malware fires up when you launch Registry Editor, then simple kill it using Task Manager, and re-run the EXE fix (As it will have already changed the associations AGAIN. Annoying huh?).<\/p>\n<p>Now, you want to go through these places:<\/p>\n<pre>HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run<\/pre>\n<pre>HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce<\/pre>\n<pre>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run<\/pre>\n<pre>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce<\/pre>\n<pre>HKLM\\Software\\Clients\\StartMenuInternet\\IEXPLORE.EXE\\shell\\open\\command<\/pre>\n<p>You&#8217;ll find something that looks a little bit like this:<\/p>\n<p><a href=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Registry.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-639\" title=\"Registry\" src=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Registry-300x225.png\" alt=\"\" width=\"300\" height=\"225\" srcset=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Registry-300x225.png 300w, http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/Registry.png 797w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Delete those entries that match the name of the malware, with the exception of the last IEXPLORE.EXE entry (Which tells Windows what to do when you want to load Internet Explorer). Simply clear the extra malware guff from the beginning so that it looks like this:<\/p>\n<pre>C:\\Program Files\\Internet Explorer\\iexplore.exe<\/pre>\n<p>Now you need to search your HDD using Windows Search, including hidden and system folders, for that file.<\/p>\n<p>When you find it, just right-click on it and delete it.<\/p>\n<p>It&#8217;s also worth checking to make sure that it&#8217;s not set itself up as a Proxy. In Internet Explorer, you can go into your Internet Options &#8211;&gt; Connections Tab &#8211;&gt; LAN Settings. Make sure that &#8220;Use a proxy server for your LAN&#8221; is unticked.<\/p>\n<p>If this has been of any help to you, or you&#8217;ve found another way of doing things that I haven&#8217;t, please let me know in the comments<\/p>\n<p>Cheers<\/p>\n<p>Chill.<\/p>\n<p>Pictures below:<\/p>\n<p><a href=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-01.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-743\" title=\"2012 Screenshot 01\" src=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-01-300x260.png\" alt=\"\" width=\"300\" height=\"260\" srcset=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-01-300x260.png 300w, http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-01.png 486w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><a href=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-02.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-744\" title=\"2012 Screenshot 02\" src=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-02-300x214.png\" alt=\"\" width=\"300\" height=\"214\" srcset=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-02-300x214.png 300w, http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-02.png 734w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><a href=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-03.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-745\" title=\"2012 Screenshot 03\" src=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-03-300x222.png\" alt=\"\" width=\"300\" height=\"222\" srcset=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-03-300x222.png 300w, http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-03.png 570w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><a href=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-04.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-746\" title=\"2012 Screenshot 04\" src=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-04-300x240.png\" alt=\"\" width=\"300\" height=\"240\" srcset=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-04-300x240.png 300w, http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-04.png 726w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><a href=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-05.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-medium wp-image-747\" title=\"2012 Screenshot 05\" src=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-05-300x118.png\" alt=\"\" width=\"300\" height=\"118\" srcset=\"http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-05-300x118.png 300w, http:\/\/www.c2s.co.nz\/blog\/wp-content\/uploads\/2011\/03\/2012-Screenshot-05.png 316w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a>EDIT 20110808 : I&#8217;ve been given this link, if you&#8217;re *still* having issues after following this, there&#8217;s a few more recommended places in the registry you can try, details here:\u00c2\u00a0<a href=\"http:\/\/www.best-anti-spyware.com\/anti-malware\/win-7-security-2012-fake-security-app-used-by-hackers-to-extract-money-from-pc\/\" target=\"_blank\">http:\/\/www.best-anti-spyware.com\/anti-malware\/win-7-security-2012-fake-security-app-used-by-hackers-to-extract-money-from-pc\/<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>NOTE: This malware comes under many similar names, they pretty much all do the same thing, some marginally worse than others. Removal is easy and straight-forward either way. EDIT: Added XP Home Security 2012 updated info. The newer ones are getting more and more clever at hiding! Unfortunately I&#8217;m still not sure where this sneaky [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[4],"tags":[310,309,306,307,308,305,349],"class_list":["post-626","post","type-post","status-publish","format-standard","hentry","category-how-tos-guides-tech-info","tag-exefix","tag-fake-antivirus","tag-malware","tag-trojans","tag-viruses","tag-xp-home-security-2011","tag-xp-home-security-2012"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pWi3e-a6","jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/posts\/626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/comments?post=626"}],"version-history":[{"count":10,"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/posts\/626\/revisions"}],"predecessor-version":[{"id":632,"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/posts\/626\/revisions\/632"}],"wp:attachment":[{"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/media?parent=626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/categories?post=626"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.c2s.co.nz\/blog\/wp-json\/wp\/v2\/tags?post=626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}