Tuesday, December 13, 2011

Win7 Home Security 2012 Firewall Alert Unregistered Version System Hijack Action Center

This appears to be a very well known trojan; I'm not sure how it got through on Lisa's laptop. Here are the links for how to remove it:

First off, the Microsoft pages for it reveal that there are Vista, XP, and Windows 7 "versions" out there. Humorously, they refer inquiries to the "bleepingcomputer.com" page on the virus:

http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/how-do-i-remove-vista-home-security-2012-virus/1e3ea9ab-8b1b-486f-b840-1d1fd4988322

http://answers.microsoft.com/en-us/windows/forum/windows_7-security/getting-messages-about-win-7-home-security-2012/3d161885-299f-4231-837d-93fffeab8215

On bleepingcomputer.com, the description of the problem is very through with detailed removal steps and matches what is on Lisa's laptop:

http://www.bleepingcomputer.com/virus-removal/remove-win-7-home-security-2012

http://www.bleepingcomputer.com/virus-removal/remove-win-7-antispyware-2012

The steps seem to be: 1) Use FixNCR to re-enable the ability to run executables, 2) Use RKill to disable the trojan, and 3) Use Malware Bytes to clean it from the system.

Here it where to get RKill, which is apparently made by bleepingcomputer?

http://www.bleepingcomputer.com/download/anti-virus/rkill

Here is info on what RKill does:

http://www.bleepingcomputer.com/forums/topic308364.html

Here is the source for Malware Bytes, which is apparently also a bleepingcomputer creation:

http://www.bleepingcomputer.com/download/anti-virus/malwarebytes-anti-malware

Here is the UG for Malware Bytes:

http://www.bleepingcomputer.com/virus-removal/how-to-use-malwarebytes-anti-malware-tutorial