HT Logs. Tips, FAQs, Analyze.

Internet Antivirus 2011 is a harmful program.

It is a fake security program, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Internet Antivirus 2011 associated files and folders:

C:\Documents and Settings\All Users\Application Data\da1933\IA220_121.exe
%UserProfile%\Application Data\Internet Antivirus 2011
%UserProfile%\Application Data\Internet Antivirus 2011\cookies.sqlite
%UserProfile%\Desktop\Internet Antivirus 2011.lnk
%UserProfile%\Start Menu\Internet Antivirus 2011.lnk
%UserProfile%\Application Data\Internet Antivirus 2011\Instructions.ini
%UserProfile%\Start Menu\Programs\Internet Antivirus 2011.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Antivirus 2011.lnk

Internet Antivirus 2011 associated registry keys and values:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Internet Antivirus 2011

Core filename: IA220_121.exe
Command: C:\Documents and Settings\All Users\Application Data\da1933\IA220_121.exe
HijackThis shows Internet Antivirus 2011:

O4 – HKCU\..\Run: [Smart Engine] “C:\Documents and Settings\All Users\Application Data\da2933\IA220_121.exe” /s /d

Description: rogue antispyware program

How to remove: use the Internet Antivirus 2011 removal guide or the steps below.

1. Reboot your computer in Safe mode with networking.

2. Reset proxy settings of your browser (this malware hijacked them) by doing: run Internet Explorer, Click Tools -> Internet Options. Select Connections Tab and click to Lan Settings button. Uncheck “Use a proxy server” box. Click OK and click OK again.

3. Download Malwarebytes Anti-malware. Install, perform a scan and let it remove what it found. Reboot afterwards (important).

4. Download OTM by OldTimer from here and save to your desktop.
Run OTM, copy,then paste the following text in “Paste Instructions for Items to be Moved” window (under the yellow bar):

:Commands
[emptytemp]
[resethosts]

Click the red Moveit! button. Close OTM.

This entry was posted on Thursday, December 9th, 2010 at 11:10 am and is filed under Rogue Antispyware/Antivirus. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.