Win 7 Antivirus 2012, Win7 Antispyware and variants Removal tool

To remove Win 7 Antivirus 2012 Software (Uninstall Win 7 Antivirus 2012 Software)

• Restart your computer and as soon as your computer turns on hit the F8 key (repeatedly) until a screen comes up
• Choose Start computer in SAFE MODE with network support
• Open Internet Explorer
• Go to Tools => Internet Options => Connections Tab => LAN Settings
• Uncheck "Use a proxy server"
• Recheck "Automatically detect settings"
• Download this free removal tool for Win 7 Antivirus 2012 Software
• Extract it
• Launch
• Click on the delete button

Win 7 Antivirus 2012 Software will be removed from your system in 10s. Restart your computer when it’s finished.

This removal tool for Win 7 Antivirus 2012 may refer to :

• For Windows XP :
  • Remove XP AntiVirus
  • Remove XP AntiVirus 2012
  • Remove XP AntiSpyware
  • Remove Win 7 Antivirus 2012
  • Remove XP Home Security
  • Remove XP Home Security 2012
  • Remove XP Total Security
  • Remove XP Total Security 2012
  • Remove XP Security
  • Remove XP Security 2012
  • Remove XP Internet Security
  • Remove XP Internet Security 2012
• For Windows Vista :
  • Remove Vista AntiVirus
  • Remove Vista AntiVirus 2012
  • Remove Vista AntiSpyware
  • Remove Vista AntiSpyware 2012
  • Remove Vista Home Security
  • Remove Vista Home Security 2012
  • Remove Vista Total Security
  • Remove Vista Total Security 2012
  • Remove Vista Security
  • Remove Vista Security 2012
  • Remove Vista Internet Security
  • Remove Vista Internet Security 2012
• For Windows Seven :
  • Remove Win 7 AntiVirus
  • Remove Win 7 AntiVirus 2012
  • Remove Win 7 AntiSpyware
  • Remove Win 7 AntiSpyware 2012
  • Remove Win 7 Home Security
  • Remove Win 7 Home Security 2012
  • Remove Win 7 Total Security
  • Remove Win 7 Total Security 2012
  • Remove Win 7 Security
  • Remove Win 7 Security 2012
  • Remove Win 7 Internet Security
  • Remove Win 7 Internet Security 2012

Processes :

• [3 Random Letters].exe

Files :

• %CommonAppData%\[random]
• %AppData%\[random]
• %Temp%\[random]
• %Templates%\[random]
• %AppData%\[3 letters random].exe

Registry

Registry keys created :

• HKEY_CURRENT_USER\Software\Classes\.exe
• HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
• HKEY_CURRENT_USER\Software\Classes\.exe\shell
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
• HKEY_CURRENT_USER\Software\Classes\exefile
• HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon
• HKEY_CURRENT_USER\Software\Classes\exefile\shell
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\open
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command

Registry Values created :

• HKEY_CURRENT_USER\Software\Microsoft\Windows
  
  • Identity = 0x19BA2783
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  
  • ctfmon.exe = "%System%\ctfmon.exe"
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
  
  • (Default) = ""%AppData%\[Three random letters].exe" -a "%1" %*"
  • IsolatedCommand = ""%1" %*"
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
  
  • (Default) = ""%1" %*"
  • IsolatedCommand = ""%1" %*"
• HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
  
  • (Default) = "%1"
• HKEY_CURRENT_USER\Software\Classes\.exe
  
  • (Default) = "exefile"
  • Content Type = "application/x-msdownload"
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command
  
  • (Default) = ""%AppData%\[Three random letters].exe" -a "%1" %*"
  • IsolatedCommand = ""%1" %*"
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command
  
  • (Default) = ""%1" %*"
  • IsolatedCommand = ""%1" %*"
• HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon
  
  • (Default) = "%1"
• HKEY_CURRENT_USER\Software\Classes\exefile
  
  • (Default) = "Application"
  • Content Type = "application/x-msdownload"

Registry values modified :

• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
  
  • (Default) =
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  
  • AntiVirusOverride =
  • FirewallOverride =

Remove Win 7 Antivirus 2012 Software manually :

• Restart your computer in safe mode :
  • Restart your computer and as soon as your computer turns on hit the F8 key (repeatedly) until a screen comes up
  • Choose Start computer in SAFE MODE
• Open the infected account
• Open explorer, paste into the address bar %Temp% then press enter, it will open C:\Documents and Settings\Christian\Local Settings\Temp on my computer
• Remove all .exe files under this path
• Open explorer, paste into the address bar %AppData% then press enter, it will open C:\Documents and Settings\Christian\Local Settings\Temp on my computer
• Remove all .exe files under this path
• Click on the start menu button then click on run
• Type msconfig and press enter
• Go to the Startup tab
• Uncheck ctfmon.exe and click on OK
• Return to run and enter regedit
• Browse to HKEY_CURRENT_USER\Software\Classes\ and remove the keys : .exe and exefile
• It will prevent these malware from running but you should use the removal tool to clean your computer completely from all other folders and registry keys of this malware.
• Restart your computer in normal mode