I’ve had a couple of customers in the past week whom were infected with a fake Internet Security Suite. When encountered on the internet it shows an animated image file, within a browser window, which resembles My Computer displaying hard drive(s), CD player(s), etc. and under each one it states viruses found. Upon clicking anywhere on this image it will want you to download and install it’s application.
This so called application is more a nuisance than anything else, that I have seen, as it keeps popping up fake virus or security alerts trying to get you to download or possibly buy (haven’t checked that) software.
My first encounter with it I immediately noticed there was a shortcut on the desktop for this Internet Security Suite so I right clicked and brought up properties then checked the target location which I forget where it was located but obviously not where installed applications are suppose to be. I deleted all the files except for a couple since they were in use then brought up the task manager to kill the fake application… task manager wouldn’t open.
I downloaded a command prompt version of the task manager and killed the fake app process, then removed the rest of the files which were in use and rebooted the system. Everything worked fine except the system could no longer access the internet, so I’m guessing the fake app was acting as a proxy of sorts.
After that I just decided to run Windows Restore to a point before the customer encountered this, rebooted and everything was fine. This, I think, is the fastest way to remove the fake app and you can read here on how to use the Windows Restore. The Internet Security Suite icon remains on the desktop, right click on it and select properties then click Find Target and delete the files displayed.
I found very little information regarding this fake application so thought I would add it to my blog. I did run across this site which provided a utility to download to remove the fake app, and if it wouldn’t let you, how to modify the Windows Registry file so you could download the utility. But I still think using Windows Restore is the simplest route to go.
