How to Remove Internet Antivirus 2011 (Uninstall Guide)

Don't Copy From This Blog...

Internet Antivirus 2011 is a rogue security program that misleads users into paying for the fake removal of malicious software. This fake program creates numerous harmless files on the computer and detects them as spyware, adware, trojans and other viruses during fake system scan. After the fake scan, Internet Antivirus 2011 prompts the user to pay for a full version of the program to remove the infections that do not even exist. If you have this rogue program on your computer, don't purchase it. Otherwise, you will lose your money and give your dredit card details to cyber criminals. Please follow the removal instructions below to remove Internet Antivirus 2011 from your computer for free using legitimate anti-malware programs.

While Internet Antivirus 2011 is running, it will display fake security alerts and notifications saying that your computer is infected with malware or that your sensitive information can be stolen. However, usually such rogue programs do not delete any files unless they come bundled with ransomware or other malicious software. This doesn't happen very often, so you shouldn't worry too much. To make things worse, Internet Antivirus 2011 may block programs on your computer and hijack Internet Explorer. Usually, it enables a proxy server on the compromised computer and then redirects users to misleading or malicious websites. If you can't browse the Internet normally, then you should check your LAN settings. You will find more information in the removal instructions below.

Internet Antivirus 2011 is from the same family as My Security Shield and My Security Engine malware. They are identical actually, except their names of course. Be advised, that such rogue programs usually comes bundled with rootkits. Removing Internet Antivirus 2011 files is not enough; you should scan your computer with TDSSKiller or Hitman Pro for rootkits. If the rootkit exists and you won't remove it then you may get another rogue program on your computer next day or after week. By the way, if you have already purchased this bogus program then you should contact your credit card company and dispute the charges. Last, but not least, if you have any questions or just want to share some valuable info about this malware, please leave a comment. Good luck and be safe online!

Internet Antivirus 2011 removal instructions using HijackThis or Process Explorer (in Normal mode):

1. Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab. Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.

2. Download Process Explorer.
3. Rename procexp.exe to iexplore.exe and run it. Look for similar process in the list and end it:

SA548_581.exe

OR download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it. Search for similar entries in the scan results:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:25520
O4 - HKCU\..\Run: [Internet Antivirus 2011] "C:\Documents and Settings\All Users\Application Data\25485A\SA548_581.exe" /s /d
Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

4. Download free anti-malware software from the list below and run a full system scan.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

5. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

Internet Antivirus 2011 removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm

NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab.
Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.

3. Download free anti-malware software from the list below and run a full system scan.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

Internet Antivirus 2011 associated files and registry values:

Files:

C:\Documents and Settings\All Users\Application Data\25485A\
C:\Documents and Settings\All Users\Application Data\25485A\SA548_581.exe
C:\Documents and Settings\All Users\Application Data\25485A\[SET OF RANDOM CHARACTERS].dll
C:\Documents and Settings\All Users\Application Data\25485A\[SET OF RANDOM CHARACTERS].ocx
C:\Documents and Settings\All Users\Application Data\25485A\MSSSys\
C:\Documents and Settings\All Users\Application Data\SMEYFE
%UserProfile%\Application Data\Internet Antivirus 2011\
%UserProfile%\Application Data\Internet Antivirus 2011\cookies.sqlite
%UserProfile%\Application Data\Internet Antivirus 2011\Instructions.ini

%UserProfile% refers to:
C:\Documents and Settings\ (for Windows 2000/XP)
C:\Users\[User Name]\AppData (for Windows Vista & Windows 7)

Registry values:

HKEY_CURRENT_USER\Software\3
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\SMae0_2129.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=2129&q={searchTerms}"
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=2129&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" = "http://127.0.0.1:27777/?inj=%ORIGINAL%"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:25437"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "Version/10.02129"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "DisallowRun" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Internet Antivirus 2011"
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=2129&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"

Share this information with other people: