How to Remove E-Set Antivirus 2011 (Uninstall Guide)

Don't Copy From This Blog...

E-Set Antivirus 2011 is a rogue anti-virus application that mimics legitimate security software vendors. This fake AV package rips off ESET's name and steals AVG Anti-virus logo. Cyber-criminals use web-based pop-up ads to trick web users into downloading this rogue anti-virus application. E-Set Antivirus 2011 claims to scan your computer for malware, displays fake security warnings about infections and then asks for money to remove the non-existent malware.

The rogue application hijacks web browsers via Image File Execution Options and displays fake security warnings Internet Explorer Emergency Mode and Attention! Your web page requested has been canceled.

About Internet Explorer Emergency Mode
Your PC is infected with malicious software and browse couldn't be launched
You may use Internet Explorer in Emergency mode - internal service browser of Microsoft Windows system with limited usability.
Notice: Some sites refuse connection with Internet Explorer in Emergency Mode. In such case system warning page will be showed to you.

Other fake E-Set Antivirus 2011 alerts:

The home page of E-Set Antivirus 2011 is zsecuritymall.com. It's pretty much a copy of Panda Antivirus web page.

E-Set Antivirus prevents executions of legitimate malware removal tools and other applications on your computer. It falsely states that a certain application is infected or corrupted and was blocked due to security reasons. If your computer has been infected, it may dramatically slow down. To remove E-Set Antivirus 2011 from your computer, please follow the steps in the removal guide below. If you have any comments or questions regarding E-Set Antivirus 2011, we'd like to hear them! Good luck and be safe online!

UPDATE: You can use this code ABC12-DEF34-GHI56-JKL789 to register the fake E-Set Antivirus 2011. Then scan your computer with anti-malware software.

E-Set Antivirus 2011 removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Login as the same user you were previously logged in with in the normal Windows mode. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm

2. Download free anti-malware software from the list below and run a full system scan.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

Alternate E-Set Antivirus 2011 removal instructions (Manual):

1. Go into C:\WINDOWS\system32 folder. Locate msiexecs.exe and delete it. Important! Do not delete msiexec.exe. See the image below.

2. Open the Windows Registry Editor. At the taskbar, click Start → Run. Type regedit and click OK or press Enter. (In Windows Vista/7 click the Start button in the lower-left corner of your screen. Type regedit into Start search box and press Enter).

3. Locate the HKEY_LOCAL_MACHINE entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

In the righthand pane select Debugger = msiexecs.exe -sb and delete it if it exists.
Close the registry editor.

4. Open Internet Explorer and download free anti-malware software from the list below and run a full system scan.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

Associated E-Set Antivirus 2011 files and registry values:

Files:

C:\Documents and Settings\All Users\Start Menu\E-Set 2011\
C:\Documents and Settings\All Users\Start Menu\E-Set 2011\E-Set Antivirus 2011.lnk
C:\Documents and Settings\All Users\Start Menu\E-Set 2011\Uninstall.lnk
C:\Program Files\E-Set 2011\
C:\Program Files\E-Set 2011\e-set.exe
C:\WINDOWS\system32\msiexecs.exe

Registry values:

HKEY_CURRENT_USER\Software\[SET OF RANDOM CHARACTERS]
HKEY_CURRENT_USER\Software\[SET OF RANDOM CHARACTERS]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "E-Set 2011" = 'C:\Program Files\E-Set 2011\e-set.exe'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "WinNT-A8I 16.03.2011"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe "Debugger" = 'msiexecs.exe -sb'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe "Debugger" = 'msiexecs.exe -sb'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe "Debugger" = 'msiexecs.exe -sb'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe "Debugger" = 'msiexecs.exe -sb'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safari.exe "Debugger" = 'msiexecs.exe -sb'

Share the knowledge: