Internet Security 2010 (Malware)
Step by Step Removal Guide
Internet Security 2010 is a rogue anti-spyware program that gets installed on your system through malware. Once this software is running on your system a fake scan will start. The program will display a list of many infections that it has supposedly detected informing you that you need to purchase the program to remove the infections. All of these infections, of course, are fake. This is all setup to deceive you into purchasing the software. It goes without saying, you should definitely not purchase this software. You can see an image of the program below.
If your system has been infected with this rogue anti-virus software you will need to download some tools from the Internet in order to remove this infection. However, if your system is infected it is possible that you may not be able to download software using the infected computer. If this is the case you may have to download the tools needed to clean your system on a different uninfected machine, transfer the files to a usb drive, external drive or CD/DVD, and then copy the programs onto the infected machine.
The first thing that must be done is to terminate the processes that belong to the Internet Security 2010 Rogue so that they do not affect the cleaning process. To do this you will need to download RKill. RKill is a program from the guys over at BleepingComputer.com that is designed to terminate known malware processes.
The download link is here: RKill Download Link
On the download page click on the button labeled 'iExplore.exe download link'. Save the file on the desktop, or if you have downloaded the file on a different computer copy it to the desktop of the infected machine.
Double-click on the iExplorer.exe icon to attempt terminating all the processes associated with the Internet Security 2010 Rogue and other rogue software. It may take a few minutes so please wait. When the program has finished the window will close. If you get a message that RKill is an infection just ignore it. In some cases the RKill program will be stopped by the Rogue software. If this happens you can try leaving the warning message open and running RKill again. If RKill continues to be closed by the Rogue software you can try downloading one of the other versions of RKill listed on the download page. All of the files on the download page are just renamed versions of RKill.
Do Not reboot your computer after RKill has completed or the Trojan will start up again.
The next step is to download Malwarebytes Anti-Malware from the following link.
The download link is here: Malwarebytes Anti-Malware Download Link
Download the file to the desktop, or if you have used a different computer to download the file, copy it to the desktop on the infected machine.
Close all open windows (including this one if you are cleaning this computer).
Double-click on the icon named 'mbam-setup.exe'. This will start the installation process.
Just follow the prompts and leave all the settings at default. When the installation has completed make sure to uncheck both 'Update Malwarebytes Anti-Malware' and 'Launch Malwarebytes Anti-Malware'. Do not reboot!
If you receive any code errors during the installation of Malwarebytes just press 'OK' and continue. (We will fix that later).
This infection deletes a core exe file that is part of Malwarebytes so you will need to download a new copy of this file and place it into the correct directory.
The download link to the file you need is here: Malwarebytes Core Exe File
Please save the file to the following directory (or if you have used a different computer to download the file save it the following directory): C:\program files\Malwarebytes' Anti-Malware\ (This file will have a random name assigned to it - please write it down, you will need it in the next step).
Once the file has been saved into the correct folder open the C:\program files\Malwarebytes' Anti-Malware\ directory and double-click on the file that you wrote down. Malwarebytes will now start and you will see the following screen.
Malwarebytes will startup and you should see the following screen:
Before running the scan you will need to update Malwarebytes. To do this press the update tab and on the screen that appears press 'Check for updates'. Malwarebytes will download the updates necessary and when it has finished press 'OK' to continue.
Be sure that 'Perform full scan' is selected then click on the 'Scan' button.
The scanning process could take quite a while so find something to do while you wait for it to complete.
Once the scan has completed click on the 'Show Results' button.
Note: Your results may appear differently than those in the image above.
Now press the 'Remove Selected' button.
Malwarebytes may require you to reboot the system at this point to finish the removal process. Please allow your computer to reboot and follow any additional steps that need to be performed after your system has restarted.
If you intend to use Malwarebytes into the future you should uninstall and then download it again and reinstall it because the files have been changed by this infection.
If you are still experiencing problems at this point please give us a call and speak to one of our Virus Removal experts.