Internet Security 2010 is a rogue antispyware program, clone of widely spread Advanced Virus Remover, which is also rogue antispyware program. The program distributed with the help of trojans. When Internet Security 2010 is installed, it will configure itself to run automatically when Windows loads.
Once running, Internet Security 2010 will begin to scan your computer and list a variety of infections that will not be fixed unless you first purchase the program. Important to know, all of these infections are fake and do not actually exist on your computer, so you can safely ignore them.
What is more, while Internet Security 2010 is running your computer will display nag screens, warnings and fake security alerts from your Windows taskbar. Some of the alerts:
System warning!
Continue working in unprotected mode is very dangerous.
Viruses can damage your confidential data and work on your
computer. Click here to protect your computer.
System warning!
Intercepting programs that may compromise your privacy and
harm your system have been detected on your PC.
It`s highly recommended you scan your PC right now.
Just like false scan results, all of these warnings are fake and should be ignored! If you find that your computer is infected with this malware, then be quick and take effort to remove it immediately. Use the removal guide below to remove Internet Security 2010 from the system for free.
More screen shoots of Internet Security 2010
Symptoms in a HijackThis Log
O4 – HKCU\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe
Use the following instructions to remove Internet Security 2010 (Uninstall instructions)
Step 1
Download HijackThis from here. Once Save dialog opens, please rename HijackThis.exe to iexplore.exe as shown below.
Save Dialog – HijackThis.exe
Save Dialog – iexplore.exe
Click Save button to save it.
Run HijackThis. Click “Do a system scan only” button. Now select the following entries by placing a tick in the left hand check box, if present:
F2 – REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon32.exe
O4 – HKLM\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
O4 – HKCU\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
O4 – HKCU\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe
Once you have selected all entries, you will see a screen similar to the one below.
HijackThis
Close all running programs then click once on the “fix checked” button. Close HijackThis.
Step 2
Download LSPFix from here and unzip it to your Desktop.
Run LSPFix. Place a tick in the “I know what i`m doing”.
In the KEEP box select helper32.dll (if the file is not listed in KEEP box, then close LSPFix and go to step 3). Press “>>” button and you will see a window as shown below.
LSPFix
Press Finish>> button. When LSPFix is done removing the LSP you will see a summary box. Press OK. Reboot your computer.
Step 3
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select Perform Quick Scan, then click Scan, it will start scanning your computer for Internet Security 2010 infection. This procedure can take some time, so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected for start Internet Security 2010 removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
Internet Security 2010 creates the following files and folders
C:\Program Files\InternetSecurity2010
C:\Program Files\InternetSecurity2010\IS2010.exe
Internet Security 2010 creates the following registry keys and values
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internet security 2010
Cassandra and dee, looks like your PC is infected with a hidden trojan that reinstalls the rogue. Ask for help in our Spyware removal forum.
roger, make a new topic in our Spyware removal forum. Probably your PC also infected with winupdate86 trojan. Read the instructions.
Tim, looks like your PC is infected with a new variant of the rogue. Please ask for help in our Spyware removal forum.
I had a problem with that internet security last night… today my internet wouldnt work so I called my internet provider and the y suspended my account because there was attacks on my comp, and they were afraid that there system would get infected. so now if I get attacked and they have to suspend me again I lose my internet through them for good.
I had a bad case of 2010. I tried the deleting fixes but the malware had disabled both CTR ALT DEL and the ability to delete files.
I had to load Spyware Doctor via a flash drive because internet was also disabled. It was a mess.
My AVG missed the infection so I decided the $39 for a combo anti-virus and clean-up tool was worth it.
Everything is now back to normal – though Spyware Doc blocks LOTS of websites as being on a list of banned sites.
Worked for me.
After the software tried to delete the Internet Security 2010..my computer crashed and is stuck in a non-stop cycle showing no drives exist now. Can not figure out how to stop it. Please help!
zech, try boot you PC in the Last good configuration mode.
i was able to do system restore. initially was not able to while first combating the problem, but i rebooted in “last good config”. when it rebooted, the problem was still there, however i quickly clicked on system restore just to see, and to my surprise it was there and it allowed me to. im not much of a techie, so maybe it was luck
thang, if the instructions above does not help you, then ask for help in our Spyware removal forum.
I was hit by this. I installed spyware doctor and ran the check. It did find some threats but asked you to purchase to get rid of the virus. I closed it. Now, it won’t let me log into windows. I tried every mode. Every time as soon as i logged int, it will log off. Please help!
Dennis, read comments here. Try copy userinit.exe to winlogon86.exe or winlogon32.exe).
Had a bear of a time killing this, If you delete the winlogon386 you will get the logging on then immediate logoff. You will have to run an XP repair from CD. IF you kill it with Malwarebytes (and it is not ieasy if the IS2010 has been running awhile) then restore the internet connection in IE, Under connections the crapwad IS2010 inserts a proxy server, and under the TCP/IP advanced settings it changes the TCP/IP filtering to permit only. Check these and you can update malwarebytes and restore internet connectivity
Thank God for this site after i finally figured out what was going on. I had several virus along with is2010, i followed the steps exactly everything worked and i got rid of all the viruses. I have norton 360 and all of this was not detected. Thank You again.
Tried removing IS2010 with Windows removal tools and scan also own virus software. Didn’t touch it. Followed your instructions and MBAM nailed it. Thank you very much, worked a dream.
Thank Goodness for your site! IS2010 is history on my computer.
Followed all the instructions and thought i had it, but now, I can’t login… i try to, then it immediately logs me off. I just tried the BartPE, but received error messages and was unable to create a disk to bypass the login issues. Any recommendations? PLEASE HELP!
Thanks.
marc, boot your computer in Recovery console using Windows installation disk (R option).
Once loaded, type cd system32 and Press Enter.
Type copy userinit.exe winlogon86.exe and press Enter.
Type copy userinit.exe winlogon32.exe and press Enter.
Type exit and press Enter to reboot your computer.
I have the problem with my computer. It blocked REGEDIT, Task Manager and the Run box. It also didn’t allow me to start the computer in anything different than Normal Mode (no Safe Mode, Command prompt only, etc.). I downloaded and ran the IRKILL.exe program but it wasz also interrupted by the virus some how.
I’m now performing a full scan from MBAM. Will post later the results.
No good luck with MBAM. It found over 17 issues but after restart I still get the pop-ups and the background. I found the background file and was able to delete it and restore my background but after restart it reappeared. 🙁
Will continue on Monday and post the results.
Although i dont want to use Maleware, i was Rogers Anti-Virus and Anti-spyware. It had already tooken out 3 trojans from thist Secuirty 2010 Program but im not sure if it can completley take it out, atm im still doing a virus scan. Can anyone tell me Can the internet Secuirty 2010 Program be completley taken out with Rogers Anti-Virus
Followed instructions but the malwarebytes program keeps freezing up,any solution to that part please and thank you.
Jason, Malwarebytes Anti-malware is good and free malware remover. Also you can try SuperAntispyware.
Don, try these steps.
i think i successfully deleted the “internet security 2010” virus but now when i go to Facebook or ask.com it gives me a maroon colored screen and says the site has been restricted. What other steps do i need to take to get rid of this problem? THANKS FOR YOUR HELP!!!
i think i successfully deleted the virus but when i go to facebook or ask.com it gives me a maroon colored screen and says the site is restricted. how do i rid this problem? THANKS FOR ALL YOUR HELP
Well… apparently it took a couple of restarts and it allow me to get into Safe Mode where I was able to delete the rest of the files associated to IS2010. The Task Manager was also disabled by the virus but there are instructions in the Internet on how to reset the Task Manager. In my case it was an entry in the registry that has to be deleted.
MBAM seems to be a good program but I will take note of SuperAntispyware for the future.
Thanks!
THANK YOU! THANK YOU! PIZZA! 😀 THIS SERIOUSLY WORKS! NO JOKE! I LOVE YOU!
Like others, IS2010 gets to the point of a windows login screen but bounces back to the login screen after trying to login each time. Safe mode doesn’t work (get blue screen of death). How does one get to the file system, at least, via DOS or whatever. I can’t get anywhere to be able to do anything. Most of the posted solutions talk about installing this or that software but I can’t even got to a place where I can install or delete anything. The only thing I can get to is the windows login screen, nothing more. Ideas please?
Larry, boot your computer in Recovery console using Windows installation disk (R option).
Once loaded, type cd system32 and Press Enter.
Type copy userinit.exe winlogon86.exe and press Enter.
Type copy userinit.exe winlogon32.exe and press Enter.
Type exit and press Enter to reboot your computer.
Hi there.
I would like to say thank you. The information here has been extreamly helpfull. My Mother’s PC had become infected with this along with the “FAKE WORM.WIN32.NETSKY” package of nasties. I would strongly recomend that if you experiencing this problem, then follow the “FAKE WORM.WIN32.NETSKY” guide first. It would be better to spend half an hour or so doing that to ensure that the fix works.
Again, many thanks for the help.
James