Mandy at Scunthorpe Rabbit Rescue says she already has a possible home for him and that if he didn’t have mites he would probably only be staying with her for a couple of hours.  There we have it - we are bad bunny parents.

Cut

As a typical scareware, Win 7 AntiMalware 2010 displays fake security warnings and notifications claiming that your computer is infected and under attack from a remote computer. That’s not true, please ignore such false information. The rogue program also blocks antivirus and antispyware programs and hijacks Internet Explorer & Firefox. It may disable Task Manager and Registry Editor to make the removal process rather complicated as these tools are very useful when removing such infections. You may choose to remove Win 7 AntiMalware 2010 either manually or with an automatic removal tool. However, please note that this rogue program may come bundled with other malicious software that’s why we strongly recommend you to use an anti-malware program for Win 7 AntiMalware 2010 removal.

I have now completed the removal and restoration of my system. I have backed up all the registry keys and will wait a week or so before deleting them in case I need to restore them. To make sure the I checked the registry keys were the same on both an XP and Windows 7 PC and work.

First a warning – this requires changing Windows registry, which can irretrievably damage your system if you make a mistake. Please ensure you backup your system before proceeding and make backups of all registry keys before you change/delete them. I cannot be held responsible if you break your system. If you are unsure, consult a professional before proceeding.

Anyways, here what I did:

Related files: %AppData%\vz.exe.

Win 7 AntiMalware 2010 properties:

• Changes browser settings
• Shows commercial adverts
• Connects itself to the Internet
• Stays resident in background

Kill Process – dedupchk.exe (I think), vz.exe. To do this I navigated to C:\Windows\System32\ right-clicked taskmgr.exe and chose Run as administrator. (Or from a command prompt navigate to the same folder run tasklist.exe to find the PID of the processes and then taskkill.exe /PID PID to kill the processes.)

Changed the following keys to:

• HKEY_CLASSES_ROOT\.exe (Default) = exefile (REG_SZ)
• HKEY_CLASSES_ROOT\.exe ContentType = application/x-msdownload (REG_SZ)
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command (Default) = “C:\Program Files\Mozilla Firefox\firefox.exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command (Default) = “C:\Program Files\Internet Explorer\iexplore.exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command (Default) = “C:\Program Files\Mozilla Firefox\firefox.exe” -safe-mode

Confirmed (and changed if necessary) that the following was correct:

• HKEY_CLASSES_ROOT\.exe\PersistentHandler (Default) = {098f2470-bae0-11cd-b579-08002b30bfeb} (REG_SZ)
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc AntiSpywareOverride = 0
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc AntiVirusOverride = 0
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc FirewallOverride = 0

Deleted the following keys in their entirety:

• HKEY_CLASSES_ROOT\.exe\shell\
• HKEY_CLASSES_ROOT\sezfile\
• HKEY_CURRENT_USER\Software\Classes\.exe\
• HKEY_CURRENT_USER\Software\Classes\sezfile\

Finally deleted %AppData%\vz.exe.

Hey presto – my system works!

The idea for the trilogy was suggested by an older man telling that he didn’t think life was ruled by love, or reason, or money, or the pursuit of happiness — but by fear. This smart-but cynical guy’s position was that most people’s actions are motivated by fear of being hungry, fear of being hurt, fear of being alone, fear of being robbed, etc., and that people don’t make choices based on hope that something good will happen, but in fear that something bad will happen.

I reacted to this the way all of us tend to react to generalities: “Well, I’m not like that!” But then I started thinking about it more, watching the way people around me behaved, and I soon realised that there was something to this viewpoint, So I sketched out the three “theaters of fear,” as I saw them: how fear works inside us (“The Enemy Within”), how fear is used against us (“The Weapon”), and how fear feeds the mob mentality (“Witch Hunt”).

As it happened, the last theme was easiest to deal with, so it was written first, and consequently appeared first on record, and the other two followed in reverse order for the same reason

Neil Peart on the “Fear” trilogy by Rush, still an interesting philosophy

I am currently cleaning up my iTunes, moving greatest hits to original albums, removing duplicates, putting the English album covers on instead of American, and it was this last part part that got me – downloading images from Google. I was looking for the 2 heads facing each other that can look like a vase. In the 90′s I was in a band that had a recording session that we sold on cassette. I still have it on my iPod, but never kept the artwork and I was trying to re-create it.

The first I know is I get a message saying that Windows has changed to the default desktop colours and then it starts scanning my disks. It looks quite like Windows 7 security, but I know that it isn’t. What it will do next is to report that it has found a number of “threats“ and if I click the link and pay around £25 pounds it will install the removal software and clean my system…of nothing. As I am responsible for my company’s IT I am already aware of this scam and close the window.

I still get notifications from the system tray but I just ignore them. Next up is the Fake Security Centre. Again it’s prompting me that Win7 AntiMalware is turned off and a Turn On button. Persistent little critter isn’t it.

Anyway if I did succumb to any of these prompts I would get the final screen where I would be taken to the fake site that asks for payment. Not only would they process the payment, thereby earning themselves £25, they would also have my credit card details. The final part of the scam is I would eventually be re-directed to a genuine survey which they would earn money from (a device used in almost all Facebook “Oh my God…” scams).

If I tried to access the Internet (using IE or Firefox, but not Safari) all pages were re-directed to “fake” security warning. I couldn’t open Task Manager by right clicking the task bar (my preferred method).

Anyway it took me ¾ hour to get rid of it – I’ll be posting instructions, when my system is completely back to normal

Peter Venkman:

“Lenny,,,,you just saved the lives of millions of voters”

Source: Ghostbusters

Have however taken the opportunity to polish up the petrol cap surround.

Before

After