Severity scale:  

Win 7 Internet Security 2012. How to remove? (Uninstall guide)

removal by Olivia Morelli - -   Also known as Win7 Internet Security 2012 | Type: Rogue Antispyware

Win 7 Internet Security 2012 is a phony anti-spyware program that supposedly scans your computer for malware and displays a list of false system security threats to scare you into thinking that your computer is infected with worms, trojans, spyware and other malware. Then the rogue program prompts to pay for a full version of the program to remove the infections which don't even exist and to ensure full system protection against other malware. This misleading program also displays fake security warnings and pop-ups claiming that your computer is badly infected or that your data might be deleted.

Privacy threat!
Spyware intrusion detected. Your system is infected. System integrity is at risk. Private data can be stolen by third parties, including credit card details and passwords. Click here to perform a security repair.

Stealth intrusion!
Infection detected in the background. Your computer is now attacked by spyware and rogue software. Eliminate the infection safely, perform a security scan and deletion now.

Win 7 Internet Security 2012 Alert
Security Hole Detected!
A program is trying to exploit Windows security holes! Passwords and sensitive data may be stolen. Do you want to block this attack?

Don't trust all these alerts and remove Win 7 Internet Security 2012 from your computer upon detection.

Furthermore, Win 7 Internet Security 2012 hijacks Internet Explorer and blocks almost all sites claiming that they are infected or compromised and may infect your computer. It goes without saying that it blocks security related websites in the first place. Win 7 Internet Security 2012 also blocks antivirus and anti-spyware applications. It prevents new installation of anti-malware tools so you will have to ends its processes first. Otherwise it will continue to block malware removal tools.

If you find that your computer is infected with this annoying virus, please use the removal instructions below to remove Win 7 Internet Security 2012 as soon as possible either manually or with an automatic removal tool. If you are blocked from running your anti-spyware, enter one of its activation codes to make it think you have purchased the program: 1147-175591-6550, 2233-298080-3424 or 9443-077673-5028. In addition, run a full system scan and find all the files of the virus.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Win 7 Internet Security 2012 you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Win 7 Internet Security 2012. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.
Press mentions on Reimage

Win 7 Internet Security 2012 manual removal:

Kill processes:

Delete registry values:
HKEY_USERS.DEFAULTSoftwareMicrosoftInternet ExplorerBrowserEmulation "TLDUpdates" = '1'

HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "%1" %*'

HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "%1" %*'

HKEY_CLASSES_ROOT.exeshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "%1" %*'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "C:Program FilesMozilla Firefoxfirefox.exe"'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellsafemodecommand "(Default)" = '"%LocalAppData%kdn.exe" -a "C:Program FilesMozilla Firefoxfirefox.exe" -safe-mode'

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = '"%LocalAppData%kdn.exe" -a "C:Program FilesInternet Exploreriexplore.exe"'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "AntiVirusOverride" = '1'

HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "FirewallOverride" = '1'

Delete files:





About the author

Olivia Morelli
Olivia Morelli - Ransomware analyst

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Olivia Morelli
About the company Esolutions

  • Hoang

    This spyware is very smart. It blocked every attempts that I want to do to kill it. I cant execute anything from task manager to regedit to IE as Administrator, so all the instructions I got before doesnt work for me because I cant execute anything. I did the following steps and I was able to successfully removed this malicious spyware. Try it for yourself and hope it will help you too:

    1) From another working computer, go to this website:

    Follow the links there to download the following files on a USB Flash drive:
    – FixNCR.reg (
    – iExplore.exe from
    – (Note I downloaded rkill.exe here too but I dont think its needed)
    – Download a free version of MalwareBytes Anti-Malware here

    On the infected computer that is now taken by the Internet Security spyware, press and hold the power button to force improper shutdown, then press the power button again to turn it back on. This time it will ask you if you want to boot into Safemode or normal mode. I chose Safe Mode. For some reasons, Safe Mode with Networking doesnt work for me.
    Once your infected computer is in Safe mode, copy the 3 files downloaded above to a local directory on your infected machine.
    – Double click to run FixNCR.reg
    – Double click iExplorer.exe. This process take a while so please be patient. I did run this program twice and also the rkill.exe here but I think its overkill.
    – Click to install the MalwareBytes Anti-Malware. You wont be able to update because you wont have internet access but you dont need to update at this time. Just let this software install and scan. It will take around 15-20 min to run so go take a break. This program will detect and remove iSecurity.exe and 3 other spyware programs from your system. Once you restarted, your system will be back to normal as if it wasnt infected. Then you can update your MalwareBytes software. I was so happy that I was able to fix this without reformat my hard drive and reload Windows.
    I hope this instructions help many of you out there who is struggling to recover from this smart but malicious spyware.

  • anon1

    Malware Bytes detected dns.exe for me this AM when a client opened an email attachment and activated the Win7 parasite. Once deleted through the software the problems ceased. I did use a restore point for added peace of mind.

  • Scott

    I had this pop up yesterday, did system restore, now nothing will open on my computer. Every program or file I try to open says it isnt there. Even when I go to my hard drive, doesnt show any files. Can anyone help? Thanks in advance

  • ken

    Joe is the man, thanks for the fix worked like a dream:

    Enter this key to register the program “3425-814615-3990”.
    After that you will have internet access again. Download Malwarebytes.
    Right click the setup file and run as Administrator. Install, update and do a full scan. Reboot as it says and the virus should be gone.

    although i used a Kaspersky download and found 4 more trojans,


  • HudsonBoys

    I got this Virus this morning ” Win7 Internet Security 2012. Followed the basic instructions above : safe mode, regedit, delete the malware file (lmk.exe file in my case)) . Rebooted PC one last time, system no longer getting hijacked, but for some reason I lost my cmd.exe (C:windowssystem32cmd.exe), and all my other applications would simply give me a notice that “Application not found”. Any ideas?

  • Mel 1

    Thank you so much! This helped me too. I was going crazy downloading scanners from one computer to try on the infected one only to have it not work. This worked, so thank you!

  • michael

    mine showed up as hfn.exe in my task manager. i stopped the processs and the internet worked for awhile long enough for me to search for the hfn.exe file and then delete it, after that my computer was good as new …….so far. its been several hours since it went away i just hope it doesnt regenerate/repair itself. there were 2 other 3 letter extensions that i couldnt stop process as they were listed as system processes. the hfn.exe was the only 3 letter exe that was listed to my user profile and kept popping up when the viris returned and kept showing the fake viris protection. after moving it to my trashcan i emptied it…..

  • Bryan

    System restore did not work for me. Regedit to access the registry did not work. Did not have a back-up computer but i had two administrator accounts so I could log on to the internet from the unaffected admin account to get to this site. I found the process file under oov.exe. When I stopped the process I then opened internet explorer and it could access the internet. While internet explorer was opened I then accessed the registry by typing in regedit from the start prompt. I then proceeded to look for the registry keys given here to delete. After deleting the first key I proceeded to the next key but was unable to find it. ***by chance**** I went back to iexplorer and found that the virus had started working again. when I glanced back at the Task Manager I noticed in processes that oov.exe had restarted itself. I terminated the process and when I went back to look for the second registry key to delete and there it was! after deleting the 2nd registry key oov.exe did not start on its own. I think that the keys appear at start-up.

  • JestersBaubles

    Couldnt find any of the files listed above, and deleting the registry keys noted above did not work. Had to do system restore.

  • Chrisj

    My system restore actually didnt work, it told me after the whole reboot that the system restore file was corrupted and couldnt complete the process. Help?

  • Jaime

    Plain and simple: just do a System Restore. Restart your computer in Safe Mode with Command Prompt. Type rstrui.exe. Select a restore point. 10 minutes later, your computer will be back to normal.

  • nikki

    I used Combo fix, my infected file was flj.exe

  • win 7 hater

    Hi iv read all your comments, and was just wondering if I am to run a system restore will this delete all my pictures and films etc? Appreciate the feedback 🙂 cheers

  • Nik

    That virus almost cost me my final exam! This website is a lifesaver. The virus was plb for me by the way.

  • terd

    it showed up on my wifes netbook as “tos.exe”. Avast found it but couldnt do anything about it. I used combofix (from above post) and as far as I can see, only had one lingering line in the firefox safe-mode registry. combofix also cleaned up about 1 gig on a tiny 32 gb ssd. all seems to be normal again. for now – the wife needs to lay off the porn :>

  • bill

    Working on the System Restore. This Win 77 is bad news.

  • Michael Kessen

    I used Malwarebytes, Spy Doctor, my own anti-virus program Avast and regedit fixes and I still couldnt access most things like Device Manager, games, apps, most programs, etc..They did fix the annoying pop-ups I was having and I was able to access the internet. I couldnt do a System Restore either because it deleted my restore points. I was frustrated and did not want to reformat my HD until I came across a post where someone mentioned a program called Combofix on a different website, is where it can be downloaded and its free. It appears my problems are all gone. Try it out and see if it works, it worked for me.

  • Gage

    OK. Well this little bigger seems to be a rapidly changing virus/mal ware. Though simply running a program as and admin does seem to be the quick and easy way around it.
    Though I wouldnt post here without saying what the name was and my particular file hid itself as jmq.exe
    Ran malwarebytes as and admin and was good. (Right clicked malwarebytes and select run as administrator )
    Lets keep the name of this one up to date since its always changing.

  • Gage

    OK. Well this little bigger seems to be a rapidly changing virus/mal ware. Though simply running a program as and admin does seem to be the quick and easy way around it.
    Though I wouldnt post here without saying what the name was and my particular file hid itself as jmq.exe
    Ran malwarebytes as and admin and was good. (Right clicked malwarebytes and select run as administrator )
    Lets keep the name of this one up to date since its always changing.

  • Shaun

    I just did a system restore because I am not savvy enough to deal with registries and manual uninstalls, however, I think the process was det.exe with a description of Windows Presentation Foundation Host.
    Heres why:
    – the process was listed as being created only two hours ago, about when the spyware became active, while all my other processes were created months ago
    – det.exe did not appear in my search of while most others did.
    – its format conforms with the reported format others have seen jkl.exe , ari.exe , wkx.exe , oab.exe , ppn.exe etc.
    – its description attached it to an official windows process(reported by one other commenter)

    So I guess what Im saying is the process will be different for everyone but should be fairly easy to pick out if you look a little closer. Again, I have no clue what to do after halting the process though, so system restore if that is an acceptable option.

    • Hurl

      Shaun – This will remove the registry Entries for you. Open notepad and past the below into the file, go to “File” “Save As” Change file type to “All Files *.*” and save file as fix.reg

      –Copy Below
      Windows Registry Editor Version 5.00

      “Content Type”=”application/x-msdownload”






      @=””%1″ %*”
      “IsolatedCommand”=””%1″ %*”


      @=””%1″ %*”
      “IsolatedCommand”=””%1″ %*”









      [HKEY_CLASSES_ROOTexefileshellexPropertySheetHandlersShimLayer Property Page]

      @=”C:Program FilesMozilla Firefoxfirefox.exe”

      @=”C:Program FilesMozilla Firefoxfirefox.exe” -safe-mode

      @=”C:Program FilesInternet Exploreriexplore.exe”


  • lesley

    It doesnt allow me to run a system restore

  • DMix

    I also got this virus from – trying to update flash player and this virus installed. I found in the appdata folder an executable “jkl.exe” and running as a process in 32bit mode. I killed the process and renamed the .exe and ran Microsoft security essentials manually by browsing to the folder program files then microsoft security client then msseces.exe “run as administrator” and full scan which is not detecting the root virus, but other “dropper” viruses. MS security essentials has been very good to me so far, but this “type” and variant has been out for a while so it should have been stopped early on. Im wondering if ADOBE knows they have this?!? Looks like its been inside a flash player update for a few weeks at least.

  • richard

    I was suspicious when it seemed like my internet speeds were slowing down them bam! Win 7 security…..

    I ran system restore, scanned w/ maleware bytes, rebooted.

  • Curl

    A few days ago my husband got this virus on his computer and it is absolutely frustrating him. I see that you guys have all posted about fixes to the problem. My problem is that my husband and I are not computer savvy, so I do not understand exactly what we should do to get rid of this thing! Any help is much appreciated!!!

  • Joe

    Ok, follow these steps to remove…

    Enter this key to register the program “3425-814615-3990”.
    After that you will have internet access again. Download Malwarebytes.
    Right click the setup file and run as Administrator. Install, update and do a full scan. Reboot as it says and the virus should be gone.

    Btw…the file in question was named “iov.exe” on my computer.

  • Joe

    Download Malwarebytes…right click and run as administrator. That will allow you to run the install!

  • epic

    Rodi thank you so much you just made my day ! Much love

  • rodi

    Just this code 3425-814615-3990 to manually register the program. Then it won’t block anti-spyware programs and Internet Explorer.

    • Tom

      Where do you enter this code?

    • Joe

      still blocks malwarebytes and prevents installing…read down farther for work around

      • Joe

        Even after using the code it still prevented me form going into safemode as well as blocking mscongfig. Beware people the virus is running on your computer after using the code. 2 of the codes didnt work. I think I used the same one as listed above. Funny…after entering it said removing threats…lol, give me a breake. These morons need to get a job like the rest of us. Sad part is, people fall for this and pay the money. They are said to have made millions wiht this scam!

  • thxrodi

    Thanks Rodi u actually helped me Thanks!

  • thankspanda

    I got the Win7 7 internet sec 2012 too. I believe I got it from watching streamed TV episodes at free TV project website…. The browser shutted down by itself, and aftwards, it was a problem to have access to internet… both firefox and iexplorer would not connect.
    I looked at the task manager and deleted the file as it says in a previous post, and then used windows updater to fix the registry. somehow spywaredoc was not installing. after several attempts, i restarted windows in a previous point in time, and then I was able to download and run Panda software free trial, which cleanned my computer…. ouch!
    luckily, i had a back up computer where I could look for all this info. many thanks

  • FhvnEd

    I must add my thanks as well. I was just looking for a collegiate graphic and all of a sudden my system went haywire. Popups all over telling me I was infected, in danger of crashing, my passwords were being hijacked, etc, etc. Not seeing anything coming from my McAfee or firewall, I assumked this was just what it was… some form of spyware. I had no idea how invasive this thing is/was. I couldnt open any programs, couldnt get to my files and my email stopped working. Using a clean computer, I googled it and found you guys. I also bought Spyhunter, but couldnt get to my pthumb drive so I wasnt until I used your manual cleaning solution that I got the system back.

    A couple of points. My infected file was roe.exe, and although I removed all mention of it, I couldnt actually find the file on my system.

    Cleaning the registry was what made it all go away, but I only found references to it in about half of the listings that showing in the fix above.

    BOth the anti-virus override and firewall override were set at “0”, and the only reference to the virus was in my Firefox registry. The IE reference was clean.

    Regardless, this fix saved me a lot of aggrevation and heartache as I envisioned spending hours (if not days) getting this persistent little beggar out of my system. Thanks. Again

  • Mosaicmel

    Thanks Geo1… Ur a life saver!!! This worked beautifully (and I was freaking out… Lol)

  • thanksgeo

    thanks geo1.

    system restore worked just fine….now on to run a scan.

  • Geo1

    Heres what was easiest and worked for me:

    I typed in “system restore” into the finder. I then right-clicked on system restore and chose “Run As Administrator.” Choosing to run it as the administrator prevents the virus from automatically closing it. Then just run system restore, and your computer will be back to normal.

    The above does not have to be done in safe mode, because the virus still runs in safe mode as well.

    • BobM

      Thanks for the comment. Worked like a charm! This Win 7 thing scared my wife cause she thought she had a computer full of viruses. Neither of us are that computer savy, so your posting really saved me a lot of anxiety.

    • Rod

      This worked great! Did this and ran Malwarebytes afterwards to delete the malware. Thank you!

    • tb1

      System Restore worked Thanks Geo!
      Running ca scan now…

    • katydid

      Thank you very much!! Easy fix for someone like me who knows almost nothing about a computer. You saved the day! 🙂

    • Sophia

      Wa wondering if youhave any advice– After do what you mentioned, it says that i need to turn syste prtection on first. When I go todo that under controlpanel-system-system protection- the option to click on a driver andturn it on does not come up. Doyou know what I shoulddo in this case? Thans.

    • Jeff

      Worked for me, thanks.

    • Stephany

      It worked for me as well!!
      😀 You are the best!

      Thank you sooooo much!

    • Shawn Raverty

      :et me tel you something. I just got a new laptop and we so upset this happened…….thought it was shot…….I have goosebumps now telling you. IT WORKS JUST LIKE YOU SAID……Thanks so much………My girlfriend is gonna be so excited…..If anyone doubts this look me up. 100% authentic info!!! Time to jump back online…….” Geo1 ” saved the day!

  • Darr247

    Ugh… this board strips out all the back slashes when you click Post Comment. Real helpful. Not.

  • Darr247

    This came packaged in a 730KB file named AdobeFlashPlayerInstall.exe showing version (current version of Adobe Flash Player is 11 something, I think) that I found in %TEMP%, and showed up on Task Managers Processes tab as ptb.exe (Microsoft Direct Play).

    Manual removal above worked, though some of the items listed did not exist…
    HKEY_CLASSES_ROOT.exeshellopencommand “(Default)” = ‘”%UserProfile%Local SettingsApplication Data[random].exe” /START “%1? %*’ (this one was not present)

    HKEY_CLASSES_ROOTexefileshellopencommand “(Default)” = ‘”%UserProfile%Local SettingsApplication Data[random].exe” /START “%1? %*’ (this one was not present)

    The 2 Firefox entries were not present because Firefox isnt installed on this machine, and the last one (in StartMenuInternet) had as the command
    %UserProfile%AppDataLocal[random].exe” -a “C:Program Files (x86)Internet Exploreriexplore.exe instead of
    ‘”%UserProfile%Local SettingsApplication Data[random].exe” /START “%Program Files%Internet Exploreriexplore.exe”

    The registration codes found on other sites were both rejected as invalid, so thats pretty-much a waste of time.

    Downloading MBAM and STOPzilla now. 🙂


    Im confused. How do I delete the malicious files? I dont even have a msconfig (apparently) and although I deleted the processes and registry values, I cant finish the last step! Can someone help me with it? Totally clueless, although I clicked the link at the bottom thats supposed to help me

  • mel

    Purchase Kaspersky anti virus, l swear by it, l had McAfee at the time l got the virus which does not detect this virus, as soon as l installed kaspersky it detected it and removed all of its components, kaspersky is the best anti virus l have ever used, works like magic 🙂

    • Jen

      Only problem with adding a good antivirus once you already have this stupid win7 crap is that you cant install anything oce its in there. I can get malwarebytes or anything to open or install onto it. I cant even get to any webpage to install anything else and i dont know how to delete registry keys… Im so mad!!!

  • daniel27r

    Also known as ari.exe
    Damn virus is everywhere…

  • Lind s

    Helpful, indescription of processes look for ukrainian or russian lettering…thats the virus mine was kwe.exe

  • Generic User Name

    Avast! did nothing. Process was called awg.exe on my system.

  • Hellow

    I tried to remove the processes but the system doesnt allow me? anyone know anything?

  • Mandy

    I found that it was called oab.exe.

    Could only get regedit to run in safe mode, deleted reg keys with oab rather than kdn.exe, continually had to kill the process oab.exe. Once I deleted oab.exe from user profile I was able to get Malwarebytes to run and it got rid of the rest of it.

  • mike

    now also known as wkx.exe

  • Ryan

    This was on my pc as XNC.exe, coming from one of the top ranking TV sites in Google!

    Thanks for identifying what I needed to look for.

  • Tony Powell

    Just a quick line to let ye know. The program hid its self on my Win7 Ultimate PC as odo.exe instead of ppn.exe I hope this helps someone

    • bill

      Not finding any of the exe files mentioned what is description of process?

  • Kent

    you can still run the task manager but you have to ctrl-alt-delete to get to it. It wont run from the taskbar.

  • Kenny

    WILL run in Safe-Mode. will not allow web browsing, task manager, or regedit. you can still install Avast and do a manual scan, however, Win 7 will still pop up notifications while Avast is scanning