I just got finished cleaning a machine with this infection so I figured I would share. Let me start off by saying that Microsoft does not and will never call its software by the slang Terms. Meaning Microsoft will never call it Win7 or Win8 or Vista or anything like that. So right there is a dead give away that this is fake. It is always proper terms from the company as they will always call it Windows 7, Windows Vista and so on.
Now onto the removal process.
First thing you need to do is use a 2nd PC to download the latest copy of MalwareBytes Antimalware and ComboFix. Transfer them onto a USB Thumb Drive for use with the infected machine.
Next thing you need to do is go into Safe Mode. Not Safe Mode with Networking. Just Safe Mode! From there on the Main Screen of Win Home Security enter this code into the Activation area:
1147-175591-6550
It is the only serial that works. This will cause the program to say it is activated. Since previously this infection prevented you from doing anything it thinking that it is activated now allows you to run programs.
Run Combofix from Safe Mode. The install MBAM and run that. Then update your Anti-Virus protection. Between these 3 scans you should be clean. But to verify make sure that you do not have anything that says Win7 Home Security on your system as well as cleaning our your C:\Users\<username>\AppData\Local\temp folder and all other temp folders. Make sure that you use Task Manager or Process Explorer to verify that no processes that have only a 3 character name are running. This is the infection.
Reboot, run scans in normal mode for extra care if you wish and enjoy a clean system.
Now onto the removal process.
First thing you need to do is use a 2nd PC to download the latest copy of MalwareBytes Antimalware and ComboFix. Transfer them onto a USB Thumb Drive for use with the infected machine.
Next thing you need to do is go into Safe Mode. Not Safe Mode with Networking. Just Safe Mode! From there on the Main Screen of Win Home Security enter this code into the Activation area:
1147-175591-6550
It is the only serial that works. This will cause the program to say it is activated. Since previously this infection prevented you from doing anything it thinking that it is activated now allows you to run programs.
Run Combofix from Safe Mode. The install MBAM and run that. Then update your Anti-Virus protection. Between these 3 scans you should be clean. But to verify make sure that you do not have anything that says Win7 Home Security on your system as well as cleaning our your C:\Users\<username>\AppData\Local\temp folder and all other temp folders. Make sure that you use Task Manager or Process Explorer to verify that no processes that have only a 3 character name are running. This is the infection.
Reboot, run scans in normal mode for extra care if you wish and enjoy a clean system.