FacebookTwitterLinkedIn

iON Internet Security from cloud

Also Known As: iON Internet Security Rogue
Damage level: High

What is iON Internet Security?

iON Internet Security from cloud is a rogue security program which reports non-existent security infections in an attempt to scare PC users into purchasing a 'full version'. This software is created by cyber criminals who make money from unsuspecting computer users who fall for the trickery displayed by this bogus software.

PC users should be aware that none of the security infections identified by iON Internet Security from cloud exist on their systems.

Fake security scans and 'detection' of multiple high-risk malware infections are just a part of the scam. Adding to the danger, this fake security scanner modifies the registry of the infected operating system and configures the scanner to start automatically on each system start-up.

iON Internet Security - fake antivirus screenshot

Like most rogue antivirus and anti-spyware programs, this malicious software generates fake security warning pop-ups and blocks the Task Manager. Furthermore, iON Internet Security hijacks the Internet browser and encourages the user of the infected computer to purchase the 'full version', which supposedly removes the identified viruses and Trojans.

Note that paying for the full version is equivalent to sending your money (along with your credit card information) to cyber criminals. This program (screenshot below) is a scam - do not trust any information generated by it. The correct way to treat this bogus software is to remove it from your system.

iON Internet Security from cloud is a fake antivirus program. This software has no features enabling it to perform computer security scans or to detect any genuine security infections.

It is an empty software shell, which generates a bogus list of supposedly-detected security infection (in fact, this program generates an identical list of security threats on all computers infiltrated).

Commonly, iON Internet Security from cloud infiltrates operating systems using various exploit kits, which are able to detect security vulnerabilities and infect the computer with the malicious program. If you observe this program scanning your PC for security threats, you are dealing with fake antivirus software. Use the removal instructions provided to eliminate this scam.

A fake security warning message generated by iON Internet Security:

Warning! Your computer is at risk of data loss due to malware.

Warning! Your computer is infected! Highly possible that you may lose all the data. Your personal data can get to third parties and all your files can be removed during the day and you can have other problems.

Warning! 10 malware found. Highly possible that you may lose all the data. These malware programs cause:
All your files can be removed during day
Your personal data can be sent to third parties
System crash
Loss of Internet connection
And other problems

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

iON Internet Security from cloud removal:

If you cannot download or run the spyware remover, try running the registry fix (link below). It enables execution of programs. Download the registryfix.reg file, double click it, click YES, and then OK.

Manual iON Internet Security from cloud removal instructions:

Step 1
Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Step 2

Now remove the proxy settings. This fake antivirus program adds a proxy to your Internet connection settings in order to display various 'errors' when you attempt to access Internet. To remove it, open Internet Explorer, click Tools and select Internet Options. Then select the "Connections" tab.

internet-explorer-options internet explorer internet connections

 

In the "Connections" tab, click LAN settings, if 'Use a proxy server for your LAN' is checked, uncheck it and press OK.

internet options lan settings internet explorer proxy settings

 

Step 3
Download HijackThis and save it to your desktop. Some malicious programs are able to block HijackThis, so when you click the download link, in the Save dialog, rename HijackThis.exe to iexplore.exe and only then click the Save button. After saving the file to your desktop, double click it.

In the main HijackThis window click the “Do a system scan only” button. Select the following entry (place a tick at the left of the entry):

O4 - HKCU\..\Run: [SysInit] %AppData%\Microsoft\Protect\SysInit.exe

After selecting required entries, click "Fix Checked" and these entries will be removed. After this procedure, close HijackThis and proceed to the next removal step.

Step 4
Download legitimate anti-spyware software to fully remove iON Internet Security from cloud from your computer.

Step 5
After removing iON Internet Security from cloud, you will need to reset your Hosts file. Don't skip this step, this malware modifies your Hosts files, and you will encounter browser redirect problems if malicious entries will not be removed from hosts file.

The Hosts file is used to resolve canonical names of websites to IP addresses. When it is changed, the user may be redirected to malicious sites, despite seeing legitimate URLs in address bar. It is difficult to determine sites are genuine when the Hosts file is modified.

To fix this, please download the Microsoft Fix It tool, that restores your Hosts file to the Windows default. Run this tool when downloaded and follow the on-screen instructions. Download link below:

Finish
After completing these steps, your computer should be clean.

Summary:

The fake antivirus programs (also known as "rogue antivirus programs" or "scareware") are applications that tries to lure computer users into paying for their non-existent full versions to remove the supposedly detected security infections (although the computer is actually clean). These bogus programs are created by cyber criminals who design them to look as legitimate antivirus software. Most commonly rogue antivirus programs infiltrate user's computer using poop-up windows or alerts which appear when users surf the Internet. These deceptive messages trick users into downloading a rogue antivirus program on their computers. Other known tactics used to spread scareware include exploit kits, infected email messages, online ad networks, drive-by downloads, or even direct calls to user's offering free support.

A computer that is infected with a fake antivirus program might also have other malware installed on it as rogue antivirus programs often are bundled with Trojans and exploit kits. Noteworthy that additional malware that infiltrates user's operating system remains on victim's computer regardless of whether a payment for a non-existent full version of a fake antivirus program is made. Here are some examples of fake security warning messages that are used in fake antivirus distribution:

Fake pop-up used in rogue antivirus distribution example 1

Fake pop-up used in rogue antivirus distribution example 2

Computer users who are dealing with a rogue security software shouldn't buy it's full version. By paying for a license key of a fake antivirus program users would send their money and banking information to cyber criminals. Users who have already entered their credit card number (or other sensitive information) when asked by such bogus software should inform their credit card company that they have been tricked into buying a rogue security software. Screenshot of a web page used to lure computer users into paying for a non-existent full version of ion internet security rogue and other rogue antivirus programs:

example of a webpage used to collect payments for fake antivirus programs

To protect your computer from ion internet security rogue and other rogue antivirus programs users should:

  • Keep their operating system and all of the installed programs up-to-date.
  • Use legitimate antivirus and anti-spyware programs.
  • Use caution when clicking on links in social networking websites and email messages.
  • Don't trust online pop-up messages which state that your computer is infected and offers you to download security software.

Symptoms indicating that your operating system is infected with a fake antivirus program:

  • Intrusive security warning pop-up messages.
  • Alerts asking to upgrade to a paid version of a program to remove the supposedly detected malware.
  • Slow computer performance.
  • Disabled Windows updates.
  • Blocked Task Manager.
  • Blocked Internet browsers or inability to visit legitimate antivirus vendor websites.

If you have additional information on ion internet security rogue or it's removal please share your knowledge in the comments section below.

▼ Show Discussion

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
iON Internet Security Rogue QR code
Scan this QR code to have an easy access removal guide of iON Internet Security Rogue on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

▼ REMOVE IT NOW
Download Combo Cleaner

Platform: Windows

Editors' Rating for Combo Cleaner:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.