How to remove Security Tool virus from a computer?

How to remove Security Tool virus from a computer?

Rogue programs

Security Tool is a widely spread fake anti-virus application that was first noticed on September 2009. We receive many e-mails from people asking "How do I remove Security Tool?" or "Help with removing Security Tool!". This virus is usually promoted via fake online scanners, fake video websites, using social engineering or other misleading methods. Once installed, it simulates a system scan and states that your computer is infected with malware. That's of course a big lie, because Security Tool is an infection itself and can't properly detect any other infections. Remove this bogus software from your PC as soon as possible. Please read removal instructions below. And remember, DO NOT buy this software. If you have already done that, contact your bank/credit card company immediately and dispute the charges.



The biggest problems about this malware are:

• It blocks anti-malware and anti-virus software
• Security Tool process name is randomly generated (different on each infected PC)
• Disables Windows OS system tools: Task Manager, Registry Editor and etc.

Here are some of the fake Security Tool malware pop-ups:

Security Tool Warning
Security Tool has detected harmful software in your system.
We strongly recommended you to register Security Tool to
remove these threats immediately.

Security Tool Warning
Your PC is still infected with dangerous viruses. Active
antivirus protection to prevent data loss and avoid the theft
of your credit card details.
Click here to activate protection.

Quick removal recommendations: first of all, try to boot your PC is Safe Mode with Networking and run a system scan with an anti-malware applicaton. If you can't do that, then you will have to end Security Tool process before doing enything else. Please follow Security Tool removal instructions below.

SecurityTool files:

• C:\Documents and Settings\[User Name]\Local Settings\Application Data\[SET OF RANDOM NUMBERS].exe  
• For example:
• C:\Documents and Settings\Steve\Local Settings\Application Data\24025916.exe (for Windows XP users)
• C:\User\Steve\Local Settings\Application Data\24025916.exe (for Windows Vista & Windows 7 users)
• %UserProfile%\Desktop\Security Tool.lnk 
• %UserProfile%\Start Menu\Programs\Security Tool.lnk 

SecurityTool registry values:

• HKEY_CURRENT_USER\Software\Security Tool
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "24025916" 

---

Step by step Security Tool removal instructions:

Method #1 
1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button. If you can't open iexplore.exe file then download explorer.scr and run it.

2. Look for similar line in the scan results:
O4 – HKLM\..\Run: [24025916] C:\Documents and Settings\All Users\Application Data\24025916\24025916.exe 

The process name will be different in your case [SET OF RANDOM NUMBERS].exe, located in:
C:\Documents and Settings\[User Name]\Local Settings\Application Data\ for Windows XP
C:\Users\[User Name]\AppData\Local\Application Data\ for Windows Vista & 7
Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

OR you may download Process Explorer and end Antivirus Action process:

• [SET OF RANDOM NUMBERS].exe, i.e. 24025916.exe

3. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware 
• SUPERAntispyware 
• Spybot S&D 

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
------------


Method #2 
1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm



NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware 
• SUPERAntispyware 
• Spybot S&D 

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

---

Bootable Rescue Disk 
If your PC doesn't start up or you see just a black/blue screen and can't do anything, a bootable rescue disk may be your last chance before doing a clean installation of Windows.  

---

Useful suggestions from other people: 
"I got rid of it within a few hours by restarting my computer and while it was reloading i quickly jumped into the task manager and stopped the process by clicking on the number."

"Start up PC in safe mode, hit F8 when pc starts up, then do a system restore"

"Go to C:\Documents and Settings\All Users\Application Data
Then click Tools at the top of the page, select Folder Options, go to View and scroll down and click Show Hidden files.
Now look for a random 8 digit number. Rename the file and the 8 digit number to anything, then restart your computer and tehn go to that file and simply delete it."

---

More information about how to get rid of Security Tool virus:
http://answers.yahoo.com/question/index?qid=20091230193816AAeaWyN
http://answers.yahoo.com/question/index?qid=20091213183432AAGvM5j

Security Tool removal video:

Ditulis soni agus Pada 09.25 Komentar

InSysSecure malware. What is it and how to remove this virus?

InSysSecure malware. What is it and how to remove this virus?

Rogue programs

InSysSecure is a rogue anti-spyware application that should be avoided and removed from a computer upon detection. This fake program doesn't have an English language version. Likely, it will be distributed in Europe: France, Germany and Italy. The homepage of this virus is insyssecure .com (don't visit it). InSysSecure has to be manually installed either form its homepage or via fake online scanners and other bogus websites. Notionally it may come bundled with other malicious software too.



Basically, InSysSecure is a Trojan virus that displays fake GUI and reports false scan results. In order to remove supposedly found infections you have to buy this fake software. The rogue program also displays fake security alerts stating that your computer is infected and should be cleaned immediately. Some of the fake infections read:

"Spzprogramm Warnzeichen! Ihr Computer ist mit Spionprogramm infektioniert. Das kann Ihren Dateien und die im Internet zugänglich machen. Klicken bitte hier, um Ihre Kopie von InSysSecure zu registrieren und Ihr PC von Spyprogramm frei zu machen."

InSysSecure is a scam, don't buy it. The removal of this virus shouldn't be very complicated. However, note that it may come together with other Trojans, so the manual removal guide stated below may not work for all users. In such cases, download an anti-spyware application, update it and run a full system scan. 

Anti-Malware applications:

• SUPERAntispyware
• Malwarebytes Anti-Malware
• Spyware Doctor
• Microsoft Security Essentials
• Spybot - Search & Destroy

If you can't download any of the above programs, try to remove InSysSecure manually. Manual removal instructions:

Remove these directories:

• C:\Program Files\InSysSecure Software 
• C:\Documents and Settings\All Users\Start Menu\Programs\InSysSecure 

InSysSecure files:

• InSysSecure.exe
• main_config.xml
• uninstall.exe
• [RANDOM].exe in C:\WINDOWS\system32\ folder
• 29495zy1d5.exe
• 1 InSysSecure.lnk
• 2 Homepage.lnk
• 3 Uninstall.lnk
• 103215zoj198.dll
• 10543v5zus929.bin

Registry values:

• HKEY_LOCAL_MACHINE\SOFTWARE\InSysSecure 
• HKEY_CURRENT_USER\Software\InSysSecure
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InSysSecure
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM].exe"
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "InSysSecure"
   

Ditulis soni agus Pada 06.54 Komentar

How do I get rid of Guard Pro virus? (Removal guide)

How do I get rid of Guard Pro virus? (Removal guide)

Rogue programs

Guard Pro is a rogue anti-virus program, fake antivirus scanner that is promoted through the use of Trojans, bogus websites and various malicious software. It's a typical scareware that scares users into thinking that their computers are infected when in reality the only real infection is Guard Pro itself. Most of the time, this misleading application comes from fake websites, but it may be also manually installed from its homepage which is winguard-pro .com. Of course, you shouldn't visit this site. The graphical user interface of GuardPro is provided in the image below:



Once installed, the rogue program runs a smart system scan and detects only one infection called TrustWarrior (it's a rogue application too by the way). This infection is supposedly removed by the rogue program and then Guard Pro won't detect any infections or computer security threats during next scans. As a matter of fact, Guard Pro is detected as Trojan.Qhosts (Trojan.Qhosts is a Trojan Horse that will modify the TCP/IP settings to point to a different DNS server [Information from Symantec]). This virus will attempt to create a file called "host_new" in C:\Windows\System32\drivers\etc\ folder.



Now, how to remove Guard Pro? The easiest way is using a legitimate anti-malware application such as SUPERAntispyware or MalwareBytes Anti-malware. Don't forger to update these programs before scanning. Manual removal is also available, but obviously it's more complicated. In some cases GuardPro may block anti-malware/virus programs, so you have to end its process: VH339.exe for example. The full list of files to remove:

Folders:

• C:\Documents and Settings\All Users\Application Data\[RANDOM], for example 117fc
• %UserProfile%\Application Data\Guard Pro
• C:\Documents and Settings\All Users\Application Data\VHMELHOOOK

Files:

• VH339.exe
• VHOOK.ico
• VHJJOOK.cfg
• cookies.sqlite
• mozcrt19.dll
• sqlite3.dll
• Guard Pro.lnk

Registry values:

• HKEY_CURRENT_USER\Software\3
• HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
• HKEY_CLASSES_ROOT\trial_ca8cf.DocHostUIHandler
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Guard Pro"

Ditulis soni agus Pada 10.28 Komentar

How to remove No Malware (uninstall guide)

How to remove No Malware (uninstall guide)

Rogue programs

No Malware is a fake (rogue) anti-spyware application. This one is from the CoreGuard Antivirus 2009 family and should be removed from a computer as soon as possible. The fake program is being advertised as a free anti-malware scanner, but in reality if you want to run a full system scan you will have to pay 9$ which later turns out to be even more: $69.99 for 3 months subscription or $79.50 for one year subscription. Also, don't surprise if No Malware will display many fake security alerts or various misleading pop-ups stating that your computer is infected with malware. That's a lie. Don't purchase this bogus software and get rid of No Malware virus manually or with an anti-spyware application.


Updated: NoMalware virus uses MalwareBytes Anti-malware database. How rude!
There are at least two domains used to distribute this malware:

nomalwares.org (88.214.204.221)
malwaremechanic.com (72.9.100.115)

Ditulis soni agus Pada 12.11 Komentar