"Security Tool" virus

[mikeywikey]

I am sure I have a virus called Security Tool on my main PC. I am writing this from my laptop. My system tray is there with all the usual icons, but my desktop is blue ... not the 'blue screen of death'! I am being invited to activate this Security Tool by subscribing to it at quite a high cost. I am not able to do anything else on the computer i.e. delete this programme. It will just let me do nothing except keep reminding me if I wish to continue 'unprotected'. I cannot run AVG9 or malware antimalware. I can click on Start but I cannot run AVG from there. If I click on Help and Support from the start menu then that lets me do nothing either. All I get is pop ups telling me I have infections and need to subscribe to remove them. Help!

I should further add that when this virus arrived (I was on MSN) that I was able to continue to do things on my PC except I had then these pop ups telling me to activate. Foolishly I rebooted my PC and thats where the major problems started. Even trying to run in safe mode didn't work.

[Jelly Bean]

Step 1

 

Download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.
  

Step 2

 

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
  
• Double-click on Download_mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
    

  [*]Then click Finish.

  [*]MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

  [*]On the Scanner tab:

  • Make sure the "Perform Full Scan" option is selected.
    
  • Then click on the Scan button.
    

  [*]If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.

  [*]The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.

  [*]When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".

  [*]Click OK to close the message box and continue with the removal process.

  [*]Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.

  [*]Make sure that everything is checked, and click Remove Selected.

  [*]When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)

  [*]The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

  [*]Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

 

 

 

Step 3

• Download OTL to your desktop.
  if you have problems, try this download link:
  OTL
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check
  

.

 

.

 

http://img.photobucket.com/albums/v708/starbuck50/new/newOtl2.png

• Now copy the lines in the codebox below.
  Code:
  netsvcs
  msconfig
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  /md5stop
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  CREATERESTOREPOINT
  
• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
  .
  
• Click the Run Scan button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runscan.png
  
• Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.
  

In your next reply, please submit:

MBAM scan report

Both reports from OTL

 

 

Thanks.

[Tootech]

Sometimes this malware prevents Malwarebytes running - if that happens follow this guide

 

Remove Security Tool and SecurityTool (Uninstall Guide)

[PseFrank]

I am sure I have a virus called Security Tool

 

I don't want to interfere with any of the instructions already given, but I had to remove this nasty from a computer earlier on this evening. I Was able to start the computer in question in Safe Mode, so this may not be of use to everyone.

 

This is what I done: Windows XP

 

1. Reboot to Safe Mode.

 

2. Go........Start > My Computer > (c:)\Documents and Settings\All Users\Application Data

 

Note: If you cannot see the Application Data folder do this....

 

Click Start > My Computer. Under the Tools tab select Folder Options and then under the View tab check the radio buttonbeside the text "Show hidden files and folders".

 

Click Apply > OK

 

3. In the Application Data folder you should see a folder with a 8 digit number for a name.

(Example.......53705525............This was the actual name of the folder I found. But your's may be

a different number.

 

4. Delete the folder. (There shouldn't be a folder here with a numerical name)

 

You should now be able to reboot normally without any sign of the Security Tool. You can now download (If you don't already have it) Malwarebytes and scan your computer.

 

Don't forget to empty your Recycle Bin.

 

The above actions worked for me.

 

Note: For those using either Vista or Win 7. You should find the offending folder (The one with a number for a name) in the Program Data folder.

 

I've read that another way that someone got over this problem was to go ahead as if you are going to purchase the Security Tool software....But!!! Give completely false name, address, and card details. The writer of the post where I read this said that the Security Tool disappeared from their screen after having a couple of go's using this method. I've not tried this so I cannot personally vouch for doing this.

[mikeywikey]

Unfortunately, I could not get this to work for me, so had to reformat the hard drive :(

[Tootech]

Thats a shame - I guess there must have been more wrong than a Security Tool infection.