Security Tool is a fake spyware remover with an impressively generic name even in terms of rogue anti-spyware names. This parasite enters the system without the user’s knowledge or consent, usually by employing the use of various trojans. Security Tool might also convince you into downloading it by using the browser hijacker Sitesecuritytest.com, which is a fake online scan. Security Tool uses misleading advertising to trick users into purchasing it’s so-called “licensed version”.
Once inside and active, Security Tool floods the user with popups and fake system notifications, claiming his system is infected and in need of an anti-spyware program. All of these popups lead to the purchase page of Security Tool. Much like any other rogue, Security Tool will also perform fake system scans, which mark legitimate files as threats. To remove these “threats” you supposedly have to purchase the full version of Security Tool, which is just as fake as the trial.
Typically, the popups inform about various dangerous spyware, for example :
Security Tool Warning
Spyware.IEMonster activity detected. This is spyware that attempts to steal passwords from Internet Explorer, Mozilla Firefox, Outlook and other programs.
Click here to remove it immediately with SecurityTool.
Or
Security Tool Warning
Some critical system files of your computer were modified by malicious program. It may cause system instability and data loss.
Click here to block unauthorised modification by removing threats (Recommended).
Sure, these threats do not exist on your PC, as Security tools scanner is not functional and just a decoy.
Popups aside, Security Tool will also significantly decrease system performance and block certain websites, as well as prevent some applications from running. It is a scam and should be treated as such: do NOT download or buy it and remove Security Tool immediatelly upon detection.
Security Tool Removal instructions:
Getting rid of Security tool might be a complex task, as you need to disable its protection against antivirus software. At the moment Security tool allows users to launch processes similar to browser ones, as it needs user to visit its website. We suggest renaming/copying removers as iexplorer.exe or firefox.exe, which should pass through security tools mechanism. Here how to get rid of Security tool:
1. Disable security tool
a) By rebooting into safe mode with networking (press F8 just after reboot)
b) by pressing ctrl+shift+esc right after logging in into windows. go under processes tab, stop all numerical processes.
2. Delete security tool files (see under files in our guide)
a) by investigating where security tool shorcut points to (it will be on desktop)
b) by searching for filename with same name as processes stopped, if you went for 1.b
3. Reboot, do followup scan with free spyhunter scanner. This will detect any additional problems or files you might have missed.
Alternately, you might want to try one of registration codes for Security Tool to disable it, for example 64C665BE-4DE7-423B-A6B6-BC0172B25DF2 this one. These keys were discovered disassembling security tool and analyzing its gateways by malware researchers at infisecure.com . This will disable various popups and likely to allow running various antimalware tools like spyhunter or malwarebytes to remove the remaining trojans and traces for the system. Full version of spyhunter, malwarebytes or decent internet security suite would reduce risk of Security Tool and similar infections considerably.
Another method to remove Security Tool virus is following:
1. Reboot into safe mode.
2. Launch MSCONFIG and clear ALL startup entries. Do not close window.
3. Search MSConfig entries that reference randomly named folders in C:\Program Files or C:\Program Files (x86), for exampe C:\Program Files\sdgsdgsgsdghs . Delete WHOLE folder
4. Go to your users Application Data folder and delete all executables named by numbers, 2352352.exe or similar. Right-clicking on Security Tool’s icon will show exact place where they are located.
5. Delete all the DLLS listed bellow
6. Reboot Into Safe mode with networking
7. Download spyhunter ( https://www.2-viruses.com/spdoc.exe if pctools are blocked). Do a full system scan. You can scan with other tools like Malwarebytes Anti-Malware, hitman pro. Delete what they find.
8. You can reenable remaining msconfig startup entries
9. Reboot, do followup scans
There are couple other parasites that replace Security Tool and cause havoc in the end of 2010: System Tool and System Tool 2011. They are a bit more aggressive, and their removal differs somewhat.
Automatic Malware removal tools
(Win)
Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,
(Mac)
Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,
forget all that… try this move, it worked for me after going nuts over this for a whole day.
Reboot in safe mode
browse to C:\Documents and settings\all users\ application data
There will be a folder in there that has eight numbers as a name (ex 91908431)
Delete this bad boy, empty recycle bin
Reboot normally, delete all left over shortcuts, empty recycle bin again and you are home free.
@Philly Keith
Keith you are right on…worked just like you said. THANKS A BUNCH
Reboot in safe mode I GUARANTEE YOU THIS WORKS
browse to C:\Documents and settings\all users\ application data
There will be a folder in there that has eight numbers as a name (ex 91908431)
Delete this bad boy, empty recycle bin
Reboot normally, delete all left over shortcuts, empty recycle bin again I GUARANTEE YOU THIS WORKS
I did these simple steps and they worked great. I finally got this crap off my computer. These companies need to be shut down and the people need to be gone after. This is outrageous. Anyways, here you guys go.
1. Click Start, right-click My Computer, and then click Properties.
2. In the System Properties dialog box, click the System Restore tab.
3. Click to select the Turn off System Restore check box. Or, click to select the Turn off System Restore on all drives check box.
4. Click OK.
5. When you receive the following message, click Yes to confirm that you want to turn off System Restore.
Now Restart your Computer in Safe Mode with Networking How Do You Restart in Safe Mode with Networking? Right when your computer is booting, press and hold your “F8 Key” which should bring up the “Windows Advanced Options Menu”. Use your arrow keys to move to Safe Mode with Networking and press your Enter key. Then Download Update and Scan Useing Norman Malware Cleaner
After you Finish Remove Security Tool, Restart You Computer To Be Normal. Once you discover it’s normal, Turn On System Restore.
Here are the steps to turn it back on
1. Click Start, right-click My Computer, and then click Properties.
2. In the System Properties dialog box, click the System Restore tab.
3. Click to clear the Turn off System Restore check box. Or, click the Turn off System Restore on all drives check box.
4. Click OK.
After a few moments, the System Properties dialog box closes.
Restart you Computer to be Normal.
So far this page is the best I’ve found regaurding killing this horrid monster of a virus.
Just a couple notes:
1) safe mode worked best for me
2) Delete your MSN/Windows Live Messenger and re-install. Even after I got the virus off my MSN kept sending the link to people.
3) set your computer to save a restore point EVERY DAY, this way you can just back it up a day if you get infected in the future
@Philly Keith
Philly,
THANK YOU THANK YOU THANK YOU. I have been at it all day trying to remove Security Tool Warning. Spy Doctor is no good, Malabyte would not run properly (probably because of the rogue app) and was at the end of my rope!!
Your instructions were easy and quick and WORK BABY!!!!!!!!!!!!!!!!!!
When you say to browse the C drive, you can also use the RUN feature in the start up menu and type in C:\Documents and Settings\all users\application data then delete the folder that has eight numbers (ex-92108456) for it’s file name. It could be any eight number combination. I had three files with eight number file names but all that you need to do is click on them until you find that dastardly shield logo then delete, emty recycle bin and make sure all shortcuts are removed.
THANKS AGAIN
I forgot one important piece of info for anyone who reads my forwarding of Philly’s advice. Reboot in SAFE MODE to do this then follow his instructions.
what am i doing wrong i did everything even all the help from on this site can anyone help please me and my girl are fighting over this cause we cant get any work done withot pop ups.HELP…………
this thing has disabled my ability to start in safe mode, what can i do?
ok.
I got given this machine this morning to fix. (wxpp-sp3)
Found this page, and a page on blepincomputer most helpful.
I think there are at least two variants of this bug.
The version I had would not allow ‘anything’ to run in ‘normal’ mode.
Even stopped the three fingered salute from working.
Rebooted machine into safe mode (f8 on boot)
Loaded malwarebytes. Ran full scan found 5 items.
Removed.
Rebooted
Seems clear at the moment. – run full avg scan – so far so good.
Use procexp.exe to check bug no longer running.
Use hijackthis to check again and clean up system.
On this machine, I will install firefox and make it the default browser, then
remove msie from the desktop.
I had the advantage of my own desktop machine to find info and load programs
from to a usb stick, to load onto infected machine.
Good luck folks – the peeps that make programs like this should be shot…….
Yous..
Hey, i was hack by this security tool virus scam, i just wonder if i reformat my computer, would this help??? or it will only get the situation worse…
please help me. i have many important information on that computer
Philly Keith,
Your method works well. My computer starts to behave. Thank you!
But it seems there is still residual issue. Soon after reboot, a program named
_ex-08.exe appears in Window Task Manager, which takes over the processor, 99% CPU usage. Is it the leftover of Security Tool virus? Anybody has idea on how to get rid of it for good?
I cannot find app data or program data in my C drive!!! Can someobody please help me??????
Nothing is working for me. I tried to do system restore, it would not open. Tried to download and even run through USB, other virus scanners – spy docter etc, cant run them at all. I get an error by security tool, saying they are infected.
I cannot boot in safe mode. When i try to do that it goes to blue screen “your compute is infected…please restart”. Anyone any ideas please?
On vista, it is C:\Users\%Username\App Data. On XP, it is C:\Documents and settings\%username\App Data
AJ : Save downloaded files as iexplorer.exe or firefox.exe.
I tried that, saved them as iexplorer.exe and firefox.exe. But when i try to open them i get the popup – “iexplorer.exe is infected with Lsas.Blogger…” same thing for the firefox.exe too.
Only success i had was, the “grant access” message appeared once when i tried to run those files. I granted access and back to the error and i got nowhere. What to do now?
@admin
AJ : have you access to task manager or regedit ?
If you have access to regedit (and not task manager), you can reenable it by using registry. Just search for key containing TASK.
Also, see if you can run process explorer http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx . It might be allowed to run.
You need to stop Security tool tasks prior launching remover.
the same problem with security tool help to remove it please
I have tried everything and this Security Tool is a nightmare. I have windows Vista and I am unable to do anything. If anyone is familiar with windows Vista, can you please give me step by step instructions.
@Philly Keith
I have vista, and I can not it.
I got this crap from Youtube. I followed some of your instructions and I believe I have removed it.
Before doing anything else, disable your internet and/or wireless connection so this spyware doesn’t do anything else weird, then shut down. If you can go into safe mode, do so as soon as your system starts up (press and hold F8 as soon as your computer powers up).
Click safe mode when the DOS prompt comes up
Once Windows loads (not sure if this affects Apple OS Users) (it will probably say Safe Mode in each of the corners of your screen and maybe some technical gibberish at the top. You will want to go in as Administrator if the user prompt shows up) go into My Computer, select Local Disk or C Drive, then Documents and Settings, then All Users, then Application Data. Make sure that youu are able to see hidden files (go to tools, then Folder options, then click the View Tab on the pop up and check the circle next to show hidden files and folders) otherwise you won’t find it, then under Application Data you’ll see the weird folder with the eight digit number you need to delete. YOu might have more than one, so delete all of those that apply. Then, use your search tool under your Start button on the Taskbar and search for “Security Tool” in the search box. Be sure to search in hidden files and folders! This should get this crap out. For anyone unable to go into safe mode, or if your system is really fried, I would recommend going to a PC Repair shop as this is something that most off-the-shelf software can’t delete (this spyware prevents software from being installed from a disk, believe me, I tried previously)
Best of luck to everyone here. I’m going to have some choice words with both YouTube and GOogle now…
Will someone please help me remove this before I blow my brains out
ANGEL, THANK YOU VERY MUCH. IN SAFE MODE WE HAD TO RIGHT CLICK ON THE DESKTOP ICON FOR SECURITY, HIT PROPERTIES, COMES UP WITH TARGET LOCATION, CLICK ON FIND TARGET, CLICK ON THE FILE WITH THE 8 DIGIT NUMERICAL NAME. THE 8 DIGIT NUMERICAL NAME IS NOT NECESSARILY THE SAME FROM ONE COMPUTER TO ANOTHER. EMPTY RECYCLE BIN AS STATED & RESTART.
When you install it, it should be under your all programs tab, Right click security tools go to properties and find out where it is located. Once you have done that, restart/relog. Open the task manager (Ctrl+Alt+delete) before programs start up. This should override it, leave the task manager up. Go to the folder it is contained in and delete it. It worked for me.
Add me to the list. I am going crazy with this thing. This is my second full day of trying everything. My biggest problem is that I cannot start in safe mode. I get a blue screen and it reboots.
Cannot get Malwarebytes to run either.
Any help would be greatly appreciated.
@Philly Keith
Thank you so much!! it saved me lots of time and stress! you saved the day!
I used malwarebytes anti malware and it perfectly worked. Used those program on safe mode.
Cannot even boot in safe mode. Computer just restarts! Help
@cer You could try F8 then Last Known Good. See if that lets you restart into safe mode. It may take more than once.
HELP HELP……………who invented this virus…I’m having major issues…
trying to delete file but won’t let me.
This crap was on my computer when I went back to it after been away. It is shit and is giving me the shits to go with it. I can not even check my e-mails.
It is nice and maybe helpful for some people to details all the problems they are having with this crappy shit.
I had them also myself but thanks to a friend of mine he got me out in minutes.
By the way they must change their numbers every day!
These people after all are all bandits and they are the ones that creates all these viruses so they can sell their crap.
They should be all ban.
What I suggest is this.
Why someone that is involved into a group or company does not start
a major petition to ban all these companies.
Without them we would not have any problems.
I am too old to do that myself and living way out in the country alone.
I think Google should do the something about it
André
for those who can not boot in safe mode, boot from a dos diskette, use this program NTFS4DOS.EXE to get access to your ntfs drive c: then delete all of the sh.. in application data folder
use another computer to download bootable diskette image and NTFS4DOS.EXE from the net. google them first.
thanks for everyones help here. it might be working…
heres where I am at:
I can’t start in safe mode. never had that happen before.
task manager has been disabled.
regedit has been disabeled
folder option is not available to make system/hidden files visible.
I was still able to search the folder option folder out to find 14834828.exe and delete it (we neeed to see those hidden folders!)… I was able to find out the exact name of the file by looking at the properties of the icon that was conveniently displayed on my desktop… otherwise it would have been hard to find.
yesterday I deleted advanced virus remover from program files and a shortcut to it from the startup folder. that program has not reappeared since restarting my machine. a lot of pop ups have disappered since then but it seems like overall the invasion still continues. a number of little things are starting to not work right.
I haven’t restarted yet since deleting security tool so we will see how it goes.
msconfig is still available.
there are some programs in the startup tab that I have turned off a whole bunch of times but they always start with the next reboot so I am not sure how to get rid of them since I can’t access regedit.
I feel like I will probably have to reformat.
thanks for all of the tips everyone and good luck!!!
Thank you for the best info site yet for this abomination! I have tried everything except the manual removal stuff, for which I do not feel competent to try. Tried Spyware Doctor, which at least got rid of the main Security Fool pop-ups, but the puter still seems to be a very sick puppy. I still cannot re-install Malwarebytes, getting the now oh-so-familiar “error codes”. And now I am beset with “the daily heralds” popups, which suspiciously started once the Tool went dormant. I am sure it is still in there somewhere. Most recently, I got a USB memory stick, downloaded Malwarebytes on another computer, ran in safe mode on mine with the stick and actually got the sucker to RUN!!! Did a quick scan which found all kinds of stuff, but could not delete it without a reboot. Rebooted, did the same operation again with the USB, this time running a full scan, found even more stuff, it could not delete again without a reboot. Did this, and started up XP proper. All seemed well – I tried to install Malwarebytes back on the C drive, got almost to the scan, and Security Tool nuked me. Now it won’t even let me access the USB stick. My sense of this is that Malwarebytes can’t get rid of this effing plague, and until they address these new quicks and superpowers of Security Tool, we are all screwed.
Please tell me I am wrong! I have spent hours each day this week on this. I could have bought a new computer with the lost time. What a waste! May these bastards rot in hell.
@fritz
my sysytem too can’t enter safe mode but here is what i did.
immediately after the system finished booting i quickly hitted alt+ctrl+del keys before the malware started this brought up the task manager, then ended a process with about 8 digit numbers mine was “62062066”. Then on the desktop where the shortcut is i right clikd to get the menu and clikd on properties. On the properties popup i copied the address where the program was installed.
i internet explorer then pasted the address there. (mid you you have to delete the last file name with .exe so as not to launch the program again and the preceeding quotation mark) you see the folder then delete all in it.
Hope you get my explanation. I know i suck at explaining but just fuse the pieces together and it should work for you.
my background goes gold and no icons
Started in safe mode then restored to before this piece of crap took over my computer . So far so good . I run XP Home Edition .
I’m in the same boat as ptropp. It will not allow me to boot into safe mode, computer just restarts. I have tried the “last known good configuration” to no avail. It also has changed my permissions for being able to access REGEDIT. I installed Ad-Aware, during the first run it stopped in the middle and now will not start at all. When I CTRL-ALT-DEL at start up I can chase down and end most of the trouble making processes but there is one I can’t shut down, there are 2 csrss.exe’s there and I’m pretty sure thats the culprit. Any advice would be much appreciated. Thanks.
My daughters PC got it and here’s what worked for me from reading in this forum…
Safe mode – ha, would not work
Ctr-Alt-Del right away while booting and stop the 8 number process – worked
Search – comes up but would not start any searches
My computer – hidden files not accessible and would not allow me to change it
Click on security to get properties to find actual address – worked
In Search mode, while search would not work, it did allow me to stumble down the address until I finally got to the folder to be deleted.
Deleted folder, empty recycle bin, reboot and……..
IT WORKED. First reboot only had a few icons including the security one, deleted that and the link in the start menu, emptied the recycle bin, shut all the way down and restarted yet again and looks like most if not all came back including a bunch of desktop icons.
Thanks guys and gals, looks like each of us may have to attack the problem a little differently depending on what this nasty lil bug screws up.
download vipre antivirus software. There is a 30 day free trial. Disable your current AV software.Vipre will pick it up and remove it. EASY PEEZY!
Well add me to the list. Problem is Security Tool, or something, has diabled both the keyboard and mouse, so I can not promt into safe mode or any other F# key. When it boots up there is just the desktop( blue) and their faux spyware program. I cannot do anything except look at it.
Any ideas? Take it out and shoot it? Recycle it? Start over, reinstall XP and lose everything on it?
Add me to this list. Security Tool has taken over mine to the point of disabling both the keyboard and mouse. I cannot promt any F# key or anything else. When I boot up I get a desktop (blue) and the ST’s fake program. All I can do then is manualy turn off the computer.
Any ideas? Reinstall XP and lose everything? Drop the CPU off at the recycling center? Take it out and shoot it?
This is really getting me down now. It’s been going on since Thursday night and quite frankly I’ve wasted nearly the whole weekend trying to remove this from my system because of these fucking geek hackers writing this piece of shit virus.
Must have re-started my PC about a hundred times, both normal and safe mode trying different ways to remove it. Since Thursday I haven’t seen the numerical.exe in the Apps Data folder but I still can’t run Malwarebytes or SpyDoctor or several others I have tried so it’s obviously lurking somewhere in the background like a fucking coward….come out you fucker, I’ll take you on….sorry for the rant it’s not really very helpful, just need to get it off my chest…
I got this one on wednesday, spent nearly every day trying to remove it and though my system is not on 100% (I think only reinstalling everything will get me to that) I finally can work again…I used avira-antivir-live-cd zu do a scan and find the trojan base of this; then I used ubuntu-Boot-CD zu get in Linux, deleted the security-tool-files manually and the trojan-files; then I friend helped me re-writing the Master Boot Record. After hat I could start windows and deleted the security tool-base in the registry. Finally I could run Anti-Malware from Malwarebytes, Kaspersky Removal Tool (from that website), Combofix, Spybot, Ad-aware, AVG 9 and now I’m running Zonealarm and Threatfire additionally…
Oh, btw: For those just deleting the digitnumber-folder: That just stops security tool, but security tool entered your PC by using a trojan. That base of the virus needs to be removed.
Though I still can’t rid of my browser hijacker, that redirects bei google-search and Safe Mode still doesn’t work (maybe some files merged with windows-sysfiles and killing those files killed my safemode); any ideas?
Update – apparent success. Purchased Spyware Doctor, SpyHunter and Security Task Manager. Ran the last first and got rid of some nasty shit. Then SP and SH got rid of more shit. The apparent turning of the tide was downloading AVG 9.0 Free.
This took out even more stuff and made it so I could INSTALL AND RUN MALWAREBYTES!
This took out everything. I have purchased the full Malwarebytes and have it running ALL-THE-TIME. Praise Jee-sus!
I’ve been having these problems w/ Security Tool as well. The ctrl+alt+delete, ending the process #s works to stop it from popping up. However, it has removed all of the icons from my desktop as well as made my wallpaper invisible. Any suggestions on how to get them restored.
Hi all, found this rather helpful. Free Spyware, it seems to have helped me w/ my issues I’ve been experiencing w/ this Security Tool bullshit.
Avira AntiVir Personal
http://www.filehippo.com/download_antivir/
Craig: I would recommend AVAST, if you go with free antivirus. Better detection ratio.
John C. : go with AVAST instead of AVG. AVG has no rootkit protection in free version (as far as I know). And that is a big problem in cases like this.
I’ve had problems with this for a while now. It won’t even let me run explorer.exe…
OK, I have an idea.
It may be there has been a motherboard failure on the computer, that’s why the mouse and keyboard stopped working.
How ’bout I pull the hard drive out (because that’s what’s infected) and put it in another computer, then try to run anti-virus/anti-spyware programs?
I would really like to save the info on this hard drive.
Any comments?
ty Philly Keith! my roommate bought a laptop & against my advice, uses IE instead of Firefox & didnt install spybot or ad-aware & last night this crap shut it down.
Phil D. : It should work. Just scan with antivirus the drive first ( Before copying anything out).
Please help me. I have tried all the suggestions listed in this comment string since Oct. 9th, as well as tips from Spywarefixpro. I am unable to boot in safe mode, unable to access the internet or task manager. I have not lost my keyboard or mouse but you guys are scaring me. I tried downloading an automatic Spyware Remover to a flash drive and run that but nothing happens. I just paid $100 to have someone else clear viruses a few weeks ago from this same computer. I’m trying not to pay again. I’ve been working on this all weekend and the last two nights. Any new suggestions?
K. L. : Have you tried manual instructions ? Do you have access to task manager or process explorer ?
when i have the task manager open , in process what do i do to get rid of or delete the “security tool” program.
I had problem with Security Tool and applied the solution from Philly Keith:
1-Reboot in safe mode.
2-go to C:\Documents and settings\all users\application data.
3-search and delete file with ex 91908431.
4-empty recycle bin.
5-reboot normally.
6-delete all shortcuts.
7-empty recycle bin.
It works. thanks a million.
this system craping system, my desktop disappear…
Thanks admin, that worked for me. Was able to copy all the files I needed off the hard drive and paste on to a diferent one. Maybe I’ll rebuild the old Dell.
I’am using Zone Alarm’s latest anti-virus/anti-spyware and Spybot on this computer.
Phill D. : Throw away spybot 🙂 It is not too good with latest parasites. Do occasional scans with malwarebytes or get superantispyware if you want free tools, but I do not thrust in spybot’s updates.
Philly Keith is right! Their way i s best. Just be sure to goto tools/view/show hidden files , then look for application data in ALL USERS! Delete the 8 digit filename folders and empty recycle bin. ALso remove all shortcuts and links from start up tab.
I have installed Norton which is working ok but somehow in the process ‘Security Tool’ has appeared!!! It is awful & pops up allllll the time!
I have looked up on google to try & find how to delete it but I just can’t seem to delete it! Why isn’t Norton version 3.0 getting rid of it??? Can anyone tell me in very easy steps how to remove Security Tool from my laptop. Thank you.
After my earlier rant (message #88)I think my system is now clean. I tried all the ways suggested including manual removal, some of which was successful although I still couldn’t run Malwarebytes, SuperAntispyware or my AVG anti-virus so the trojan was still there in the background.
What I did was post all my problems on a relevant forum and a Hijackthis specialist (even though at this stage I couldn’t run a scan without it shutting down) gave me step by step instructions to remove. Most of these were unsuccessful so as a last resort used a program called Combofix. It is a very aggressive malware removal tool but it seems to have done the trick. However, I would not use it without instruction and again the analyst will walk you through what to do. I hope this in some way helps because I was as frustrated as some of you clearly are.
@Philly Keith
I tired that 4 times it didnt work
I got security tool in my desktop.IAfter using the internet for a while, the wholee system blacks out. How?
got this crap on my system tonight. And my problem is that as soon as security tool kicks in, my whole desktop goes blank/gray and all of my icons dissapear. I’m gonna try the recommendations others have provided and see if it works.
Success! success! I finally got this shit off of my computer. What I finally did was open the windows task manager, and click on the proccesses tab. And then I highlighted and deleted the 8-digit number that security tool was hidding under (the number in my system was a number that started with a 7, not 9).
Then I was able to follow the steps that Philly Keith suggested (except I wasn’t in safe mode), and restarted it. Now its back to the way it was before. WOO-HOO!
Ok, I’m not sure who suggested it, but when Security Tool was eating the exe for Malwarebytes I made a copy and renamed it F-U-SECURITY-TOOL.exe and the infection didn’t eat it. Then I was able to update it and scan the pc that is infected.
The ‘people’ that are wasting our lives with this garbage seem to be reading this blog. I can’t get to Safe Mode, the fix worms are getting smarter and this is getting more aggrevating. I don’t think that this is only hoaxware but more like a test bed for worse attacks to come. For those that are struggling with this issue, please be patient and keep being resourceful. For those that are reading this stuff to see what holes we’re all finding in their software, please reference the rename of the file as mentioned above.
And to those that get mad when they click on something that ends up costing them money, . IF you don’t get it, google it and check the first link that comes up.
Ok, why is it that ‘tanstaafl’ got removed from my past post?
i have it too but whenever i download the spyware, after presssing run, nothing happens…Stupid person whoever made “Security Tool”.
i was very close and i dleted the random number and relogged it had most of my icons for a moment then security tool took over.
Keith, it will not let me delete the 8 digit folder, how do I delete it? @Philly Keith
i cant get the spy doctor to run because of the secruity tool progam wont allow it
i need help please
I just got the security tool virus and im not sure how to get rid of it can someone help me? I can’t open any apps other than the internet. I’ve read comments that say download spyware manager on another computer and put it on their own but i don’t know how to put programs from other comps onto mine.
how do I delete it, this is completley taking over my pc I want it gone NOW!!!
whenever I click something to delete it, it pops something up and cancels it out
please help me s.o.s
@paulg
If you click the tool bar you should have an option to show the desktop
dosn’t last long.
whoever made this stupid thing must have go the name Tool from someware deep in there conchance. This is the most ignorant thing, I dont feel like waisting all my time to fix some stupid little joke, I dont have the money for this crap.
I Got rid of this Virusus by copying all the stuff to my hard drive(usb) then i deleted evrythin, n i put aall the setting back on, with my stuff. i go out for a night the week after, and its back. i cba to do wat i did again if i know tht it doesn’t work. im really pissed off any ideas for wat i could do!!
i’ve download malware but i dont wanna pay for anything. i downloaded spy-doctor but u have to pay. i’ve tried manual script n it just comes back. AHHHH IM DIEING OF THIS VIRUS HELP!!!!!!!!!!!!!!!!!1
Chucky: You need to disable virus first. Start task manager and stop all numeric-only processes. This should allow spyware doctor to run.
Andrew : we got a new release of spyware doctor, this should fix the problem. Security tool recently mutated.
my task manager is disabled is there anything i can do to get this off without it
Wow… this blankety blank Security Tool virus is almost as bad as the H1N1 Virus! I think I’ve deleted all the suspicious files. Need to reboot to be sure… wish me luck!
Try downloading process explorer from microsoft. Rename it to iexplorer.exe or some random name.
please help !!
when i try to download any programs to delete it they do not appear on my screen (neither does any program there before) and when i click start and run and search it a security tool warning says there is a problem ! does any1 know how to help
I did not order security tool. It just popped up on my computer and ruined my week. After i get off from work, i can’t even read my e-mails because of the constant pop-ups telling me that my computer is infected. I don’t use my computer very except reading e-mail from our church members. I want very badly to get this virus removed from my computer.
This virus has caused my computer to show a dark blue screen on start up saying the system has closed down, there for i can’t get into anything it won’t start up on safe mode either….what am i to do???
Lauren : Try rescue CD, if you got one. If PC does not boot up, it is reinstall time probably.
@kody112
Dear Kody and keith,
Do advise on “left over shortcuts” and oblige
Regards
Dr Amit K Saiya
@blue carbuncle
better yet why is it illegal for people like us to get back at theese kind of people
the virus wont let me open spyware doc, adware se, task manager, add remove programs, nothing.. HELP
Dang! Does anyone have an answer???
This crap makes me want to toss my computer out of the window!
@blue carbuncle I cannot believe this! Another malware on my computer. This one’s not even creative. For the sake of its builder, I hope we never meet.
This security tool keeps popping up saying i have 39 viruses. i just keep press continue unprotected. and it will go away but there is still the small icon at the bottom of the screen that keeps showing up that different files are infected by a worm. and all my icons that are on the regular screen are only there when i first log on and if i want to open something i have to hurry and click on some of them before the security starts its fake scan. then after a little bit of messing around with it. the screen goes to a blue page that has something about problem is caused by: SPCMDCOM.SyS and says a few other things then toward the bottom of the page it has a few groups of numbers kinda like 00×0000340 and that page stays there for about 15 secs then it restarts my computer. any idea on how to get this off here?
Another question before this security tool thing got on my computer i have been having a problem with starting up my computer. when its turned off and i go and turn it on it goes to a blue HP page that has 4 options F9- diagnostics F10-setup F11- system recovery and Esc-boot menu. and that screen only last for about 5 secs if u dont pick one then it goes to a black blank page with an _ at the top like its gonna let me start typing something but i cant do nothing on that page, i always have to hold the power button down to turn it off then turn it back on and when the blue page pops up i have to hit Esc to get to the boot menu and it has >HDD Group 3rd drive:(E.)hitachi hdp*********CD-Rom Group 4th drive:optiarc dvd rw ad-*******< bunch of#s and if i have my external burner on it will show that on there to. but i always pick the 3rd drive (E.) and then it starts up. anyone know how to fix that so it will start up regular again.
The easiest way to rid computer of security tool.Start computer press f8 as it is starting. this lets you start in safe mode. In safe mode using the arrow pad go to networking. Push enter.Only the things needed will start.Then open internet explorer Type in trends micro housecall.Go to this web site and download housecall.Close window and agree to there terms Scan computer It takes about six minutes to scan Then click to remove security tool. Then run a registry cleaner to remove any icons or remnents of this trojen.Its very easy to do. The whole things takes about 20 minutes.And it cost you nothing but a few minutes of your time This works on all Trojens,Adware,or any other nasties out there
To keep the malwares from stopping your anti virus from working,you will first have to remove your anti virus .Then reload it and rename it with a few key strokes of anything you may like to use.Then the virus can’t shut down or disable your anti virus program.It works
If you can’t start in safe mode,try this.Go to a friends computer and download a disc of a anti virus program rename this program..Disconnect your computer from the internet.This will slow security tool down.First try to run a scan with your own anti virus to get rid of security tool.Always run a registry cleaner after removing.If this doesn’t work Put the disc in and download.Now run your scan from the new anti virus program This should remone it Run registry cleaner to get rid of it for good.
Heres how I fixed my computer (I hope its all gone but its working fine now). After reading a few posts here I tried going into Safe Mode but was unable to so before Security Tool could load I hit Ctrl Alt Delete to bring up the task manager. I found the eight diget process and shut it down right when it was loading. I then went to the desktop icon and went to properties and find target location and deleted the file. This allowed me to actually run a full scan on my virus program which came up with an additional 18 infections. My computer seems to be working fine but then again actually being able to use my desktop icons and programs is 1000 times better than a few hours ago.
The security tool was downloaded to my computer. I have Windows Vista, could not get it off at all…tired the regedit (didn’t work)….I had to start in safe mode then do regedit and search for the numbers it gave as the title and delete them and search again about 4 times then load back up in regular mode and now my computer is fine.
I hope this helps someone out there…I was ready to throw my brand new computer out the window (not really but damn)
Thanks for the help from the people here!!!!!!
Took your advice. Immediately after start up Control Alt Delete to end task. End process with an 8 digit number (I located mine by scrolling across the security tool icon on the bottom of the screen 23374928.) Found it in the process menu and end the annonying lil thing. Clicked on startup was able to search the web and downloaded malwarebytes. Ran a full scan and fixed the problems. Reboot and thus far havent had a problem. Hope this helps because believe me I was ready to pull my hair out.
what peace of shit it disturbing i cant use my computer it says many viruses infenct my computer hahahayz
guys how get this off?
@Philly Keith
hi Philly Keith, i’ve tried your advice but can’t find the 8 digit “bad boy” in app data any other advice please as this is driving me nuts thanks
Chrfles, followed your above, downloaded Housecall, removed Security Tool and cleaned my reg. All back to normal now. I would like to see the Security Tool people put before a firing squad!!
Thanks Again,
Cigarguy
Try intalling malware byte in a usb flash drive using a non infected comp. recommended on an 8g drive. Hook it up to the infected comp and run it. Disable the processes before the actual run
@Sunshine
what is regedit
Hi I’m Ashley. I’m a fifteen year old girl. I as of about two hours ago aquired security tool. At first i thought it was legit. I mean I have technology. But unfortuantely I didnt quite understand the danger this program held. It loaded and repeatedly bothered me. But i saw nothing wrong yet as my norton does this because i have not updated it. (and yes i know i need to.) Until my computer manually shut itself down because of viruses. It was not until i turned my computer back on that i had problems. It would let me access anything. Not even my Task manager. I came to the conclusion that it was a virus itself. So i tried to delete. Originally opening its file up and trying to delete it. That failed. Becoming so frusrated I restarted my computer and tried to delete it before security tool could load. Still didn’t work. Finally after third reloading I went ofr reasearch on then net. After waiting for minutes for internet to load i stumbled upon yahoo answres where upon a link and another five minutes it led me here. and after reading other comments teling me to go to safe mode and then deleting it I decided to try for myslef. It worked. I thank you so much. If not for you I probably would have thrown my laptop. Thank you once agin.
keith
used your instructions they worked a treet thanks millions mate
there might be a few folders with eight numbers i had three folders with eight digits i just deleted the lot and im up and running again touch wood
What I did was download Sysinternals Process Explorer. Extract it. Rename the executable file to iexplore.exe Put the files on a USB Flash Drive. Use Process Explorer to kill the processes associated with it. Download and run ComboFix. Download and run Malwarebytes.org Anti-Malware.
If it takes more than four hours and/or three attempts to find and eliminate virus issues, you may be better off wiping the HDD and re-installing the OS and all apps.
I can not find the location with the 8 digits. I am running vista and cannot find the extension application data. any one with any suggestions
I have downloaded spyware doctor and the security tool still appears. i tried everything to delete it from my programmes and it looked like it was gone however when i shut down the computer and logged back on it was still there!
can anyone help?…. any ideas?
Just another note……THANKS TO ALL THE ADVICE, WITHOUT ME SEARCHING THIS OUT, FOR A MOMENT I THOUGHT IT WAS LEGITE BUT THANKS FOR ALL THE ADVICE!!!!!!!
PHILLY KEITH — YOU DA MAN!!!! Used his fix in safe mode within an hour of gettin this crap. So far, so good!
haha… i clicked “system restore” on my hp windows7 then reboot normally..
deleted the remaining icons and emptied the recycle bin…
it worked!!! hope it won’t come back..
thanks all of you guys for the idea! saved me alot of time and money..
this is crap how does it get n to your computer? i have never seen it before. thank you to all the websigts out their to help you.
It cost me $30.00 for a year contract but it worked. Even running much faster. I used the spy-bot, search and destroy–uniblue
How do you get into safe mode to find the 8 digits
I am ready to pull out my hair. I can’t even run my computer in safe mode cause when I do my password doesn’t work. wierd. I can’t run any programs, open any attachments, so on and so forth. I think it’s a shame that people have nothing more to do with their time but to make people miserable and completely unproductive. These people should be found and punished to the highest extent of the law…whatever that may be. UGH!!!~!!
My roommatre accidentally let this program in and it IS an in-your-face irritant. To remove it I rebboted in SAFE MODE, right-clicked on the SECURITY TOOL icon to Properties, to File Location. Then I deleted all files in that location. I rebooted again in NORMAL MODE and then did a System Restore (could not get there prior)to a couple of days prior. That solved the problem.
@TROY
Troy. You turn the computer off using the POWER button by holding it down for 15 seconds. Then power on and choose the SAFE MODE at the beginning of the reboot.
I can’t see the C:\Documents and settings\all users\ application data. I’m running XP Pro and under all users I see desktop, favorites. shared documents, start menu.
Is application data a hidden file?
troy..
click restart on your pc.
before it opens again, press f8.choose safe mode
if u are using windows7 its so much easier! look for all the security tool icons,right click and choose properties. once in there,press locate program. (should be at the bottom left)once located, delete it…and all the remaining icons. click restart again, you should be running on normal and your done!
or…..
follow philly keith advice! goodluck man!
……….and don’t forget to empty your recycle bin.
@Philly Keith
I booted up in safe mode but couldn’t figure out the exact steps to reach c:\documents and settings. I am running windows Vista Home Edition. How do I “browse over” to the files you specified?
Jim
I may have stumbled onto it. While in Safe mode I searched on Application Data and got a number of matches. I saw a Documents and Settings\All users file folder, clicked on that and saw a file named 77411828 which went right to trash. Prior to that I traced the Security Tool locations by selecting the file name, clicking on Properties and deleting all references / locations.
Holy smoke, now I’m getting the same crap from a malware package called AntiVirus Pro
I have the security tool on my computer. The only thing it does is sits there and does nothing. I don’t have any mouse control and with keyboard, I just the Task Manager and cannot end any process. Looks like I am in trouble. I try safe mode, last safe mode with networking, last known configuration. Nothing works.
Does anyone has suggestions.
Please help…. Anyone, I don’t have any control over my mouse or keyboard, except the only thing that pop’s up is Security Tool, I could CTRL, ALT, DLT, but cannot terminate any of the processes. Cannot go into any Safe Mode. Does this sound like re-imaging the computer.
Your answer would be appreciatd.
Hey I as everyone else on this site… has security tool infecting my comp, I did all the manual stuff and deleted every last damn file with the 8 digit code and blocked all processes I killed every file i found and now i cant find anymore but i still cant run malwarebytes, i cleared the registry i cleared the user apps folders i cleared everything i could think of and the little prick is somewhere deep within the confines of my comp royally fucking shit up… Any suggestions? i need to fix this comp i cant afford a new one..
Thank you so much everyone for your advise…very helpful! My computer is currently unprotected – does anyone have any suggestions for antivirus software? I really gotta get me some!!
what do you mean by all left over shortcuts, and how do you reboot in safe mode?
@Steven the Sad
Guys I just spent the last 6 hours getting rid of this POS. I tryed all the free ways and ended up getting Spy Doctor ran it in safe mode (Pressing F8 repeatedly upon rebooting system. Security tools wasnt present in my safe mode all the popups were held at bay. I loaded Spy doctor and ran scan. This sucker did lock my internet connection once I was stuck but just rebooted in safe mode and I got back online.Then rebooted in normal mode and had to run another scan. All is write now and im back on working tonite as i lost a day of productivity.
I tried all this things .. but nothing worked ..
the only thing helped me .. made restore settings .
Hey guys, follow Matt advise it worked for me.. but I’ll be checking time to time 🙂
forget all that… try this move, it worked for me after going nuts over this for a whole day.
Reboot in safe modebrowse to C:\Documents and settings\all users\ application data
There will be a folder in there that has eight numbers as a name (ex 91908431)
Delete this bad boy, empty recycle bin
Reboot normally, delete all left over shortcuts, empty recycle bin again and you are home free.
Correction thanks Philly Keith… your the man
Haha, I laugh but I shouldn’t. I think I’m the only one on this site that sais that I PAID FOR IT! ;))) Well, actually not me, my scared mother. Unfotunately I wasn’t home to explain her. Well, the good thing is that now I am scanning my computer using Malwarebytes and actually everything works nicely. My mom said that emediately after she bought it, the viruses listed were “miraculously” deleted and all went back to normal.Now I wonder how much it lasts. Anyway, right now i’m dressing up to go to a store and buy an antivirus, which I thought (from my experience) that I don’t really need, especially that I used to work with computers with less than 512 MB RAM and any antiviruses slowed down my system so much that I wouldn’t be able to open even explorer. Now I learned my lesson.
Oh, and one more thing, it appears that the most affected program by this virus is Google Chrome, which happens to be my favourite web browser. Right now, even if my mom paid them, I still can’t get any response from Chrome.
So, I hope we all fix this problem. Good luck!
@kody112
Hey thanks kody112 i followed your instructions and they were on point i was able to get that junk off my computer i learned a lession from this next i will get have a antivirus on my computer thanks phats456
Philly Keith’s solution worked for me. I went to ‘run’, then entered c:\programdata\, and found and deleted the offending folder. A world of warning, however: I noticed that Security Tool had actually placed 4 such folders on my computer (they were all 8 number names), so make sure you scroll through the whole list and remove them all. I also removed the shortcuts it had placed on my desktop, and emptied the Recylcle Bin before rebooting again. Thanks Philly Keith for the very useful tip. So happy to see my Desktop return.
i need help! ive been reading all these comments from everyone..
i found the 8 digit numbered folder[there were 2] i deleted 1 but the other one i cnt delete it, what can i do??help!!!
FM18 : You need to stop processes before using task manager. Check what files are in the folder you cant delete and search for these processes.
Instead of government putting focus on collecting data and information on all Americans, they should just hunt these characters down and kill them ! This is costing Americans $Billions in lost time and material..
idk how security tools got on my computer it just poped up a couple of days ago what do i do to get it off for good?
Admin, I have downloaded “spdoc.exe”. And Security tool wouldn’t let me use it! HELP!
This security tool rogue was driving me crazy………I tried for three hours to get rid of it! Once i followed the instructions via Philly Keith’s solution it actually worked…….Thanks a Bunch!!!!
Rename to spdoc.pif and it should work.
Thanks to Philly Keith. His solution worked for me, people do not forget to use SAFE MODE than it works.
help, I have tried to download several programs to get rid of Security Tool. The programs aren’t being allowed to work. I’m not that great with computers so I need help. Thanks
@Philly Keith
tried to delete but comes up with “cannot delete make sure disk not full or write protected and file is not currently in use!!!! Please help i am going out my mind with this s**t
Thanx
I have Vista and could not find the numeric file anywhere until I used Mark’s method (post 185) and then did what Philly Keith said to do. Seems to have deleted security tool. Thanks a bunch guys!
O.K. guys I came back to this site and registered just to tell you a very easy method to get the Security Tool permanently removed. It’s simple, just boot up in safe mode (F-8) and do a restore to a past date. (OH,just pick one) I Hope they catch those A-holes that did that program. Now that I’d pay for.
Gena : rename the program to whatever.pif on save.
This thing is pissing me off. Whats the fastest and easiest way to kill it without downloading stuff? I have an english report due at the end of the week and this thing keeps poping up and getting in the way saying harmful software detected and bull.
keith: folder option doesn’t allow me to show all hidden files? and i cant see any “application data folder” in “all user folder”?
this security tool thing
is messing with my computer
i found the source, in my computer
and when i try to delete it.
it tells me that i dont have
permission for this action.
i need help
The “Security Tool” on my PC just appeared and I don’t know why. I didn’t purchased nor downloaded it. I am trying to follow your instructions but this virus is corrupting your application. What should I do? I have my very important files on my pc. Please help me. Email your response as soon as possible. I am hoping for your positive response.
Everytime I log in the screen and is and than my icons disapear, I keep getting the security tools warnings that i need to register and remove the threat
@Stuart M
you probably did not use SAFE MODE when you reboot. With safe mode all works!
When i do Reboot in safe mode
browse to C:\Documents and settings\all users\ application data. I cant find application data can anyone help me
Okay. I am infected with security tool on my other computer and have been for the past week. I have read articles and solutions in the mean time and turned the computer back on for the first time in the last 6 days two hours ago. It starts in what appears to be safe mode offering me all of the options one would hope for but when I try to run it in safe mode (or any other mode for that matter) it just reboots and I go through the same process over and over and over. Any ideas would be gratly appreciated.
@kodykid168
Hello Kody,
I tried what you suggested. I went quickly and clicked on ctrl alt delete and I found the numer sequqnce and I ‘ended the process’ because that’s the only thing that comes up as an option. It still did not ‘kill it’ as you mention it.
I also tried to start my computer in safe mode. It would not even open another window after typing MSCCONFIG and clicking ok. I tried to start in safe mode with the F8 Key. It would not work either.
What can I do?
This thing is horrible. It is weird that the Security lets me access the internet, so I can write this here.
My Wallpaper of course is no longer there. The background of my screen is pitch black and it ‘steals’ the desktop icons, so one cannot access the Recycle Bin.
What is this? And where does it come from?
I have Avira Antivir (which is usually pretty good) and it would not even let me perform a system scan with that.
Can any of you help me out with a different solution maybe?
Also further up on this discussion board there are many files listed under HKEY/Current User/software/microsoft/windows … etc….
How do I find these?
Also where would I look for doguzeri.dll and 4946550101.ex when opening the the explorer with the right mouse click on the start button?
I feel so lost right now!
Thanks for your all help.
Yvonne.
@Mark
Mark,
I typed in c:\programdata\ after clicking on ‘run’, but it told me that it cannot find the file.
I want to try to start my computer in safe mode again, but I don’t know how to make that work, because it doesn’t work via ‘run’ with MSCONFIG because it doesn’t open another window. I tried with the F8 Key and it wouldn’t work either.
I am so pissed about all this!
How can one protect oneself of such stupid viruses?
How many firewalls does one have to put up?
I do like to go on Facebook and I also like to play games. Can we not even do that anymore without catching a virus?
Please for some help.
Thanks a bunch.
Yvonne.
@Wakay
Hello Wakay,
I went to Documents and Settings/all users/
The weird thing is that it doesn’t follow with application data.
Where would I find this maleware file now?
Can you give me a hint?
Thanks,
Yvonne.
this programme doesnt allow me to open any application.
Yvonne : the app data folder is hidden. You wont see, but you can access it by adding it to directory field in explorer.
dear admin.
how do I do that?
where do I find the directory field?
To tell you the truth, a couple years ago we were hit by lightning and it blanked out my computer. Ever since then I have lost my Windows Office Program. I also don’t use IE anymore, but Mozilla Firefox. I can go into the Control Panel anymore to use the ‘search file function’ because anytime I do, there is this little doggy at the bottom of the page, smiling at me as if so he is saying: “Well too bad, but this page stays blank” 🙁
Of course I tried to fix things on my own, and I have possibly deleted things that I should not have …. 😉
After all the computer is working great, but last night I caught the ‘Security Tool’ and it is annoying because I can’t access any icon on my desk top anymore.
I will try what you have suggested dear admin. 🙂
Hope I will find the app data folder so I can add it, and hopefully it will let me do it.
I can open IE, but for example it won’t play any videos nor did it move the ‘dropp down menue’ when Yahoo still had its old page and one would want to see the weather for example.
Ok. where do I find this directory field again?
Thanks,
Yvonne.
Ok,
here I am.
I went as far as ‘all users’ and then it gives me the option to add a new folder.
Yet, what sense would this make? The Security Tool exe would not be in there!
The All Users – Folder contains, Desktop – Favorites – Shared Documents – Start Menue.
I just searched through all of them, by opening these folders. There is nothing that sais “application data folder” …. 🙁
Thanks for any help that you can give.
I will look out for your response, dear Admin.
Yvonne.
This is what worked for me after trying just about everything here.
ctrl+alt+delete upon start up to
get task manager up before security tool.
click on start and scroll up to security tool to find its location.
right click on it.
open file.
find string of eight numbers, and delete.
permanently delete out of recycle bin.
restart.
remove any short cuts on desktop for security tool.
Permanently delete out of recycle bin.
restore computer to a date before infected with security tool.
Check to make sure that all anti-virus and malware running properly.
Hi Guys,
I tried it again. I think I was able to catch the ‘safe mode’ on start-up. Anyhow it only worked once, since when I restarted the computer the desktop icons went back to normal size.
I also clicked on ctrl alt delete to open the window for the task manager.
I found the number, but all it allows me to do is to end the process. There is no button for ‘delete’.
It doesn’t help because anytime I restart it is right back on there.
I see other exe.
these are the ones that I cannot make out.
svchost.exe (many times; I have about 6 or 7 of the same on there)
spoolsv. exe
lsass.exe
jqs.exe
csrss.exe
smss.exe
Does anyone know what type of exe these are and what they relate to?
Maybe one or more of them came with the suspicious Security Tool?
I am so grateful for your all help.
Thanks for your quick responses.
Yvonne.
Hey, i got the Security tool flue, and i have Avast, but every time i set it to scan så i can remove it, it shuts down? Any help ?
@Tom
Hi Tom,
WOW, I am so glad that I have a second computer, which I just finished hooking up. Of course this one has minimum Memory, so I probably can’t upload my Adobe Photoshop Program on this one here, but it works for the while being until I find a way to fix my other one.
Yes, I finally clicked on reboot on safemode, then I went to the suggested applications in ‘run’ and I got as far as clicking on ‘SAFE/BOOT” and ‘BOOT.INI”, guess what? I can’t get the computer to boot all the way to my desktop anymore! WHAT IS WRONG WITH MY COMPUTER? … I am so cried-out about this.
Does anyone know what I can do in order to at least get back onto my desktop?
I keep highlighting to going back to a point where it was safe, or to start in safe mode, but all it does is is counting down the 30 or 29 seconds to 0, just to start counting down again from 30 or 29 seconds! It also always goes back to ‘start computer normally’.
Can anyone please help? Thank you.
I hope I don’t have to take this computer to a store to get it cleaned-out! It costs money, which I can’t free up at this point and time.
Or, does anyone know how to cean up a computer? I would do it myself, since I do have the Windows XP CD-Rom anyway.
Hope to hear from anyone, soon.
Thanks again for you help.
Yvonne.
@ Philly Keith,
I followed your instructions to the letter and problem solved! To think that I almost shelled out 29.95 for Spy Doctor (that’s what’s in store for those who istall it); you saved me money, time, and frustration. Thank you so much, you really are a lifesaver.
Yours trully,
Angelo
Thank you so much everyone!!! The Security Tool (on our Vista) was located in
C:\program data\35840525
Working on safe mode, I deleted the folder 35840525 & the 2 shortcut icons, then emptied my Recycle Bin… Reboot it normally afterwards… Security Tool’s gone!!!
Thanks again!!!
I know NOTHING about computer virus scan sites. and I accidently installed this Security Tool.. Is there any way at all to just REMOVE the Security Tool fully without actually installing anything else?? I dont own the computer and I just want it off…. Please let me know if there is anything that is simple steps. Thanks!
okay, this somehow ended up on my new pc and it’s not even installed in my computer and it keeps scanning and telling me i have viruses and files that are infected that i know it’s not true. it keeps me from doing my work on microsoft and other programs. i’ve tried installing the Malwarebytes Anti Malware but everytime i try to bring it up on my cd it says that it’s infected and won’t let me do anything. what do i do? please i just got this computer.
To All Having Problems Searching For Application Data!!
I have windows xp media center edition, and ealier the Admin said to Yvonne that the app data folder might be hidden!!!
First off, let me start by saying that every computer may not have the file name (ex 91908431)…I actually came across three files 09204121, 41220112, & 51200987.
STEPS
1. start computer in safe mode
2. go to start, my computer
3. go to C:\Documents and settings\all users
**note** you may encounter four folders Desktop, Favorite, Shared Documents, and Start Menu.
4. Here you right click anywhere in the box, then go to properties
5. Now you check hidden (near the bottom), then hit OK… a smaller box will appear, make sure you hide the sub folder as well *IMPORTANT*
6. Now everything has disappeared!! Dont worry, repeat step 4 & 5… but this time you uncheck hidden then hit OK
7. Now you have six folders!! Application Data, Desktop, Favorite, Shared Documents, Start Menu and Templates…. double-click the app data folders and find them eight irritating azz numbers and then follow the example giving by my man Philly Keith!!
DELETE THESE FILES… EMPTY RECYCLE BIN… REBOOT NORMALLY… DELETE SHORT CUTS!!!!
Hope this helps, if not…. i suggest installing windows again, but of course back up your most important shit 🙂
P.S. I just turned 20 today!! 11/30
Here’s to all of us who have been victimized by this crap. If you would like to talk with a representative of the company that markets/infiltrates the Security Tool all you need to do is dial 1-800-507-4599. After quite a lot of work I managed to get it off my computer and after a few phone calls I managed to get some of the anger and frustration out also. Enjoy the day!
Has anyone tried giving Mcafee their $90 and they remove it for you????
Security tool has totally messed up my computer. I cant even finish downloading any software that supposedly gets rid of it. Trend Micro does nothing to it. I have a black screen and can’t open any applications. Help!
@Philly Keith
how do you reboot in sae mode
After I got rid of the 8 number files, the icons on my desktop were dark, sort of when you cut a document or pic so you can paste it elsewhere? What happened and how can I fix it?
a very very easy solution,,,,just kill the numbered process from task manager before sucurity toll starts and then go to c->documents and settings->all users->applications and delete numbered folder,,,also delete from recycle bin,,,
press F8 couple times when booting your PC. Then choose from menu.
i just got a brand new computer and now i have stupid security tool on it, and my parents are going to be really mad. I need help nothing is working i tried everything. the pop ups are making me so mad… and my computer goes to a blue screen after 30 mins of using it. and then shuts down i dont know what to do… PLEASE HELP ME
My computer keeps crashing over and over again, i have security tool and it turned my desktop blue, i keep trying to go into ‘change/remove programs’ but it keeps telling me somethings trying to get through to my credit dard information. it wont let me download anything whatsoever. i really need help getting this off.
@AMY
I found Angles & Amy’s solution(copied below) to be the best and most simple, couldn’t find the file locations on my PC stated by others. Cheers. ANGEL, THANK YOU VERY MUCH. IN SAFE MODE WE HAD TO RIGHT CLICK ON THE DESKTOP ICON FOR SECURITY, HIT PROPERTIES, COMES UP WITH TARGET LOCATION, CLICK ON FIND TARGET, CLICK ON THE FILE WITH THE 8 DIGIT NUMERICAL NAME. THE 8 DIGIT NUMERICAL NAME IS NOT NECESSARILY THE SAME FROM ONE COMPUTER TO ANOTHER. EMPTY RECYCLE BIN AS STATED & RESTART.
When you write ‘kill the numbered process from task manager” what do you mean by ‘kill’? I clicked on END and it would still come back up. How EXACTLY does the process work to ‘kill’ the numbered process?
Thank you.
I had tried that and then some other stuff, so now my computer won’t even boot up anymore. I went into bios and even enabled the SUPER BOOT and not I can’t even get back into BIOS anymore!!!
Can anyone help me to at least get the computer to boot again, so I can go and try the process again to ‘kill’ the Security Tool?, and or to at least save some of my important photographs to CD.
Thanks so much.
Yvonne.
@kody112
I GUARANTEE you this will only work temporarily. I should know, I’ve only done it about 50 times already.
Hi, my lap top was infected with ths securiy tool virus a few days ago, it is absolutely unbelievable and unlike anyting i have encountered, i have Norton pemier 3.0 i have tried deleting ‘securiy tool’ files, running comprehensive virus scans etc. it has somehow gotten itself into my ‘program data’ and will not let me delete it manually saying i need permission to perform the action… i’ve tried rebooting everything i can think of, it shuts my computer down ranomly and has disabled my entire desktop and removed my backgound it also hides my tool bar… after reading the posts on here i have made the decision to get professinal help even if that means paying for it as i would rather pay $100 to get it properly fixed as opposed to damaging my 2000 dollar lap top only 3 mnths old tryin to remove it myself and i would stronly suggest this to ANYONE infected by this virus.
@ayesha
on my computer it does’t even appear in task manager
i need rid of security tool as it is fake and damaging my programmes?
Thanks to Philly Keith…after how many days of aggravating pop-ups…finally removed it!!!
Yes there a many FREE spyware removal programs but are there really any that are free, and you do not have to purchase a programs after you have completed a scan? Are there any really free ones available???
Well… There are couple free for home users, namely spybot S&D and superantispyware. Some are semi-free, aka remover is free and real time protection is paid or there are limits on how many parasites you can remove with free version.
The problem is that maintaining a good anti-spyware product requires money for staff, equipment and malware tests. There is always a catch how anti-malware manufacturers try to get money 🙂
I have a windows Vista and I tried Philly Keiths method but I think it is differnet in Vista. Anyone have any idea how to get rid of it with Vista. I cant download any malware programs etc. It wont let me.
Thank you. I found it and deleted and it worked.
I got a bitdefender total security and It didnt decete the fuking malware called security tool. But my Intenet works fine. All you lot and I can do is press ctrl+shift+esc and click process the end process the 8 digit number (sometimes it closes but keep doing it until it opens!!)
Started it in safe mode logged in as Administrator.
Did a system restore to a previous date.
It didnt have any security tool any more
@Scott What did you find? I’m still fighting to download a malware on Vista. Any suggestions?
Hi Roxanne,
you can download Avira Antivir for free.
I have it on mine, and it works great!
By the way, after agonizing with my computer, not being able to start it at all anymore, I was soooooooooooooo lucky about 3 days ago!
A friend of mine, whom I haven’t seen in a long time, and never even thought about, helped me to start up my computer again and then we had to take it down.
Security Tool messed up too much already. At least I was able to save my pictures and some documents since we totally had to upload Windows XP anew.
This killed it, too but it also killed my computer, you know.
Since I had this second one here with very little memory, he simply placed the drive from the old computer into this one. Now I am ok, and hope this Security Tool stays away FOREVER! …. lol…
Does anyone know the address of this “Security Tool” place? I think some folks would like to pay them a very personal visit.!!
Roxanne, in Vista, restart your system.
after logging on, hit alt ctrl delete and open task manager.
Click on processes
Be sure check “show processes from all users”
Find the process that System Tool is running under. Mine was an 8 digit numerical .exe file
Highlight it, then click “End Process”
Next go to C:|program data
Locate the folder, right click and delete it.
Be sure to empty it from the recycle bin.\
Reboot…………hope this helps. It worked for me!
I got rid of security tool very easily. I right mouse clicked the security tool icon on the desktop. Went to properties and found the long number with exe after it. I copied that. Went to start on bottom left of screen and opened that on the bottom there is a search screen I pasted what i copied took me to where the number was, I deleted it cleaned my recycle basket and restarted my computer. It hasn’t been back since knock on wood
for all you ppl saying delete that numbered file alone, and rebooting.. good luck to you.. that doesnt fully remove this..
I got this virus and it brought along cyber security with it so I had both.
@Joe
If you go into safe move look in your application data folder under all users and you will see an exe that has the same icon as the security tool. Delete it and then it will let you install any antivirus or the preferred malwarebytes antimalware which worked for me.
ooooh!….this “SECURITY TOOL” is a big messy thing. i cannot open my programs due to irritating and annoying pop-ups… whoever the creator of that useless system file should be punished. i do hope that all the “finest” IT experts will work on it to trace that genius but useless creator of Security Tool…the PAC-MAN is not happy for that thing… haaaaayzzz…
I can’t run the doctor spyware. I need help. My desk top is now black and can’t se anything on it.
I cant open anything i got to this website through their customer srvice and cant open anything with it help me i dont know how to reboot it help me!!!!!!!!
@Philly Keith
i cant delete the 8 digit number
Thanks for the numbered file tip, I deleted both of those, but, then again, they were both empty. I think it may have killed itself overnight because there was the Security Tool shortcut last night, and early today (on safe-mode) the same icon was empty, and its properties described it as being re-directed. Also, a curious factoid, on Task Manager, I never saw an eight-digit or ten-digit number followed by .exe, yet my computer was still infected with the rogue anti-virus. This sure has been an odd experience.
Here’s how I killed it:
1- I have XP, so I keep hitting F8 to start in the safe mode.
2- In the SAFE mode, do “Run”, type in MSConfig. Here upcheck the process in “Startup” that has a six digit numberic number, in my case, “807999”, click “Apply”.
3- Re-boot, and startup WILL NO LONGER activate the virus, taking control of your PC, even though the malware is still in the system. Now, you can take control of things to download tools needed to remove the executables, registry entries etc. of the virus.
4- Download Malwarebytes, free version, to remove what remains in the system.
5- I separately deleted the “Security Tool” icon on the desktop.
6- Change the wallpaper back to normal.
6- Resume work ….
Here’s how I killed it:
1- I have XP, so I keep hitting F8 to start in the safe mode.
2- In the SAFE mode, do “Run”, type in MSConfig. Here uncheck the process in “Startup” that has a six digit numberic number, in my case, “807999”, click “Apply”.
3- Re-boot, and startup WILL NO LONGER activate the virus, taking control of your PC, even though the malware is still in the system. Now, you can take control of things to download tools needed to remove the executables, registry entries etc. of the virus.
4- Download Malwarebytes, free version, to remove what remains in the system.
5- I separately deleted the “Security Tool” icon on the desktop.
6- Change the wallpaper back to normal.
6- Resume work ….
Used My system Restore before my computer had fully booted. Set it back 14 days, Ran that. Added new Anti Virus working fine.
Instead of downloading the software to remove it just simply follow the steps to remove it in the registry… you should also boot in safe mode and goto Run/msconfig and remove ALL STARTUP ITEMS, this is called selective startup and you disable EVERYTHING, and then windows will only launch what is needed to run, this way Security Tool is not trying to launch and interfering with the removal process, if you are familiar with system registry keys then goto Run / regedit.exe and follow the steps at the beginning of this page and remove the reg keys from the system.
Also i recommend CCleaner by Piriform to repair your registry and ALWAYS DISABLE SYSTEM RECOVERY otherwise when you reboot the virus’s etc will return.
-Randy
Bachelors of Science
Programming / Network Forensics
@ler
Sup dude… STool can be a pain in the ass lol….. Try downloading “rkill”… what it does, it temporally terminates all mal-ware program (security tool)… here i will place the link
http://download.bleepingcomputer.com/grinler/rkill.com
Once it is downloaded, double-click on the rkill.com in order to automatically attempt to stop any processes associated with Security Tool and other Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by Security Tool when it terminates programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate Security Tool . So, please try running Rkill until malware is no longer running. You will then be able to proceed with the rest of the guide.
Do not reboot your computer after running rkill as the malware programs will start again!!!
If you are still having problems… i will make another video sutible for your cause 😉
This ‘security tool’ has been drving me insane!
So far, I’ve been able to do the above suggested by ‘KyLO’ (#222) but can’t find my recycle bin to empty it! My desktop isnt showing and my background is a funny green colour.
DOES ANYONE KNOW ANOTHER WAY TO ACCESS RECYCLE BIN?!?!
I’ve been searching for the last 45min but still can’t find it! GRRRRR!
@Philly Keith
Dude your way worked perfectly….no buying one spamware tool to erase another, no exhaustive processes, just to-the-point directions…..and results. You, sir, deserve a holiday named after you and a park made in your honor.
That yellow shield is finally gone.
What a great Christmas gift.
Thank you guys,
Rhys
Thank you for this -I was goofing up at the browse stage…I kept clicking Browse after typing in directory – Instead of OK–Press OK…guys/gals
Yellow shield back.
Rhys
i downloaded the spydoc but the security tool wont let me download it!!! every time i try to open it to install it, it says somthing about sending me credit card deals or something help me FAST!!
@Philly Keith
Ok, great – I got to the application data and found the file and was trying to delete it to the Recycle bin and an error message popped up saying that it couldn’t delete, access denied. What do I do now????
Rhys : Have you scanned with any anti-spyware after it was gone? There might be a security vulnerability open by the security tool or some hidden trojan downloader. You HAVE to make sure everything is clean after you remove Security tool
virushater : rename it to spydoc.pif on save . It should pass.
Bethany : disable the processes first. Start task manager and stop the numerical processes.
@brenda… you can access your recycle bin by going to my computer and that “arrow down button”
HELP!!!!!!!! OMG THIS THING HAS BEEN ATTACKING MY COMPUTER FOR A WEEK NOW. HOW CAN I GET IT OFF. I EVEN TRIED PHILLY KEITH’S WAAY BUT I CANT FIND APPLICATION DATA UNDER ALL USERS AND I DID A DOMAIN SEARCH FOR IT ON THE WHOLE COMPUTER BUT STILL COULD NOT FIND IT..!!! HELPP PLEASEE I HAVE A HUGE PROJECT AND CAN NOT ACCESS MICROSOFT WORD.!!! WHAT DO I DO..????
@Philly Keith
how do i delete other remaining pop ups?
ok i got this damn virus to and its killing my computer! So you say that there is manual instructions what are they? how do i do it manually? I cant even open my desk top anymore. Please help me i dont want to download anything i just want it off manually! thanks.
@Philly Keith
Wouw thank you SOOOO MUUUCCCHHHHHH !!
I was about to get crazyyyyy, u saved mee
THANKS
hi!! my computer was suddenly infected by security tool. i try too get ridd of it but i didnt make it. what can i do??? its really boring too have it on my computer! please help me!
Help, I Just found out that this ‘Security Tool’ is a VIRUS. I am trying to remove it using Spydoc. Does it works???
Hey theres a sercurity tool which won’t let me access anthing on my computer. SOMEONE PLEASE HELP ME RID OF IT
Hi, would system restore after you do the task manager thing works to get rid of this? thanks
@securitytoolmurderer
if you load normally, hit ctrl+alt+del before security tool loads, go to the processes tab and end the process that has a 8 numbered name, this will NOT solve the problem, this will allow you to use the computer to fix the problem.
open up my computer and in the address bar at the top type the following and hit enter
C:\Documents and Settings\All Users\Application Data
That will take you to the folder whether it is hidden or otherwise. There should be a file (sometimes more than one) that are also named with 8-digit numbers, Delete these then empty your recycle bin.
Following this remove any desktop shortcut and startup item for security tools and empty recycle bin again.
Restart your computer again and it should run ok. I would suggest running a registry cleaning software after to remove anything from there and also a scan with a program like Malwarebytes to hunt out the trojan that put security tools there.
::NOTE:: these file locations are for windows XP, if you are running Vista or Windows7 they may be in a different location, if this is the case, right click on the security tools icon on the desktop and click properties. Once this window opens hit the ‘find target’ button and it will take you to the folder housing security tools. Once there delete the numbered folders as in above instructions.
If anyone is having trouble with the F8 safe mode boot, after killing the numerical prcess via the task manager open your start menu and go to run. Type in msconfig and hit enter
this will bring up the windows configuration utility, go into the BOOT.INI tab and check the box marked /SAFEBOOT and the box saying minimal (if you want network access check the network box instead of minimal) then restart your computer. Leave it to start and it will automatically boot in safe mode
::NOTE:: When using msconfig it will continue to boot this way until you return to msconfig and tell it to reboot normally. when finished in safe mode, before restarting, run msconfig again, on the first screen check the option ‘normal startup’ and hit apply. Next time you restart it will load as normal. (again i have only tested this on XP so someone else will have to confirm for vista/windows7
Hope this helps you guys as I read through and see a lot of repeated comments about the same things. Just trying to do my part as a previous victim of this wretched program.
Good Luck
Jim
i cant remove this so if u would please help me remove this :(!!!!!!!!!!
Thanks Logan Chandler
how do you boot up in safe mode
I just did a system restore and it’s no longer on my desktop or in my tool bar or start up menu. Did this get rid of it? Anyone know?
ok this security tool is driving me crazy!! I am scanning my spyware doctor but this thing makes my computer restart in the middle of my scan so.. is there any other way to remove this?? thxx
Laeh: Do a scan with anti-spyware programs. Many provide free scanners, and it is highly recommended to make it sure.
ok i opened my mozilla firefox internet and it says
“how embaressing
firefox is having trouble recovering your windows and tabs
you can try removing one or more tabs that you think cause the problem or start a new session.”
Windows1
Security tool-how to remove
remove or start new session?????
what do i do, pleaseee help
I had a problem with this just yesterday i tried a ton of stuff to get rid of it but the popups never went away. i was in the middle of renewing my mcafee virus protection then it started to disable my internet and deleted all my desktop icons and i couldnt open files. It was on my toolbar and hiding in my files too.
I went to a few sites that showed you how to get rid of it but that didnt work either. I actually had to call mcafee and just pay $90 for them to get rid of it for me. they were cheaper than dells virus removal and others. Im pissed i had to pay so much but at least they have a 100% guarantee that it will be removed. i wouldnt trust doing it myself since the virus can come back after being deleted.
the safe mode only works for awhile but it will still be on your computer. supposidly the longer its hiding on there the more damage it’ll do. unless you know exactly which files to look in i would just have a pro do it. after getting rid of it i was finally able to renew my mcafee disk and it hasnt been back since. it took them about 20min to fix it. 90 bucks for 20min is crazy but it worked.
Hi Guys
Just wanted to say thanks for all the information on this page i was infected by this virus last night and after hours of trying found this site. Great and easy instructions.
Thanks again.
1. Bootet the pc with Bart PE (windows-environment link:http://www.nu2.nu/pebuilder/).
2. Removes those 8-10 digits exe-files (under UserData/All User/Application Data – remember to make those folder visible!)
3. Boot af pc. “Security Tool” doesnt start anymore. (Blessings!)
4. Doing Malwarebytes AntiMalware and looking for some patterns in registry (regedit)
5. Have fun.
Thanks to Keith and Kylo whose info helped me kill this SOB! All works now!
ctrl alt delete as soon as windows logs on b4 virus boots up,open task manager,end process of the 8 digit number,go to documents and settings,application data delete security tools,get rid of it in start menu,and task bar if its still there,run a virus scan just in case,and yur gud!
Omg i have this virus too omg i want it gone ASAP hellp something freee would do nice!!!! so annying i didnt know there was people out there having the same issues so lame man!
Right:
This caused me no end of aggro so thanks to all the helpful people who posted advice here.
I got the number of the offending spyware program when I went to close down my PC – I got a message saying that one program won’t close etc – did I want to end now. The number of the spyware program was shown then – it was an eight digit number beginning with 4.
I then restarted, hit ctrl-alt-delete immediately on start up, and went into processes, found the process with that number, and turned it off.
I found that I was then able to run malwarebytes and remove all the related spyware components from my system. That was 15 minutes ago and everything seems okay now (touch wood).
Thanks to those who suggested the ctrl-alt-delete on start up, if I hadn’t done that I wouldn’t have been able to open malwarebytes and get any further.
This has now taken up around 2 hours of my day now…..#%&^*!
Thank you Frank, you are an angel.
Your directions allowed me to eliminate that devil “Security Tool” which turned out to be the KoobFace worm in disguise. I am certain my children picked up this infection from facebook. Now that my computer has been successfully de-wormed(shudder) I feel I should send everyone to the showers to wash away all traces of slime.
Merry Christmas and Happy New Year
Within an hour of aquiring it, the Security Tool virus quickly rendered my PC unusable, even though I subscribe to a low-end version of Norton Antivirus. Using another computer, I examined the options and decided I felt insecure trying to eliminate Security Tool by myself. I decided to go with Spyware Doctor. They charged me $30 but it may have been the best $30 I’ve ever spent. The trick was starting Task Manager at boot-up to silence the virus temporarily and regain use of the computer to download and run the eradication program. They tell you how to do that. I am quite satisfied with the results. The only thing I seem to have had to restore is the custom background picture for my desktop. They tell you it only takes minutes, and that’s true for the actual eradication once you have and have registered the software, but the download and registration process took me an hour. I’ve had Spyware Doctor less than a day and it has already caught other incoming infections so I feel pretty confident recommending this for folk like me who aren’t particularly technologically savvy.
I was flustered for 2 days with this @&$#ing thing
then I found this site and did the reboot in safe mode
went to C:\Documents and settings\all users\ application data and looked for 8 digit file (ex. 91908431) and deleted it and then emptied recycle bin
then I rebooted normally and then deleted all shortcuts on desktop and elsewhere to Security Tool and then emptied recycle bin
that was it gone!!!
I then ran my registry fixer (iolo system mechanic professional)did registry scan and clean it found all remnants of this Security Tool and removed it
I installed malwarebytes anti-malware and ran that
finished and clean
try this method it really works…..take it from someone that was ready to kick my computer and to hunt down the inventors of this vicious virus and kill them!!
@Mike Mike
hello, when you tried to delete the 8 digit folder did it say access denied, because mine is and i can’t deete it. HELP!!! please. thank you.
Will System Restore Do The Trick?
@Philly Keith
Keith – thanks for the tip. It worked!
GREAT!!!!! MY COMPUTER HAS NO HOPE!!!!!!!!!!!!
I really hope whoever created this is jailed or seriously prosecuted.
I can’t believe people have such no life to sit at home for hours on end creating something like this. It doesn’t make you popular.
Going to try and remove now.
Security Tool eneded up on my computer. I read through this entire forum, deleted the things that people here suggested (I had several instances of the 8 digit numbers in the App Data Folder and in Registry) and then cleaned with Malwarebytes to get what was left of the beast.
Everything seems to be fine with one exception. If I try to type in something in a search window of google or yahoo, I get no results back from the search. Bottom left corner of pane says “Done”. But, if I type a web address in the top of Internet Explorer it will go to any website. I went to Microsoft site and can search using the “Bing” search window and get results.
Now my question, did this thing mess up Internet Explorer? How can I fix this. I was going to reload IE8 but wanted to get you guys feedback first.
Thanks You all so much for letting us know how to destry the Security Tool
Folks,
For all those Vista users, what worked for me was booting up in safe mode and then restoring the computer to a couple days prior
@Flexman
What if it keeps saying “access denied” ?
Please help me!
@Philly Keith
Philly Keith YOU ARE the MAN!!! It worked! However, idk if anyone else has this problem but my icons and page are huge. I have gone into resize and such but o no avail! Still big icons and the page seems zoomed… Again, I went into everything to re-size fonts and fix page size but nothing. All systems are working great except for this. I also did a simple sytem restore. Should I just back up everything and run a full recovery?
Help, please! YOU ROCK! btw =)
What the crap is going on?? AHHHHH! I have a spyware terrminator already in my system how do i get rid of this stupid security tool thing, this sucks! Every two seconds the stupid security tool wants to me remove all the “bad” programs!
This had bothered me for 2 days it kept popping up with things saying like this is trying to send credit card info and i was scared but so then i rebooted my computer and went into safe mode then i right clicked the icon in my desktopand went to properties then i put locate file i think and it asked if i wanted to delete it i put yes i did this for about three times and then i went to the start menu and looked for the progrm and deleted it for two timesthen i shut my computer down and turned back on and its fine now i have windows vista
hope this helps
@Jimmy Lim
Jimmy Lin, you are my hero. Followed your instructions and they worked beautifully. The world needs more people like you and a whole lot less of the moron(s) that designed the bug. Thanks mate.
I am trouble shooting my wifes laptop which is running Vista. I wasnt able to follow the paths given in some of the previous texts but: I did a system restore and have rebooted 3 times. So far so good. Good luck people.
@Philly Keith
thanks alot bro! got rid of the security tool.
Guys, I used Philly Keiths’s method from October 9th, been good for over a month now.
I`ve downloaded the spyware-doctor and Malewarebytes anti-maleware , but when i trying to install it security tool says it`s infected and i can`t install it
I can`t reboot in safe mode and task maneger dosen`t work .
Help me please
I have already found the 8digit file and deleted and this has worked thus far succesfully (1hr). Google search now just goes to a blank screen when searching. Does anyone no how to sort this out?
I have already found the 8digit file and deleted and this has worked thus far succesfully (1hr). Google search now just goes to a blank screen when searching. Does anyone no how to sort this out?
I have this crap on my laptop. I boot in safe mode but when I access the dir for the Application Data, all I get Volume serial number. There are no files. What now?
this is the way to shut this thing down. thank you.@Jimmy Lim
I have tried other search engines and the same thing seems to happen. (just a blank screen). Why would this be?
ok, I just did restore back to a date before the virus hit. What else do I need to do? I don’t want to touch it until I know it’s gone! Thanks!
@Red: You have to use manual instruction instead, I’ve blocked with this software and I can’t even install my Super Anti-Spyware. To use manual instruction, you have to run windows in safe mode, then right-click on Security Tool properties, then click find target/open file location, then delete the software. After that, you have to open registry editor, then delete the registry folder that has a same name with what you’ve deleted before. Hope this could help.
@kody112
not very sure how to restart my computer in safe mode and what i am lookin for
this security tool want let my computer do anything. and i am not very computer litterit
@Philly Keith
your advice didnt work for me,and i tried it twice.
is there anything else i can try,this thing is getting on my nerves!!!!!
@Philly Keith
I did that, but when I scan with spyware doctor, I still see security tool. Get rid of this, I need to spend money for spyware doctor. Do I have to this???
@admin
I scaned it and shows 3 threats and 5 infactions. I trid to fix those and spyware doctor said I need to pay for it. What do I do?
Hi ^_^ just got infected last night and went through hell all day today. ^_^
read the tips up a above and did some things to stop it from appearing while I searched for help. I tried windows defender and stopped it from appearing at startup and further on. it hasn’t bothered me now. I’ll try and go on safe mode and do what you guys tried to do to permanently take it out of it’s misery…
Everthing is working and I cant find any more files of Security tool but it is still blocking all download and update sites on the internet. How do I fix this?
I have a dell and when i go to safe mode i get the blue screen of death
well, like you i have Security tool crap. it won’t let me open IE, nor do i have a system restore (not sure if S/Tool disables that? or renders it unusable?) nor am i able to Ctrl-Alt-Delete to get task manager. i have vista/32bit home edition. can someone give me a rundown how to rid this POS Security Tool and what i should do to prevent against it or future invasions? i use Spybot and update it weekly. also adaware and use it weekly and i use the Free AVG that runs daily at nooon. once, i used this other program (ashampoo i think) and it cleared my registry..is that my system restore? i hope not…thanks for your help. jo3y in baytown.
Therese : Check browser add-ons, proxy server and hosts file. Most of anti-malware software does not check these places, as they are not actual infections, but bad configuration.
Here a guide how to do that : http://www.2-viruses.com/how-to-fix-google-results-hijacker-google-redirect-virus-problem
Steve: Check which error you get on BSOD. You can remove security tool without “safe mode”, for that you have to press couple times ctrl+shift+esc during login phase of windows so task manager launches. Stop numerical processes and then delete them.
OMG… my computer got the security tool.. im trying to download the spyware doctor but the security tool is blocking it. what should i do? help me please,,
I have this on a computer at work so it’s pretty important that I fix it… I can’t use task manager and I can’t use safe mode. I can hardly even get to the start bar because this virus makes my computer SO slow… how am I supposed to fix this?
@jo3y So far today I’ve been able to stop it three times with Windows Defender. I, like you,would like to eliminate it completely. It’s amazing that most of the removal answers are so difficult to read. If I discover something this afternoon, I’ll try to make it simple enough for me to understand.
On my laptop, the file shows up as c:/ProgramData\41818325 I deleted it there, and in software in Defender, and from desktop. It hasn’t shown up for about 3 hours now. Windows Defender seemed very successful at temporarily stopping the file. I ran two other anti-virus programs and they didn’t recognize it.
@Philly Keith
How do you know what the left over files/shortcuts and such are? My daughters pc got this crap on it somehow.
my desktop is blank i almost always get the stop screen ( the blue screen ) and i cant take this “tool” off!! Please help me get this thing off! Thank you.
Candance : Try launching task manager right after boot (keep hitting ctrl+shift+esc).. Virus might need time to launch. Another alternative is downloading process explorer .
Ghraze : there is an alternate link to spyware doctor. Try it.
Where do you go to type C:\…etc. in at ? I do not follow you?
@dashaun
You need to hold down ctrl/alt/delete and end the process. That will free up your computer. Then you need to start working on this tutorial.
Philly Keith’s solution worked like a charm. thank you !
The best thing to do is use Norton Antivirus. Spyware doctor is great and all but it’ll detect things on the computer that isn’t there. If u can’t buy the full Norton Antivirus or Internet Security get the trial version and it’ll find the security tool and delete it for you.
You know, me and my wife just spent the last few hours trying to get this mess removed from our desktop. To who ever the person is who wrote this mess, please pray that i dont find you. The painful things I want to do to you are massive.
My husband actually went out and purchased a new computer today and we now have this virus back!
How could this happen again???
He loaded up all of the typical software programs and also Skype
We have no idea how this could have happened again with a brand new computer. any thoughts on this one?
My husband was able to get the virus deleted and it looks like it is gone for now. However, if the pop up appears again what is the very first thing we should do at that point in time? Thanks so much and Happy New Year.
I think this worked for me on my wifes laptop… I disabled her wireless connection to stop ST from updating or getting out, restarted her computer and interrupted the boot into safe mode. When windows launched, I started task-manager immeadiately, which was up in the back ground, even though ST was still giving messages, Task Manager stayed up. I found the numeric dll process and ended it, then I was able to get into her system menu to restore to an earlier checkpoint. I installed malwarebytes on my computer via flash and transferred to her via flash, allowed it to update and it ran great, it is running now, and working like it did before the virus. Maybe this helps, It did for me.
@Philly Keith
What a pain! Philly Keith is exactly right!!!!!! Make sure to go to tools and and unhide all hidden folders because mine was hidden at first inside all users! thank youuu
A couple months ago I purchased Spyware Doctor onto my computer but somehow it is not getting rid of this “Security Tool” that has been popping up the last few days. (As someone suggested above) I was able to delete a couple of folders with an 8 digit name but one remains unable to be removed. Anyway i’m doing all the possible scans on Spyware Doctor yet it still is not removing this darned Security Tool. what to do? what to do?…
Pls help me..
I have downloaded Malwarebytes until I can’t open this file bcoz security tool blok my desktop icons and I get just black background. when I open Malwarebytes from document, I can see just malware icon but, I can’t run this..
How can I do?
This can happen if there are another infected PC in your network or you visit infected websites, Linda
Nina : Have you updated Spyware Doctor? This is weird, because I am possitive that Spyware Doctor removes most of the versions of Security tool. Try doing update (in safe mode with networking) and performing full scan.
Emily: Malwarebytes is blocked by Security Tool. You need to either try different removers or disable the Security tool manually.
@Philly Keith
i search but i g0tz many f0lderz wut d0 i delete???it driving me nuts
i just got this what do i do to get rid of it
I got this stupid security tool thing, too and was at my wits end trying to get rid of it. Believe me, I am not a savvy computer user, just a 67 yr. old grandma so if I can get rid of it, you can, too. I truly had to shut down my computer by hand as the Sec. Tool wouldn’t even let me close it down normally. Once it started booting up, I just kept clicking control/alt/del until the list of processes appeared. I searched for the one which had 8 numbers in it (hides the Sec. Tool app.) and clicked to remove it. Bingo! Worked like a charm and it’s now gone.
@Randy
thanks for the tip on ctrl alt delete when its starting up!!! i couldnt access anything bc this stupid thing would prevent anything from opening. so getting it to stop in the set up before it was running helped at least to get into a program and online. so now im going thru one of the free spyware thats supposed to catch this one. wish me luck!
i just got this stupid virus like 8 hours ago.
im in C:/Users/Linda, but i cant seem to find App Data. nor i can find the file in C:/Program Files/. please help. im very new at this stuff..
Linda : Go to folder options and choose show hidden/system files. Or you can write app data in the address bar of your explorer
i recently got this shit on my comp. i followed everything but the only problem now is that when i open firefox, explorer etc it all runs really really slow! i’ve been scanning my computer every hour and its getting really irritating anyone can help me with this?
Thanks to all the helpful hints in this thread I was able to remove Security Tool but now my computer is REALLY slow. Any advice to bring it back up to what it was before? Thanks in advance
What i did was restarted my system and wile it was starting up in windows i pressed Alt+Ctrl+Del and stopped the service. It was under some Number 364…. I just stopped that and after that i was able to run a normal Cleaning program. Try that.
Got this on my PC today, here is what I did:
(I use vista)
Somwhow it downloaded itself from a website (laaame)
And it tried to launch “CMD” several times, but vista will block any action (first time im greatfull for it)
So I disabled my internet connection, then I restarted my computer (removing the power) restarted in safemode, followed the shortcut on my desktop (SecurityTools) and it led me to the .exe which I deleted and now im letting AVG do a linescan before I restart my pc normaly.
Seems to be gone so far
omg liike the system security has like tooootally crashed my new laptop…cus liike first i was online and then the system tool popup came up and i accidently clicked ok and it downloaded a bunch of crap on my pc and like now i cant get on to itunes or anything else!!!!..this thing is really pissing me off i tried using the instructions on how to remove it but likeee…i dont wanna download anything else cus im scared ill jst break it some more….i meaan like really im like a teenager….I NEED MY COMPUTER!!
Ray : do a follow-up scan with updated spyware doctor. Also, check the proxy server.
My cumputer was infected with Security Tool virus. I have followed this guide:
How to manually remove Security Tool Virus
1.Stop Security Tool Processes: [random numbers].exe
2.Remove Security Tool Files
3.C:\Documents and Settings\All Users\Application Data\[random numbers]\
4.C:\Documents and Settings\All Users\Application Data\[random numbers]\[random numbers].exe
5.Remove Security Tool Registry Keys
*HKEY_CURRENT_USER\Software\Security Tool
*HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Tool
6.Remove Security Tool Startup Entry: [random numbers].exe
And it seems to work okay, no sign of Security tool or other popups.
I have one problem left and it is my google search that doesn´t work. If I search for a word in google, it just like freeze and goes no where.
I dont no if this problem relates to security tool, but it started after i had the virus installed.
I hope someone can help me!
Oh thank you SO, SO, SO, SO much! I spent the last two hours in a fret over this horrible, nasty, headache riddled program. It would NOT let me boot up in safe mode. I used CTRL/ALT/DEL and ended the program which finally let me run the C:/Documents and Settings/all users/application data, deleted the file and emptied my recycle bin. This took care of it!
Per : disable proxy server and empty your hosts file. Also, do a follow up scan with spyware doctor to make sure there are no additional parasites left.
hi just woundering how to get rid of this stupid thing its on my laptop i dont no how to get rid of it permanintly can you help if so can you explain it in really simple terms as i am not that good with computers thanks
C:\Winsows\System32\config\systemprofile\Start Manu\Programs
I found another one there. o.o
what i did is Restarted my computer quickly did ctrl+alt+del ( task Manager)
Removed stranger numbered or named exes ( that i have never seen before )
then quickly removed security tool on desktop
then removed 1 in
C:\Documents and settings\all users\ application data
numbered folder
and in C:\Windows\System32\config\systemprofile\Start Manu\Programs
and in Start> All programs on the last list . I remived Securuty tool again.
That makes 4 Security tools files installed.
By the way i’m not familiar with the other exes in Task manager:
SSSheduler.exe
Siszyd32.exe ( i alse see it in Satart up in all praograms [ Start.All Programs)
any 32 numbered exes ;o are they bad?
Thanks it worked to delete my host files in c: Windows_directory\system32\drivers\etc\hosts
My google search works again
I need help!
My school’s computer is infected with the virus!
It almost totally crashed!
The computer can only start internet explorer and documents!
thanx guys it really worked for me. delete the 8digit folder.
I’ve successfully removed the security tool virus using the tutorial on UTUBE and Anti-Malware software. However, when I try to do a search on Internet Explorer, I get a blank page. If I have a bookmark, it will bring me there and display correctly, but if I do a new search a get a blank page. I’ve tried reseting I.E. I’ve tried reinstalling I.E. I’ve tried installing Firefox. No change. I’ve run Spyware Doctor and it says I’m clean. Please advise.
Just wanted to say thanks to everyone who posted you were not only helpful but some provided comic relief which was very much needed.
Ocie : Check Your proxy server and hosts file. this might cause the problem.
@admin
Could you please elaborate? Where is the proxy and host file located and should I just delete them?
this is annoying me. i thought it was a bit suspicious and am glad i looked it up on the net,now i just have to remove this shit.
@Philly Keith
how do you browse on a laptop when in safe mode networking
Was called this evening by a client. They were infected by Security Tool. Could not get online and their desktop was jacked. I began by starting his Windows XP machine in safe mode. From there I ran CMD and disabled ALL his Services and Start Up items. I then renamed his most recently modified files in Windows/System32/config (with old as the extension, not all modified files let me rename them.) After doing that I back to Windows and opened C:\Documents and Settings\All Users\Application Data (unhide files!) and deleted two numerical files. We shut down his computer and then logged in normally. Things appear normal for now but I will check his computer again in a day or two. His desktop icons are back and he is able to get online once again. Needless to say I think that these people should be hit by a massive ‘Technical malfunction’ and their Servers be akin to a McDonald french fry, Fried Long and Hard!!!
@ralph durden
ralph: how do i get to C:\documents and settings??
Here’s my story how to get and get rid of Security tool, if you can start in Safe mode (If you just want to know how to lose it, skip down to 20 🙂 )
1 Download zip folder Zuma deluxe from your torrentz supplier of choice
2 Open and click on anything that looks like install.exe
3 Play Zuma
4 Go to sleep
5 Wake up and find your computer taken over by aliens
6 Try to fix it your self
6 Try to fix it your self
6 Try to fix it your self
9 Call friends and follow their advice
10 Find this site and follow all advices here
11 Still find your computer taken over by aliens
12 Go to your local drugstore and buy a huge amount of alcohol
13 Drink
14 Pass out in front of computer, angry
15 Wake up on floor in front of computer
16 Puke on your spouse’s clothes
17 Argue with your spouse
18 Kiss and make up, have wonderful hangover/make up sex
19 Find new solutions
20 Start your pc in safe mode with network
21 Go to housecall.trendmicro.com and download Housecall
22 Follow instructions
23 Wait for scanning result (in my case, 4 hours)
24 Restart, nervously
25 Heureka! No more Security tool!
26 Clean up some leftover files like C:\Documents and settings\all users\ application data and other good adviced places recommended above in this thread (I also deleted Zuma and all of it’s content)
27 For security, I re-installed Firefox, Msn, Msn live and other programmes using straight up internet.
Good luck!
it blocks spyware how do i stop it i dont know how to do it manual im 12 god
security tool is destroying me
i just got this laptop and now i am considering another.
I’m not the best with computers and i dont no where to search for security tool files and how to delete them. the instructions don’t go in depth enough for someone with low computer training to follow.
A computer geek since 1958. How to prevent this infection:
Post a notice showing the Security scam page OR simply detailing what it looks like “Security Alert: You are infected with xxxxxx viruses”.
Action:
1. STOP IMMEDIATELY whatever you are doing. It is better to redo than try to remove this beast.
2. Disconnect physically from the internet by removing the CAT5 cable or power off the cable modem. This prevents sending an acknowledgment to the rogue server.
3. do one of these: Power off the PC (DO NOT do a shutdown)by pulling the power cord or turning the power supply OFF. (2) Turn off the power strip, if used. (3). Turn off the battery backup, if used.
Then power on the PC but leave the network cable disconnected.
Enter safe mode (F8) with networking.
Open Internet Explorer. Then open Tools/internet options/ remove cookies and temporary internet files.
Has worked every time for me and my users….
3.
@kody112
what cody112 recommended seems to work for us. I just to had to type in application data at end because we couldn’t find it. thanks cody112….
It will not let me start up in safe mode!!!!!! argh!!!
@Craig
hi all
my desk top was empty too, accidentally found that if you right click on the empty part of the tool bar it gives you the option of ‘display desktop’ it disappears periodically but you can just do it again to see icons again.
i started following your instructions, but now when i reboot it automatically goes to the pre-screen with SAFE MODE on it. if i choose NORMALLY BOOT nothing happens, all other options start scanning driver files and get stuck on:
windows\system32\DRIVERS\isapnp.sys
what i’ve read is that i need to run a restore from the boot disc, but this is a netbook w/o a drive. any ideas before i have to turn to external/networked drive?
thanks.
I’m gonna SNAP. Idk how this stupid thing got on my laptop but I cannot get it off. I went into program files and deleted the numeric file in the security tool file and all the icons blah blah blah and then restarted this thing and it’s STILL here. I cannot open task manager. I have no idea what I’m doing. Can someone please explain in english??
1) Reboot in safe mode
then what??….
So I didn’t mean to click on the subscribe button or whatever it was I clicked. That’s what i get for not paying much attention. I am in safe mode right now with network connections. When I go back to the regular settings I can’t get into anything. Not even task manager to shut anything down. Everytime I Ctrl+Alt+Delete and choose task manager it flashes on the screen for a second like it’s trying real hard to start but then goes away. While I am in safe mode there are no security tool processes or applications running or at least I can’t find any of them, maybe I’m looking in the wrong places. As for renaming the files I haven’t tried but I couldn’t rename anything in normal mode if I wanted to, and if I rename it in safemode will the changes carry to normal mode when I restart? Thanks so much!!
my wifes pc has this freaking virus. i run avast virus w/spybot, and windows defender. when the pc boots up, all that crap comes up. using task mgr, i noticed another window open, i used alt tab to cycle thru the windows, low and behold, windows defender found the threat and allowed me to remove all (uh huh), so, rebooted, same ole. but now i have the knoweldge to let WD shut down the sw which allows/ed the removal via the method above (manual) some of the entries, etc weren’t on the system, but most were. good luck to you..
Renae: If you rename something in safe mode, it will stay renamed in normal.
To start task manager, try hitting ctrl+shift+esc right after logging in in windows. Security tool might be not active then and will not close task manager.
security tool interruption has delayed the completion of my grandchildren’s homework assignments. Really don’t appreciate that!!!!!
I have not gotten rid of Security Tool yet, but what has helped me, so I can get in and out of programs without being over ridden by Security Tool is stopping the computer and installing the Drivers and Utilities disc that came with my computer (leave it until you find the answer). You will still get popups, but you can over ride them.
i cant believe i got this too – i did the ctl+alt thingy but cant fnd the next step:- 2. Delete security tool files (see under files in our guide)
can you please point me in the right direction
…but so far i go tno pop ups thank god!!!
thanks for this guide guys!!!!
Philly Keith’s way of deleting Security Tool works beautifully: it’s fast, easy, and gets rid of it in minutes. One thing that was differnt I went to look for application data in documents and settings, but it was not there. For people who encountered the same problem is easily remedied if you go to the start menu and type in the address Philly Keith had put in: C:\documents and settings/ all users/ application data
where do i type that c:\documents and settings thingy
Por fabor remuevan su oferta de mi computer ya que esta bloqueada y no me deja trabajar por esto les p[ido que remuevan su inicio de instalacion porque no lo quiero Gracias
@Pierre
so what do you do after you type it in?
I got a new laptop for christmas, and now Security Tool has started saying I have loads of trojans and viruses. It keeps saying stuff about: vdsldr.exe and stealing credit details or something whenever I’m doing nothing. I just want a completly FREE remover of Security Tool, because this ‘Spyware Doctor’ still makes you pay money to remove the stuff…For god’s sake…Just please can somebody just help me. GOD DAMMIT! I CAN’T DO ANYTHING!!! FFS!
Ape : Try manual instructions.
My sons laptop has just been infected with security tool, spent all aftrenoon trying to get rid of it. in the end i tryed systerm restore which took the systerm back 2 days and somehow it worked. all runing ok now. very easy to do and i cant beleve it worked. i hope this help someone.
hey David, I got rid of security tool on my pc by 1st rebooting your computer, pressing F8 as the computer starts back up BEFORE the windows screen with the blue loading bar begins. then scroll to SAFE MODE.Then press enter. when your normal screen pops up, click on the start menu, then control options. double click on file options, it should be on your left in the first row. scroll down and click show hidden files and folders, click apply, then ok. Right click on start menu, click explore, click on documents and settings, All Users, the first file on the list should show 8 digits. this is the file you want to delete.right click on it, click delete, it should disappear right away. then reboot in normal mode, and download a free antivirus to find and uninstall security tool or manually do it from your files.
@kevin
My BackGround On My Laptop Goes Black And No Icons..?
Thanks for all the good infos. In my case, in safe mode there was no process running. All I had to do is to delete files and entries in the registry named “94754837” and shortcuts to Security Tool. I ran CCleaner after to remove remaining spyware traces.
I would just like to repeat Ben’s message above … i used that method successfully …a bit of searching but pretty straight forward
MANY MANY thanks to u guys and gals who contributed
people, help me! my laptop worsen. my folder option is missing, my task manager has been disable, cant do system restore, cant boot in the safe mode. when i choose to boot in safe mode windows will turn back to the safe mode screen again and again till i still have to chose start windows normally. i follow the step above, but i cant do anything. people help me. 🙁
i have 2 diff. kinds of security tool warning popping up on my lap top how do i get this off i have tried alot of stuff .. dont want to spend money that i dont have to get it fixed..
what do you mean when you said stop all numerical processes?
Kara: processes like 23623623 , 7437346 etc.
had security tool on laptop with windows 7. spydoctor said it removed it. when i rebooted still there. I then right clicked on security tool shortcut went to target file in the open folder location then deleted it. it said C:program data 71113244 not C:\documents… before rebooting ran spy doctor it did not find the virus. rebooted with no problem. I did notice that while trouble shooting the virus seemed to counteract whatever i did. I was able to get into safemode at first then i was blocked.
thank you so much for the information guys, angel you got the best way to remove the security tool virus. thanks thanks so much
Security Tool totally ruined my computer! Now I can’t open Word or task manager or any program. Please help me!
crewchiefvh60 : Do you have a firewall? I would guess it is either an infected computer on your network OR a new rootkit/trojan that redownload security tool. Do following :
1. Delete your internet cache in your browser.
2. Scan with spyware doctor again, do a full scan (not fast one)
3. without reboot, scan with some other anti-malware ( malwarebytes is ok, superantispyware, etc).
4. Reboot.
HELP!!!! I have Vista, I had Security Tool virus.Thanks to #248 King Timmy,I was able to get removed. Then I ran my BObit Security 360 & clean programs & cleaned the registry & files. I had disconnected my AirCard(wireless) while I was doing this. I got a new AirCard from Sprint Mobile. We’ve spent two days trying to get connected. I have turned off security programs & firewall but cann’t connect to internet.Get error ” wizard cann’t connect to internet” Did I turn off IE some way??? PLEASE HELP!!!
Please HELP!!!!! I have a desktop with Vista. I had Security tool virus but thanks to KingTimmy #248 his easy to read & understand directions,I got it removed. I ran IObit Security 360 & also cleaned the resitery. While I was doing this,I uninstalled & removed my mobile broadband to be sure it won’t sneak back in while I was working. After when I tryed to reinstall Mobile broadband it won’t work. I got a new AirCard & been working with Sprint. We disinabled the security program & firewall to be sure “Sprint SmartView” was getting in. But cann’i connect to IE,say’s “wizard cann’t connect to internet”
i don’t know what to do. i went on my face-book today, and Security tool just popped up and started ruining everything. I can’t do anything. I’m totally lost. i don’t even know where to start.
the security tool blacks out my background and eliminates the icons. it also disables many programs such as windows media, word, internet explorer, and even my antivirus program. what should i do?
admin. yes i have a firewall my wife got security tool from facebook pop-up. since removing it from the folder no more problems
Security tool is very annoying – wouldnt let me download any spyware programs.(not too mention annoying popups) If having this problem….when booting up computer press F8 and select safe mode with networking. You should be able to download spyware doctor or use windows defender to eliminate effects of security tool. A computer repair center wanted $150 to fix problem but i purchased spyware doctor for $29.95 and it fixed the problem within minutes. Simple and fast – Highly recommended!!!!
Katie : Do not use IOBit Security. They use a stolen database from other security manufacturer, so I would guess they are not too reliable on updates themselves.
Your website rocks. My sisters computer got security tool and I thought it was toast. Did philly’s version in safe mode and it worked. It wouldnt let me pull up recycle bin in safe mode, so after I deleted nos. I shut down/rebooted and deleted recycle bin after normal restart. It worked. Thank you for having a site like this.
I got Security Tool on my laptop yesterday and I’m tryin Keith’s idea I have windows 7, When i try to browes my documents and settings folder is locked any ideas. Please if anyone can help. Thanks
I too was picked up the “Security Tool” virus. I installed Kaspersky Internet Security 2010, and it rid my laptop of the menace,
@Philly Keith
You are the man!!!…Thanks so much. Your instructions was right on. Didn’t have to download anything. I just followed your instructions. Had two set of 8 digit random numbers attached to a folder. I Deleted them and I am as happy as can be. Been at this now for three hours. I am praying it holds. Thanks.
@kody112
thanks my pc stock 3 months ago for having this bad boy virus, and suddenly i found your post which i follow your instruction and it works… well done to you guys, as well as philly, good job….
reboot in safe mode -when restart your pc press f8 continously
when already in safe mode, right click the security tool icon, find target or open folder then delete, then empty recycle bin
I had to tackle this last night. I wanted to say two things: first, several other sites recommended that after you enter safe mode, to go to System Restore and turn it off until after the virus is removed. This makes sure the virus is not saved in a restore point in case you need to go back later on. Secondly, if you use Malwarebytes Anti-Malware (I did and it worked great), you NEED to update it in order to catch Security Tools. Make sure you are running in Safe Mode with Networking, and if you are running on a laptop, your WiFi will be disabled in Safe Mode, so plug it directly into the router. Hope that helps! We ended up with 6 other trojans as well as Security Tools, so be on the lookout.
@kody112
Everyone listen to kody112 instructions. This virus plagued my computer and was driving me abolutely nuts. I tried everything, was ready to buy a program to rid my laptop of it, take it to a professional at the tune of $200.00. Kody 112’s suggestions were easy and it worked in a flash. Thank you kody112. you saved my day….My hero.!!!!!
After getting this virus, my computer will not reboot at all. I’ve tried rebooting it in safe mode, etc and it lists a bunch of files to halfway down the screen and then freezes. Is there anything I can do?
Angela : repair instalation with rescue disk. If you can’t or it will not help, you will have to bring PC to techs or backup data on another pc and reinstal windows.
So glad I found this site. My computer became infected a few days ago. Followed kody112 instructionS above which got rid of it entirely. THANKS SO MUCH!
@Philly Keith…thank you so much for the info…it worked on my vista^^, …thanks to this site as well…more power y’all ^^,
@ATL Thanks so much ATL this worked so good for me I got this fuking mess by watching music videos in yahoo I spended a good 8 hours trying to fix it till i found your advice, my god what a relief u rock, thank you, thank you, thank you. my computer is nice clean and working in full capacity yea once I deleted all those folders with the numbers and started my computer the only thing left over was a icon in my screen I inmidiatly sended that sucker into the ricycle bin and emtied jaja yeaaa. put my screen picture back and good to go. jaja how you like me now mr. security tool,kizz my ss.
I am so tired of this security tool thing because it itself is a tool. I want it off of my computer NOW!!!!!!!!!!!!!!!!!!!!! Can someone please help me get this off my computer… It is not allowing my to use my magic jack and it wont let me access my files for school… I have downloaded spy ware doctor and that didnt work and I dont have a credit card so i am screwed there. I need some answers.. I cant afford some fancy puter cleaning system or any house calls… Please help!!!!
I tried to do the process of removing Security Tool but I only went to the stopping the numerical processes part. Should I just skip that step and move onto removing Security Tool files?
the stupid security tool thing want let me do anything on my computer and my mom and i have no clue how it even got on our computer!!!!
i have this damn security tool on my cp i want it off
THX ALOT DUDE!
i had real trouble dealing with that motha phacking stupid virus thing, thanx alot again!!! 😀
I’m not really sure how it works, I downloaded the intelliscan, but I still have a lot of infections, how do I get rid of them? And, security tool goes away each time I scan, but when I didnt scan it, it stayed there, so how am I just entiltled to scan each time I log in to the computer? And how do you remove files?
I hope I’m not past the point of saving, but my laptop won’t even boot-up. I’m running vista, and I get to the point where it says “Resuming Windows” and then no more picture. I tried putting my reinstallation disk in but it doesn’t help.
Any advice?
I with this Heather girl(woman)! These security tool people need to be shot!!!!! Quit screwing with people. This has to be one of the most inconsiderate things I have ever seen! I also can’t afford to have my computer fixed. Please send help this way too!!!!!!!
Hello,
I just recieved security tool several days ago and it has been driving me nuts everr sincee. Is there a FREE download that knocks it off of the computer? Because the information you provided is not quite working with my computer or I should say I dont understand it. Can you please write back to me a FREE recommended download that will not only kill security tool but will also not slow down my computer. I would appreciate it.
THANK YOU! 🙂
For my computer I used System Restore, wich you can acess by hitting the start button (which should still work), then going to all programs, then Accesories, then go down to system tools and you should find System Restore there.
I just got this today and it is now off of my laptop…this is what I did.
I restarted my comp….hit f8 right after the restart went into safe mode. Once logged into windows went to start….then to accessories and the to system restore. Restored to a date before this lame a$$ virus took over and wallllaaa! gone:) Hope it works for everyone!
I just got this spyware today and i removed it with the steps you gave to remove it. I also have a question, after removing this program is it going to affect my computer or take any passwords???? thank you for your help…..
This is hell but i recon i will just put a fresh install of windows 7 on my pc but atm malwayre bytes its workin what i did was go into safe mode and i deleted all u needed files and programs then ran 10 antivirus full scan all findin different things then using malwayre bytes in normal mode and hoping for this to work,,,,,,
this thing wont let me do anything.. it has shut down my computer like 5 times now. its soooo annoying.
kristal-Thank you so much!!!!!
Picked up this virus on our home computer last night. After spending a couple of hours trying to deal with it I found this site and worked through using system restre. I am running Windows 7 and it looks like we are good. Thanks for the help in working through this. Responsible parties for this virus should be SHOT!
@Jimmy Lim
I have Windows 7 and tried your suggestion, but it won’t delete because it says it is open, so how do I close it??
@kristal
yeah,but on some computers like mine don’t create restore points or whatever it was called to restart the computer to.
How do I get this off my computer I have a emachine it is driving me crazy. Help
@Philly Keith
Thank you Philly Keith, after a very frustrating day, this worked for me.
Thank you so much Philly Keith, my daughter called and was going nuts over this for hours and I came along this site to see what we can do and you saved us. Bless you and thank you so very much!
Security Tool isn’t letting me onto anything without popups for their system and everything! Its driving me inasane! And it hacked into my personal documents, saw how much I loved Germany, and now all my warnings and popups are in German! Oh, and it went ahead and deleted all my icon things on my screensaver, and it deleted my screensaver! Now its just all black! Help me, please!
This realy helped i couldnt go to seconds without security tool poping up! i dont see why these hakers need to mess up ur computer it can cause the person being hacked alot of trouble. I realy hate when stuff like this happens. This happened to me befor with a program called MaCatte it was tring to descise its self as MacAffee. Thankyou for the help i appreiciated ALOT!!!!
I can’t thank you enough for getting rid of this worm. I couldn’t have done it without you.
i got rid of security tool i think,i don’t know anything about computers, i read alot of remedies online to get rid of it but kept getting more confused. i went to safe mode pressing F8. i right clicked the security tool icon, went to properties and it showed the target file and name of the file i clicked “find target” and a 7 or 8 digit file popped up with the damn security tool logo with that same 7 or 8 digits next to it, i deleted it and booted up normally and it never popped back up i went back and forth from safe mode to normal…. nothing,i deleted the icon and i think that’s it. I’M A HAPPY MOTHERF…..!!!!!!hope someone else tries this, goodluck.
what workeddddddddddddd? do tell me im going nuts 🙁
I had the same virus. What a pain. I started up in safe mode (F8) then clicked on restore. I choose a date earlier than the date the virus took hold.
This worked for me I am running windows 7
I sure hope this works and gets rid of security tool virus
okay this is the most annoying virus ever. i downloaded like 50 things to help but absolutley nothing is working. please help me step by step i don’t get how to remove it and im going insane
Thanks for all the advice to get rid of this pest.
Philly Keith’s method hits the nail on the head. Also, someone advised to hit “ALT/CTRL/DEL” keys twice to bring up TASK MGR (under PROCESSES) and then END the 8 digit numeric process to get temporary stop Security Tool. This worked and gave me back control of my PC.
I fortunately had the Free version of SuperAntiVirus on my system (Win XP) and was able to run a scan and it detected & deleted 23 infections and fixed. There were several files with the 8 digit numeric names in “documents and settings”.
I would recommend the SuperAntiVirus Free version, even though it did Not prevent Security Tool infection it got rid of it.
Philly Bud
I’ve just got rid after hours of stress……
1) ctrl/alt/tab whilst booting to bring up task manager before security tool loads.
2) Goto processes tab and find the process that is made of numbers and has about 10-15 processes going, select this and end process.
3) Goto system restore (start-all programs-accessories-system tools- system restore) and follow the steps to restore to when you like. (I went 3 days!!)
Worked for me, good luck!!!
@widdywool
hi , im on window 7 too and when i press (F8) it doesn’t do anything :/
please help ! 🙁
i had the sam prblem but i reboted my pc and prest F8 emidetly
ven i did that i reinstald my software so ewry ting on my harddriwe vas delited
its a good opsin but you will lose all your work music and game files
@Philly Keith
tried rebooting in safe mode and every time i do i am not allowed to scroll through the options to get to safe mode and am just kicked back to regular mode anyone have any suggestions?
@lisa
Amen 2 that!!! this thing is DRIVING ME FN MAD CRAZY!!!! I am going crazy 4 real!! The person who created this should b found & punished 2 the max!!!
@Philly Keith
Thank you sooo much it worked i love you man!
i have tried eveything!!!!this is driving me nuts!
can someone simply walk me thur doing this in safemode.i dont know how to do that!please help”{
Philly Keith you are a star. Thanks a lot. This thing was getting really irritating and would not let me delete in normal mode. I totally agree with blue carbunkle.I hope the creator of this program rots in hell. I also hope they crap in their pants for a whole year and have chilli rubbed on their private parts followed by lemon juice for extra burn sensation.
this works im only a kid and i figured out how to get rid of it
@Philly Keith
Just removed SECURITY TOOL spyware from my windows xp computer. For non tech savvy user I stumbled through the directions and removed the virus in less than 30 minutes. I spent hours researching all the tech options I found on the internet and chose Philly Keiths methods based upon favorable replies I found from users on this forum. This is the second time I have been hit with similar spyware. The first time I was tricked into purchasing a non workable spyware program. Cost me $75.00 to clean up my computer. Beware the SECURITY TOOL spyware looks so very much like the legitimate AVG spyware program I have installed on my computer, I almost fell for it. The cavet was the fake security messages would not let me exit the screen or removed the messages from the screen. I had legitimate secirity programs installed on my computer; AVG free, Spybot search & contol & Malewarebytes-anti maleware and still got the virus. Plaudits to Phlly Keith and this website – LIFE SAVER!
hell men i dont no how to remove it
@admin
avast does work if u can get it on ur computer before security tool pops up. I have it (avast) on the computer I am using now and doing pretty good job so far…, but didn’t hjave avast on the other computer and have security tool and now I can’t get logged on to take my pix off:( Help anyone????
Lisa : Use manual removal instructions to stop Security tool processes. Also, you will have better result with any tool that targets malwares/spyware rogues than generic antivirus like avast.
I had problems with “security tool” as well, it took me hours to fix but what finally worked for me was ending numerical processes under task manager, doing a search for both any files with that number AND any files named “security tool” (this part allows you to delete the desktop shortcut as well,) and emptying the recycle bin. Afterwards I used AVG free version to delete anything I may have missed, after that a reboot and everything was fine, my desktop was back to normal and all the annoying pop ups gone. I attempted Spyware Doctor first but I would not recommend it to anyone because although the free version will locate the malicious software you must first purchase the premium version for it to quarantine/delete the problematic files.
I’ve got this security tool thing. and as everybody else trying to deleted file, I did same..
ofcourse don’t let me deleted. so I unplug from internet ( sine virus come through internet) while internet not connected,I clearn up all file everythings while internet is deseable.. and by chance it all cearn up…
but I was allmost singe up my credit card etc..for just wanted over it..and my question is since they correct money though credit card…can we trace back them…? I know it’s not easy things as I thought..but somebody have to correct money from acount…so hope they go jail or get punish very long time!
I cannot find the specified files needed to remove this Security Tool….I’ve tried everything and I still cannot find what I need to remove it.
Hello everyone here
I’ve recently been hit by Security Tool. i readed most things on the website like all of you[most of you] it didn’t work so i devised my own cure for my pc by reading some of the usefull info on here i added it to my own remedy which was get the tastbar up a second after i’ved logged in then deleted the proccessort and after it literaly nothing else worked so what i did was use the deletion of the security tool which keeps the security tool maintained untill you relog again then used the SYSTEM RESTORE to restore my pc to a date when i didnt have this sickenen virus that plagued me. Thank you all.
Hi i have a question admin does norton remove it at all?
Hello All,
I too fell victim to Security Tool earlier tonight. Like J Art above, I used the System Restore method to cure my PC. Although I couldn’t have done that without the suggestion to reboot in “safe mode”….that was the only way I was allowed to access System Restore. I then ran my McAfee full scan for good measure. Thanks to everyone for your useful suggestions…they really helped.
Jegan : best to my knowledge norton removes at least some of Security Tool versions. Though from experience can tell that not all. I am not a big fan of symantec, thus I use ESET Smart Security myself, which I can recommend for antivirus protection.
The problem is, anti-malware/spyware programs are MUCH better and faster in handling parasites like Security tool, thus such programs like Spyware Doctor with real time protection saves A LOT of headaches latter.
Thanks to the input of all. It happened on my daughter’s computer last night..probably something to do with a Google website she was on all day..watch out Google! After reading this I felt “qualified” (sort of ) to tacke it. indows 7 didn’t offer the same f8 or control-alt-delete options, so it came up with a start up recovery type option, or start windows normally. I selected the start up recovery place and in there were the old options of safe mode, command prompt etc. I tried the Command prompt and dos advice, but it wouldn’t cd (change directory) to the C: drive. There was the option to do a System Restore and fortunately we had a retore point from 1 day earlier, so I went with that–do a system restore–nothing much if anything was lost. And it seems as though there never was this thing at all. Definitely EASIER than I envisioned after reading all this on your site and elsewhere! Anyone know what agencies track these folks that do this kind of thing to all of us…if they got credit card payments from some people, surely they can be tracked by someone…I am very willing to report this if anyone knows who to tell??
@Frank
I was just wondering when do I find my six digit code for my Windowa XP laptop?
Why do people create this type of madnee?
Hello.
my laptop unfortunately got infected. After following the instructions found here, I have lost internet on the infected pc (not the one I’m writing from). Can this be caused by Security tool? I do not get the pop ups anymore, word is working fine but I don’t have internet access anymore!! Help!!
This virus completely destroyed my computer… When i had the computer on and it was working, but had security tools infecting it, i went to taskmanager and disabled it so i could use my computer without the interruptions. Later on i turn the computer off and when i turn it back on its just a black screen…. about 10 minutes later i am able to run the “Recovery System” under the choice of Operating System. This means all i am able to do is enter basic codes… and i have no clue how to do anything from that.
I want to find whoever created this so i can personally punch them in the face and sue them.
What the hell am i supposed to do now?
I removed by using tast manager when I rebooted. Could not open in Safe Mode. Security Tool was not listed, but a 93842228 number was. I ended that task and so far so good. So frustrating. It totally disabled my computer. Any thoughts as to where this came from? It believe I got it from AOL IM. Computer crawled after opening and soon after the pop ups started. I have uninstalled. Any thoughts?
@Mike Mike
Mike,
Thank you for your post. I was trying to follow Philly Keiths instructions but there was no application data file ????? Then I got to your post with the instructions to find it through run and I am free!!! Yeay!!
Thanks
Maria
Just an FYI…I usually use avast on my pc’s and I was downloading a new version to a laptop that didn’t have it yet when I got the security tool virus. So, be careful.
Philly Keith was absolutley on target. MY dughter had it on her laptop, I followed his instructions in Safe mode and restarted and bye bye!
man thank you all so much safe mode worked 4 me.thank you
Well I downloaded the Spyware Doctor and finished the scan, but then it says I have to purchase online?? Any help here because I thought the spyware was free?.
Nevermind, I’ve worked out how to delete the program now, thank you!!
Philly Keith- Great your method worked.I was able to reboot in the safe mode and delete the file.
Thanks
Thank you!!!
That was really irritating. Safe mode worked great!!! Back to Normal!!!
okay i got the tool of and if you wanna know how what i did was i turned my computer on and as soon as i got loged in i pres ctrl alt delete and the task manager and then when it pops up you go to process and find it it is in a 7 digit number name click it and end process it says r u sure u wanna end process click yes (i most certainly do)then there you go you got it off
I found a WAY EASIER WAY to get rid of it. I had been struggling with this problem for a long time and these annoying popups kept frustruating me. Well, fist security tool has a shortcut on the desktop so you right-click it and click OPEN FILE LOCATION. Then, you just delete the file folder. Afterwards, you just go to the recycle bin and empty it all. Finally you go to the desktop and double click the security tool icon then a message will appear that states something similar to this: “This file has been permanently changed, removed or deleted. Do you wnat this shortcut to be deleted??” then you just press OK. THE END!!!!! i really really really really really really hope this helps a lot;) wink wink
I’m having this same exact problem. I’m dog sitting for a neighbor of my aunt’s. Was using their computer just fine this morning and then later in the day I somehow ended up with Security Tool installed on the computer. I was so nervous and worried about this I brought the laptop into the Geek Squad at Best Buy. Unfortunately they can’t do anything to fix the problem unless I pay $199.99 for them to get rid of Security Tool. I told the guy I don’t have that kind of money to fix the problem. Although when I asked about finding a solution online he said I should google instructions on how to fix it myself. Other than that bit of information they can’t saying anything else or they would be performing a service. I’ve looked online for solutions and found some, but I don’t want to download anything to remove security tool. Not sure I’m confident enough to do a manual removal of the items listed further up on this page. I tried to do system restore but the damn security tool thing wouldn’t let me fix the problem that way. Does anyone out there have some idiot proof ways to get rid of this? I don’t want to have to explain to the people what happened and what Best Buy said. I just know that it would get back to my aunt who lives a few houses away and then it’ll get back to my mother(who I live with). I don’t need to be reemed out for messing up the computer. I always do my best to not mess with anything when using someone else’s computer for email, etc… Wish I could go back to this morning before I even used the computer. Hell I even wished my ipod touch would connect to a network, then I wouldn’t have had to deal with this security tool crap. Sorry for the long submission, but it kind of also gave me a chance to vent my frustration.
@Jessica
Dear Jessica,
I wish to thank you for suggesting a simple way to get of Security Tool from a computer. I was able to follow the way you went about it and it solved my problem. Just to make sure it truly worked I shut down the computer and then rebooted it. Absolutely none of the Security Tool stuf was on the computer. This makes me very very happy and also gets rid of the sick feeling I had in my stomach since yesterday. I assume when you had to get rid of it on your computer you did it in safe mode(it’s how I did it)? Thanks again!
I have been struggling for the past 24 hours to remove this virus. The 10/9/09 post from Philly Keith worked like a charm. My application data file didn’t come up as mentioned, but I did a file search and found it that way.
@Philly Keith
If you have newer versions of Windows ie. Windows 7, instead of browsing in documents and settings… like philly keith recommends, you need to look in ProgramData instead.
@Philly Keith
Keith, my husband and I want to thankyou, we have been working on our computer for four days and followed your instructions and it was gone in seconds. We appreciate you giving this information, in times like this you can’t afford to go out there and buy,buy,buy. Keith you saved us alot, thankyou again.
Many thanks to you Philly Keith! This BOGUS security tool was removed just as you instructed!
I have windows 2007 and those extensions you mention are not the same. How do i locate the numeric file?
How do I find program data?
Philly Keith,
You saved my ass man. I owe you BIG TIME!!!
Johnny
Under my registry, I had to delete any key with the following number: 96901328. Didn’t find any with the aforementioned 4946550101. Maybe that will help someone?
I just got this stupid thig last night! I don’t know anything about this crazy computer stuff so none of this makes any sence to me 🙁 I figured out where to find the system restore but it won’t let me open it, it won’t let me open anything at all. I can get on to the internet but that’s about it! Is there any way to explain how to fix this that I would understand? (like you are explaining somthing to a 5 year old) because that’s about all I will understand :'(. This is so frustrating…
This is a bad virus it has a new file number on my pc 05316823 I send the file to my Documents and then burn it to a DVD and it remove the virus. My pc is working ok. It was a all day project to remove. What a pain in the A@##
FYI I hope this works for all of you. I will give update 3/11/10
If my pc is working ok.
@Philly Keith
Hey thanks a million Philly Keith – actually thought I was going to lose my mind. Not just that but it got downloaded to a work laptop – shudder to think of the consequences of calling the I.T Helpdesk.
If it’s any help at all if you reboot in safe mode and then right click on the desktop icon it can direct you straight to the source file and you can delete it from there.
Thanks again mate – hate these tossers that peddle this kind of sh*t – hardly in the spirit of www is it?
My pc is still working well
just wanted to say thank you to this guy. we got a new computer today and managed to get this virus straight away. really panicking but your advice did the job. a huge thank you, this is a horrible virus
just wanted to add that was philly keiths advice we followed that did the job. thanks
Hey,
Please, help! I don’t see any numbers in task manager…. I don’t know what can I do…..
Thanks so much for the comment – Philly Keith you were a lifesaver!
IDK IF I CAN TRUSR ANY OF YOU GUYS FOR ALL I KNOW IS YOU ALL CAN BE SECURITY TOOL VIRUSES I COULD BE 1 TO YOU GUYS 2 (I’M NOT) JUST GO BUY A ANTISPYWARE FROM A STORE AND USE IT IT MIGHT WORK. I MEAN WHAT IF THIS WEBSITE IS A VIRUS EVER THOUGHT OF THAT COME PEOPLE THINK BUT I AM ON THE SAME SITE SO PEACE IM OUT U GUYS DISCUSS THIS PROBLEM YOU HAVE OR WHATEVER YOU VIRUSES TALK ABOUT.
I follow the steps on this website and it got rid of it… im not sure if my computer is still infected but i can at least opperate like i did before i was infected. im not going to try and credit cards on here for a while just incase.
Philly Keith’s method foiled security tool for me too!! If anyone knows if the rat bastards who created security tool are behind bars please post it would make my day!
i cant start windows normally
hey this thing is horrible. im trying philly keith’s method (thank you)
but im having trouble browsing to C:\Documents and settings\all users\ application data..
im not sure how to do it ? do i type it in my search engine ?
im not too good with computers so if any one could help, that would be awesome !
thank you !
Never mind that last comment of mine !
@Glengarry 76 ‘s comment helped me !! Thanks to both of you, it is really greatly appreciated.
thank you so so so much!
Our computer got hit with Security Tool this weekend. I used Windows Defender’s Software Explorer and found the file for it; under “currently running programs,” I hit “end process,” and under “start up programs,” I hit “disable.” I deleted the short cut and emptied the recycle bin. I don’t know much about computers, and this is the first time we caught a virus, but it seems like what I did is similar to the method described here to get rid of Security Tool. I cannot find the file for the virus now using either the safe mode start or the Task Manager method described here and apparently have no remaining effects from the virus. I have scanned my computer with my existing anti-virus software and new ones I just downloaded, including Spyware Doctor, and no scan has found Security Tool. Even though it seems like I got rid of the virus, I still have some reservations and am reluctant to doing anything like banking or billpay online. I would appreciate any input as to whether the method I used to get rid of the virus is a good one or should I be concerned that it is still lurking about on my computer. Also, I have the regkey for the file for Security Tool but don’t know how to go about checking my computer’s registry for it. Again, any advice is greatly appreciated. Thanks!
This Dam thing is put on your computer by Mcafee .Belive it they told me to get rid of pay 89.00 and they have something to get rid of it. when it shouldnt have been able to get on my computer
@blue carbuncle I’m with you all the way!
Tiz security tool stuff appears on my screen tiz mrning..n i cnt b able to excess to any folders..so,how i get rid of tiz?it is asking me to pay $79.90 to get rid of it..im using McAfee instead..n i dun tink im hv tat much of virus in my pc..
This freakn sucks. I cant even restore it now. My icons dont show up at all. I tried to download spyware, but it wont let me get to it. I think its different and smarter. If thats possible.
Someone help. I cant afford to pay for anything. Is there something I can do.
I fan find the file but when i go to move to recycle bin it says i dont have authorization…
what in the world are you guys all trying to do , all i did was do a system restore using my windows installation cd as a boot device, okay it took a while for the system restore screen to pop up …. if it doesn’t, try clicking another option and it’ll pop up … but it’s simple & it worked & that’s what really matters
I think I actually made it go away thanks to these intsructions 😀 So thank you very much for the help!
how do i detele it??? it is messing up my laptop!!!
helpp???
I got this on my Win7 laptop despite using recent versions and updates of IE/Firefox. I am a savvy computer user; even work in IT support, and no one except me has ever touched or used the computer. I didn’t approve for any malicious code to execute so I think this found its way in through some web browser security hole.
There are recent versions of this that seem even worse than the ones mentioned in this discussion. Personally I tried automatic removers, Vipre/Norton/AVG, Windows Defender, renaming/deleting the file, cleaning away the mentioned registry keys. Keep coming back. Safe mode does not work and just ends up with a hang.
So now I opted for formatting the computer completely, and this is what I think everyone who has gotten infected and care for their personal data should do too. Once compromised always compromised, in a way.
I mean, people … those who wrote this program aren’t some script kiddies but HIGHLY PROFESSIONAL CRIMINALS. They are after your money and have likely NO sympathy whatsoever, fully at the same level as violent bank robbers. Backdoors might have been opened in your computer via rootkits or whatever. These criminals are NOT likely to show any mercy if they come over data or files which can be used to blackmail or otherwise use you.
I got this virus the other day on a brand new computer running Windows 7 with a wireless keyboard – it was a pain initially but I watched the security tool removal video and followed the instructions and removed it effortlessly in about 5 mins. Despite having the wireless keyboard I could still get into safemode with networking using F8 after numerous attempts. Don’t be put off getting rid of it yourself and don’t waste money on lots of malware programs – you don’t need them.
Thank you! Your directions worked completely and quickly. Incredible solution!
I must say the manuel removel worked like a charm- thanks you soo much- worked in 5 minutes-Wonderful
after one week of nerve wracking experience with this virus, i finally have it removed…i tried everything based on the instructions of different people having this sort of problem but to no avail, probably i have the worst case here, thanks to my spanish journalist friend! she told me to create another user account, because vst virus is usually attached to the user account, so i did, when open the new user account, i didn’t encounter the virus, but just to make sure, i scanned my hard drives using malwarebytes and avast and found several viruses, after deleting the virus i reboot to my previous user account just to check if the virus is still there, thank GOD….finally, VST IS ALL GONE! hope this will work for you also….. thank you TERESA! HEAVEN SENT ANGEL.
if you have another computer ..
make shure is louded whith antivirus software.
I have AVAST, Malware, microsoft security essential
you have to remove your drive from your computer
using a SATA, IDE, ATA connector ( adapter )
you can find them at FRY’S electronics store
conect your disk to the computer
I recomend to use Windows vista
go to search and select the drive letter
that correspond to .. type Security Tool ..
and the system will give you a list of
whatever it might be locater
when finish searching select everything
that says security tool and delete them.
take your drive to your lap top
and load malwarebite avast update them and scan your comput
Oscar: yeah, right : most of security tool related trojans use random directory/file names…. Sadly you will not find them with search for “Security Tool”. There is also a problem with your approach : it will not fix registry problems, and, most likely, it will not fix hosts file or proxies and some other known configuration issues as these tools are designed to check configuration of WORKING system. That means your PC remains vulnerable to infection.
@Jessica
Thanks Jessica – Your fix worked for me. I was trying all the different processes and yours was much simpler – I now have my PC back!!!!!
hi,
i really dont get rid this security tool in my laptop and if im doing it right and also do i have to download thr spyware doctor or buy it????/
THanks so much that worked so easy!
gggrrrrrr!!! this security tool is anoying!! iv bin workin on it for 4day straight!!!
@Devin
HI devin, i dont really have the solution for your problem, but the security tool system is also in my dad’s computer, and even though he gets rid of it one time once you reboot it again it comes back, but i recomend you listen to philly keiths and Kody168 suggestions they really helped my dad;s computer.
try it its really good
@Ashley
hehe ..
yeah , same problem over here ..
unfortunately i don’t understand what application data means XDD
Im from Norway ..
i dont have a clue … about .. .where i should start looking for that security tool bullshit … so i can delete it ..
im in safe mode now ..
help anyone ?
Norwegian please XD
@Philly Keith
October 9th, 2009 at 21:04 | #15 Reply | Quote forget all that… try this move, it worked for me after going nuts over this for a whole day.
Reboot in safe mode0
browse to C:\Documents and settings\all users\ application data
There will be a folder in there that has eight numbers as a name (ex 91908431)
Delete this bad boy, empty recycle bin
Reboot normally, delete all left over shortcuts, empty recycle bin again and you are home free.
dude , i cant find the eight number shit …
damn damn damn damn .. help me 🙁
@Philly Keith
Thank You Clutch !!! i tried to do Philly Keith’s way but i couldn’t find the files that you had to click on so dont know where they are, Reboot your computer and go to ‘Safe Mode’ wait till everything loads then go to start menu or the shortcut on your desktop for ‘Security Tool’ and right click on it and Click ‘Open File Location’ this will then bring a new folder up with 8 numbers as the file name (exp. 38197937) WRITE THIS NUMBER DOWN ! Then click Start > Run > type in Regedit (you may have to search your start menu for Run) it will come up with a windows message, click Continue and ‘Registry Editor’ will come up, i then clicked edit at the top and went to ‘Find’ in the ‘Find What’ box type in the 8 digit number you wrote down, this will bring up any files under that name, DELETE THEM! it will ask if your sure and of course you are :), you will need to do this a couple of times, so just keep going back to Edit > Find etc. keep typing in the number and deleting any files under that numbered name, eventually you will get a message saying that there are no more files under that 8 digit name, i did it once more after i got that message just to make sure (as you never know with viruses), then delete the shortcut on your desktop, the shortcut on the start menu and even in the start menu list of programmes, empty recycle bin ! Reboot your computer again then go back into Normal Mode. This worked fine for me hope it will work for you guys too !!
My gf got that FAKE program Security Tool on her pc. I rebooted in Safe mode with networking. Opened the start menu. Typed in the name security tool under search. Right clicked on the name and opened the file location. There was a 8 digit number file I right clicked on it and selected delete. Her laptop is working fine for now so we will see.
Thank you! This worked. Phew- Can’t thank you all enough. What an annoying virus. Just one minor thing…since getting rid of this my desktop remains black (the icons are still there). Any idea how I get back the vista desktop? Many many thanks
this damn program got on my program last night and just ruined my report for class. thanks to all the comments on how to get rid of this shitty (pardon my french) program. i will try them and see what happens….wish me luck. and hope that no onelse gets this.
ok…just got this frustrating virus this am….but mine is acting a little differently…when I go to the task manager and hit view processes for all users I don’t have any 8 digit #s..although I do have alot of svchost.exe files…when I finally found the AppData file (I had to unhide it) it didn’t have any 8 digit #s either…I can boot in safe mode with networking…I don’t have a desktop icon for this little bugger…however it is on my tool bar at bottom right of screen…wont let me do anything but click onit to activate it.
Finally found an icon…it is hanging out in my control panel with the label Security Center…when I click on it the “fake” scan starts…wont let me delete it from the control panel…any clue as where to start with this? Any help is greatly appreciated…
@kody112
ok so im stupid! there isnt a button to browse on in windows 7. can you give me some advice
okie like yea i hope they do get sued for this and im having alot of trouble how do i reboot this doesnt make sence to me someone please take me step by step
WHAT IS TASK MANAGER. please can some one help me whit this task manager and how do i found it
@Christine
Dear Christine, you like me, have vista. Just open the pc in safe mode with networking, use system restore, and pick a restore point prior to the download of ST. When it restarts, your free
@dave
go to msconfig… any thing without a formal address… turn it off.. and when it reboots, just tell it to boot with changes. should turn off the bad programs until you turn them back on, or delete them.. once you see it is working
@admin
if you are going to go to all that trouble… just reformat and start over.. only sure way to remove a virus… most people dont know where the hard drive is.. never the less remove it and add it to another system as an outboard. r u a geek in training? or a geek?
Thanks Philly Keith!!! Your straight forward instructions works perfectly on my Vista laptop. I also search the “REGEDIT” and deleted those “8 digits” bad boys. Happy Easters.
@tyler
To reboot, either press and hold the power button. Or last resort, unplug yr power cord.
When power on, make sure your keep pressing F8 until you see a list of Windows operating options like “Safe Mode with Command Prompt”…
Then follow “Philly Keith” & “Admin” instructions above.
From Philly Keith:
Reboot in safe mode
browse to C:\Documents and settings\all users\ application data
There will be a folder in there that has eight numbers as a name (ex 91908431)
Delete this bad boy, empty recycle bin
Reboot normally, delete all left over shortcuts, empty recycle bin again and you are home free.
Admin: On vista, it is C:\Users\%Username\App Data. On XP, it is C:\Documents and settings\%username\App Data
@mother trying to fix her daughters pc
Hi, you won’t find the browse button in Windows 7. Kody112 doesn’t mean that.
I’m trying help you to solve the issue. Try your best to follow this step by step.
1. To reboot: either press and hold the power button. Or at last resort, unplug yr power cord, plug it back again. Then power your pc.
2. Once power it on, make sure your keep pressing F8 until you see a list of Windows operating options like “Safe Mode with networking…” .
Use the arrow keys on your keyboard to select “Safe Mode with networking” option. Then press the “Enter” key on your keyboard and wait.
3. When Windows 7 should start with the “Safe Mode” water mark around the PC screen. Now open “Windows Explorer” (i.e., click “Start”, then select “All Programs”, then select “Accessories”, then select “Windows Explorer”
4. Within Windows Explorer, use the Search function to search this name “Application Data”. That is,type “Application Data” (without quote) in the Search box.
5. Once the Search result returns, you should see the Application Data folder displays.
6. Double click the Application Data folder
7. Now, you should see a folder with a 8-digit name. e.g. 91908431. It shoudl be the first folder of the list.
8. Click once on this folder e.g. 91908431
9. Hit the Delete key on your keyboard. Then clikc “Yes” to confirm deletion.
10. Now, reboot your pc (same as step 1 above). When your PC power on again, you should see a black & white screen. At this point, make sure you use your arrow key to select “Start Windows Normally” option. By default, this option is selected for you. Now press “Enter” on your keyboard.
11. Once Windows 7 started, locates any “Security Tool” icons on your desktop. If you find one, delete it.
12.Then locate the “Recycle Bin” icon on desktop. Double click it to open it.
13. Within Recycle Bin window, select “Empty Recycle Bin” option. Click “Yes” to confirm deletion.
14. Your PC should be fine and your daugther should be happy.
Happy Easters!
“Thanks to Philly Keith’s resolutions”
@Lee
To change yr desktop background/wallpaper, just perform a right-click on a empty area of your desktop. A sub-menu should appear. Now, select “Personalize”. A window should pop-up with tones of personal prefrerence options. Click “Desktop background” to personalize your desktop background appearance…solid colours, pictures, etc…
Gary: Reformating PC is postponing away the solution. Geek or not, having unprotected PC means that you will get infected and infected again. Having up-to date security suites and antimalware saves these hours for other, more pleasant things in my life than formating, reinstalling PC and gathering back all the software I had.
D.Poon yes, I know. Also, in some cases it is in different location all together: I have seen version where it was in C:\ProgramData\[randomnumbers]. Typically, we list all possible places in top of instructions.
@blue carbuncle
hahaq yea same here i really am ready to call them and cuss them mf out
okay…please help. I dont understand the instructions listed above. Can someone please explain them differently? I am pulling my hair out trying to figure out how to get rid of this stupid thing. Its really really really annoyinig!!! Please help ASAP!
I tried this and thought I was onto something. My computer cut off all of a sudden after I deleted 3-4 ST items in my recycle bin. Now I cannot get it to cut back on. NO! The battery was not dead b/c it was charging the whole time I was working on it. I guess I will have to spend money to get it fixed now. Let me know if there is anything more I can do.
Listen i found out how to do it…. go to My Computer then click Local Disck C, go into Documents and Settings click All Users the folder were looking for is hidden so go up to the tool bar and go into Tools, Folder Options click the View tab click the Show Hidden Files and Folders the go down to were it says Hide Protected Operating System Files click it, a warning will pop up click yes now go back and you will see Application Data Click it there will be a file with 8 diget number go into the file and you will see it… you cant delete it yet cause its runing so RENAME it what ever you want now reboot your computer now you will see it wont pop up any more now follow the steps again to get to it now you can delete it MAKE SURE YOU TURN YOUR SETTINGS BACK ON IN THE OPTIONS MENU!!! thats the one i had you go into and turn off settings NOW ITS GONE
The File Is hidden Use the steps above and you can find it and delete
it
you have to rename it or it wont work rename it then reboot so then the program wont run cause if a program runs you cant delete it correct?
In addition to all of the other problems listed above, my computer backgroud is black and i no longer have any shortcuts because of the virus (which claims to be going through skypenames.exe. it will not let me play music or even raise the volume which it muted, it brings up a pop up saying that i have a new infection or something every time i try. It will also not let me get to a cookie debuging program on my computer because when i search for it and click on any one of three i can use the pop up comes up making me have to start all over. I am using windows 7.0. I am going to try your way now.
HERES SOME POTENT ADVICE PEOPLE : Way back at the beginning of all these posts about this hellish “Security tool” virus – there are 2 very important posts by “Kody112” and “philly Keith” (See October 9th and 12th 2009). They tell you step by step what to do whilst in safe mode. I JUST DID IT. IT TOOK ONLY A COUPLE OF MINUTES AND IT WORKS !!! (See also Angels post on 13th October 2009 for more info regarding this method). My computer is back to normal. I have switched off and back on twice and everything is functioning as it was yesterday before that nasty little worm struck.
I’ve eliminated it for good. I suggest you all try to do this before anything else.
Thanks so very much Pilly Keith, Kody112 and Angel. I’m over the moon. I can’t afford to pay to have my computer fixed and I am so happy to have come to this website and found a quick and easy answer that I could do myself in just a few minutes. I am no computer whizz and this was soooo easy. Good luck everyone.
I wonder how much $$ those crooks have fleeced from unaware people. Cyber Crime is no Joke. Lock ’em up and throw away the keY !!!
OMG! Thankyou i was panicking i thought this virus would never go away and my laptop is brand new! Its pretty easy im 15 and i got it i feel so relieved thankyou!
I recently got this virus and have been to MANY sites listing how to manually delete this virus and all of them list the virus under the “Application Data” folder. I don’t know if it’s different since I have Windows Vista, but that folder doesn’t exist on my system. I did a whole computer search for the random # as a file and “No Search Results Found” keeps coming up…. I know how to get rid of it once I find the files… can anyone PLEASE help me locate the files???
This stupid viris keeps poping up on my screen every two seconds and its very stressfull.!!!!!!!!!!!
so i have this virus.. i really cant get rid of it.. ive tried alot of things.. im computer illiterate..lol but id just like to say, i hope theres a special place in hell for ppl who invent these damn viruses
im having a difficult time. this thing is on my laptop and i dont have an internet connection on it anymore and i dont know how to get rid of it. i have very important things on there so it cannot crash. i’m such a clutz and i get instructions mixed up and whatnot so would it just be better to call in a professional to look at it? im just afraid to mess with it…these instructions are confusing for 14 year old…
please tell me how to remove the black displaying on my screen. it happened after being infected by the security tools. i would appreciate it.
The company is Russian based known as Browsing Solutions!
They have no contact details and are based in….guess where????
Moscow!!
Why have the Credit Card companies not got together and banned this company from allowing it to scam people. The Bank will not refund you and it’s a well known con!
in safe mode do a date modified search when you think you got securty tool virus and the numbered file pops up with the securty tool icon just delete and bye bye virus
hi i found a very easy way to get rid of this piece of shit virus. i went into safe mode then i did a system restore 2 days prior to getting this virus and it work got rid of it very simple and easy way of doin it
this crap got on my laptop and woudnt let me run anything. i had to reboot get task manager open and termanite the random numbers process. i then found where it lived in the ProgramData folder. i then deleted its files
@Meghan
the ApplicationData folder is hidden. go to drive C:/ApplicationData and delete the random number folder example 43332854.
@helicopter hogs
@Bella the ApplicationData folder is hidden. go to drive C:/ApplicationData and delete the random number folder example 43332854
i am running win 7
Thank you SO much for this info last time I never thought of checking how to do it & it cost me $60 for my computer guru to fix it. One last duh question this happened when my computer was off do I have to leavy my computer on 24/7 so that the Security Tool won’t “invade” it again.
Thanks again.
JUST TRY THIS PEOPLE…………..IT WORKS AND ONLY TAKES A COUPLE OF MINUTES ….BELIEVE ME I WAS SOOOOO RELIEVED THAT IT WORKED. (SEE MY POST ABOVE)
MEGHAN: TRY THIS TO FIND THE FILES: right click on Security Tool whilst in safe mode and then click on “open folder location”. This will take you right to its location and you can delete it to recycle bin and empty the recycle bin in safe mode too…….hey presto…………gone !!! it worked for me.
EVERYONE ELSE: TRY ABOVE ADVICE FOR MEGHAN or this way below:
Reboot in safe mode (to do this constantly press F8 key after turning computer on…. black screeen will eventually come up…. use arrow keys to choose safe mode)
browse to C:\Documents and settings\all users\ application data
There will be a folder in there that has eight numbers as a name (ex 91908431)
Delete this bad boy, empty recycle bin
Reboot normally, delete all left over shortcuts, empty recycle bin again and you are home free.
GOOD LUCK.
The Security Tool Doesnt Remove Viruses It is the Virus
@Philly Keith thankyou so much, I’m not so good on the old pc but did just what you said and it worked. Next time your in northern ireland I’ll buy you a beer.
Cheers again and to this site owners Cheers
What are the steps for removing the Security Tool demon using Windows 7?
have done eveything suggested… removes the peice of ca ca… but it comes back after reboot… what am I doing wrong… somebody, anybody?
Philly Keith your a god!!! Thank you for helping. This does work!!! If you have the security tool shortcut Right click on it and click on file location. The number is there. Delete number than delete shortcut. This worked for me.
Mitch: Do a scan with Spyware Doctor. Maybe there is another infection that re-downloads security tool, or a new location
I ran into this nasty virus ‘security tool’ from whatever jerk created it and it pissed me off for 2 hours! For anyone interested, try running ‘system restore’ in ‘safe mode’ it seems to have worked for me. I restarted my computer three times just to make sure all was well and no signs of those annoying pop ups. Hope it’s done for good.
James : Do a free followup scan with some good anti-spyware programs instead rebooting 🙂 No signs does not mean there are no hidden downloader, which will reappear after a while
Here is how I got around it.
1. Boot into Safe Mode – turning your PC off incorrectly should display this option if your having problems using the normal solution of pressing F8 as the PC posts etc.
2. Install Malwarebytes (*MWB)
3. Run MWB – quick scan will do the trick (if you prefer run a full scan)
4. Remove any traces using MWB
5. Do a full scan
6. Re-boot your pc
7. Don’t click on strange pop-ups on the web. 🙂
i need study how to remove security tool
Thanks Philly Keith. That works. You have to do it somewhat quickly. Even in safe mode the darn thing will start running and then you cannot delete the file.
Just did a system restore whilst in safe mode, back to yesterday morning (only option available in safe mode.) System restore took a couple of minutes to come up. Seems successful so far. Good luck. This virus is a bastard.
@James
I did it too and it seems to be working.
@Mel
get McAfee Stinger this got rid of mine
Thank you so much,
I have been trying to get rid of security tool for two days now and thanks to you it is gone!!!
@Azz
One of my client’s computers got infected with Security Tool, and he was using AVG Free with ZoneAlarm Free Version.
As good as the free versions of AVG, AntiVir or Avast might be (in the sense that they work very well for the price :)), they are not as effective as other products. I use Kaspersky Internet Security 2010 and can tell you that it is far better than these free products. It’s not perfect, none of them are. And I’m sure that some people might have a story about how it failed to detect certain threats. However, for the most part, it is much better. You have to ask yourself, “do I go with something that is 85% – 90% effective, or would it be better to opt for the product that is 95% – 98% effective?” I’m just estimating here, but I think my numbers are good ball-park averages. Kaspersky is also very light, not really a resource hog (unlike Norton products).
Every now and then Best Buy and Future Shop (here in Canada, where I live) have Kaspersky Internet Security on sale. The regular price is $80. However, the sale prices are either $20, $30 or $45. I picked up a few 2009 boxes last year for $20. The nice thing is that the 2009 license can be used on the 2010 version, therefore in essence the company doesn’t differentiate between the two versions. The license number can be used on 3 computers, and it is valid for 1 year.
I need to help to remove the system tool program.
well, because my computer is being stupid that i can not get into safe mode.
is there are any way that i can delete the program completely in the regular window mode???
I did what Paul Mx suggested, worked great (so far so good). Is it really true that security tool can start up even in safe mode?
TIM: Reboot into safe mode with networking, update and do a full system scan. That should fix your PC. If it fails, contact PCTools support -they will update definitions.
I fixed it!!!!! And I’m no computer expert!!!
My 12 year old got this on her netbook – this is how I was able to fix it:
1. Start in “Safe Mode” (press F8 right when PC is starting)
2. There was a Security Tools shortcut on my desktop. Right click the shortcut and select “Properties” – the Target will have the name of the program that is running this thing (an 8-digit number followed by .exe)
3. Go to Start and select “Search”
4. Type in this 8 digit number. The .exe on my computer was in some random file called “Prefetch” (???) This might be different for you guys.
5. I deleted the entire file and the shortcut. Then I emptied the Recycle Bin.
6. Restarted and all was solved! Hooray!
Hope this works for you guys!
@admin
so, the list of things to manually remove is good, but cannot find them!
what procedure should be used to locate them? The search tool in safe mode
does not find them and cannot locate them manually…
Jeff: check where from security launches – it changes the location, also it might be a hidden/system directory which is not shown in lists.
Ok so I got this thing and found a fix on youtube which was-
1)Go to the task manager(CTRL+ALT+DEL) (programs currently running)
2) CLICK on the Security Tool(disable it by ENDING THE TASK)
3)The program will stop. bcuz its ordered to do so by the OS.)
4)Then go to Security Tool icon, properties.. click on find target..this will pop-up.
5)Simply right click again the properties tab. then advance tab you will see:
->ALLOW INDEXING SERVICE TO INDEX THIS FILE (UNCHECK THE BOX)
THEN DELETE THE FILE AND REBOOT..THATS ALL FOLKS..
So after I did so and rebooted my user that didn’t have a password is now asking me for one.
I’m running XP on a computer that was given to me so I don’t have any boot disk.
Any advice on how to get back into my user?>
@japanese forms
I had some success helping a friend with the following steps:
1. Bring up computer in safe mode (reboot and hold F8 key)
2. Select Programs->Accessories->SystemTools->SystemRestore
– hopefully, your computer is saving registery backups
– follow the wizard, select a registry backup date that pre-dates the virus
– it will prompt for a reboot
3. Do the reboot and go into safe mode again
4. Try to run your antivirus tool
– in our case, it didn’t work (the virus had disabled it so it was giving
a strange message
– had to uninstall it
– then to be safe, I went to another computer and downloaded avast to
a USB drive and loaded it on the sick computer
5. Ran avast without internet connection (obviously since we are in safe mode)
6. Then rebooted and came up in normal mode
7. To be safe, I then got avast updates and reran the scan
Everything appears to be ok now.
@Philly Keith
Got it! Between you and ilona, It is gone. I have Windows 7 so many of the ideas didn’t work, found the 8 digit number from the ‘Security Tool’ Icon that was placed on the desktop… right click & properties revealed the number, then I had to go through DOS language to delete the files… So far it is gone… good ridence!
This completely took over my computer allowing me to do nothing had no access to anything taskmanager cmd.exe system restore or any programs suggested to run scans to fix this problem all my program games ect wouldnt work was even locked out of system info user accounts ect. After much frusteration and reading about this problem i went to the folder in /Program Files/Live Security Suite and right clicked to properties and allowed the folder zero permissions and no user accounts were allowed to access it. Still thinking my computer was a complete write off i noticed one application it was letting through was my wife was putting pictures from our camera on to the computer without problems this basic windows function still worked…made me turn to microsoft for and answer and i quickly found one here
http://onecare.live.com/site/en-us/default.htm
“Full Service Scan” The only application i found amoung all the other scans that i was denied access to using. After completing and removing the 75 items or so this one virus had I took a System Restore to an earlier date before i became infected. even after the system restore i found a .dat file to the virus in my recycle bin so ill again be performing the scan to make sure it’s really gone now. Good luck I hope this helps the people who’ve lost access to thier tskmanager restore run
Philly Keith tq!
(1) Reboot in safe mode (press F8 when starting pc)
(2) Found Security Tool @ C:\Documents and Settings\User\Local Settings\Application Data
(3) There will be a folder in there that has eight numbers as a name ~ eg. 91908431
(4) Delete & empty recycle bin
(5) Reboot normally, delete all left over shortcuts & empty recycle bin again
So far so good.
easiest way to remove security tool
if all instructions failed you might want to try these steps:
(When i tried to go to safemode, my laptop cant get to windows and and it auto reboots i tried to go to Safe mode, safe mode with networking, safe mode with command prompt.
i also tried to use MBAM and pctools’ spyware doctor but those did not work for me either.)
Only this one worked for me:
1. locate the security tool by pointing your cursor to “Security Tool” as listed in your start menu
2. go to that folder and RENAME the file
(it did not allow me to delete the file directly from the folder. if it does not allow you to directly rename the file, create a copy of the security tool in the same folder then delete the original file)
3. Create a new folder then MOVE (NOT copy) the security tool file into that new folder
4. Move the folder to your desktop where it is easily accessible
5. log off from your account then log back in (OR restart your pc)
6. after logging back in/after restarting and AS SOON as you can access your desktop,and the security tool is still not active (not showing in your system tray) delete the whole folder and empty recycle bin.
if you will delete it while security tool is showing as active in your system tray, you wont be able to delete the file.
Hope this helps
I just this virus today, flipping heck. Thanks for the advice. I hope the maker of that virus has his balls cut off and be forced to eat them.
I did KK’s procedure in safe mode and I was able to delete it all and then reboot.Seems to be ok
Bill: do a scan with any anti-malware tool, and maybe antivirus. Also, clean up temporary files from your browser cache to be 100% sure.
I could pull someone’s windpipe out over this BS. I found a good way to kill this thing. Many of the suggestions above did not work on my computer.
Here is what I did. Do a search for exe in all files. Hidden too. It found 4658511.exe. That is the FM-er. It was in Documents&settings\compaq_owner\localsettings\application data
I restarted the computer and hit start then run very fast and type in “taskmgr” hit enter. May take a couple of times, you have to beat the sysytem tool start up.
Then go to processes and stop the 4658511.exe processes. Select then hit stop process.
System tool should not start up. May have to reboot.
Go to file (documents&settings………
and delete that file, may have to rename it.
empty recycle bin.
Remove files above from registry.
go to download.com and get Advanced System care. It’s free. Read reviews, it a great little program.
Run it to clean system.
Cross fingers it does’nt ever return.
Hope this helps
J
Alright, I batteled with this dumb thing all day and finally found something useful. I have Windows Vista so this will differ depending on your system.
Reboot your computer and while it’s rebooting, press F8.
Log on and after you log on quickly press ctrl+alt+del and it’ll bring up the Task Manager. Click on the ‘Processes’ tab and find the only 8 numeral name. For me, it was 77483874. End the process and this should stop the pop-ups temporarily and make it so you can access everything like you could before the virus infected your computer.
Now open a new internet window. In the URL bar, type in C:\Users\(your User)\AppData\Local
This shoul bring up a new window with many files. Find the only 8 numeral name and delete it. This will put the file into the recycle bin and from there, empty the recycle bin.
Reboot your computer and this will get rid of the virus. Just have your security system scan for any more threats and delete any shortcuts related to Security Tool.
Hope this helps! (:
I did what Philly Keith suggested and removed it. I’m running several anti spyware programs now to see if any damage has been done. So far so good. Maybe some notes though for others:
I am running Windows 7 (64 bit Professional) and found the file I needed by first:
control panel -> file options -> view tab -> show hidden files
Afterwards I went into C drive and it was in
C:Users/ME*/AppData/Local
ME*: the name of main user on the comp that you are on.. so could be Peter, Fred, Frank etc etc.
removed 8 digit file, removed desktop icons, emptied recycle bin, reboot, and done. Somehow it did do something to my daemon tools though which now gives a strange error when I boot up each time but I am hoping a clean re install will fix that.
BTW. The way I got this piece of crap was from a fake Mozilla firefox flash update. IF YOU GET A TAB THAT SAYS “FIREFOX HAS BEEN UPDATED BLABLA UPDATE FLASH TO PREVENT BLADIEBLA” DO NOT CLICK IT EVER!!!!!!!!! EVEN IF IT LOOKS LEGIT! There are examples of how the shit looks on the net, just google “firefox fake flash update secrity tool” or something and you will get images etc.
As a final note I would like to thank: 1: the admins of this site for putting this up as a reference for people who need help. 2. everyone who commented here. AND to join other commentors I too would like the creators of this Security Tools BULLSHIT! to get cancer in the nuts and die a slow and painfull death.
@Philly Keith
Hi Philly Keith – Finding your comment was god sent. Please try this remedy; it worked like a charm. Also, people with Vista and Win7 systems don’t have “documents and settings”. You will find that string of #s in your “users” folder.
Downloaded spyhunter 4 scanner,not the malware remover itself, on my laptop, which was infected, did the scan, only then was I able to restore my computer. to an earlier date. Go to control panel–System and Security–Back up your computer–(located at the bottom of page highlighted in blue) Recover system settings or your computer–Select OPEN SYSTEM RESTORE– Obviously select date before the infection. Worked for hope it can work for you. By the by, it took 5 mins. for the entire process.
Also, recommend Spybot-Search and Destroy and its free, it would be nice if you donate to the cause.
I had this pop up from Facebook The way I got rid of it was Stopzilla and AVG a lot of digging into my control panel and removing files after files so I dont know about this doctor thing but with StopZilla it made it a lot easier and with AVG free anti virus I cant find a trace of it anywhere
Lee: Spyhunter is quite expensive ( 60 USD(or EUR) per year for software without virus protection). I would recommend Spyware Doctor instead for protection.
Spybot S&D is updated not too often in respect of latest threats. This is my impression, though. Perhaps too little donations ?
I have problem with Security tool for 2 days please HELP!
This is one of the most complex viruses ive ever come across. Stay calm, dont panic and follow this very slowly. Ok so here’s how to remove it:
In the botom right hand corner of the screen there will be 2 new icons that look like shields(they’re next 2 the icons for the volume, internet, etc) … hover over one of the icons and an 8 or 9 digit number will appear, MAKE A NOTE OF THAT NUMBER! you will need it later on.
Now shut down down computer immediatly, turn it back on again and tap F8 until the screen appears to run in safe mode. Now run the system in Safe Mode.
Once opperating in safe mode click on the start menu, then programs, there should be a new program installed called “Security Tool”. Right click on the program and move down to properties and click on it. Once in the properties tab there should be a box which allows you to open folder location, do so.
Delete all of the 8 or 9 digit numbers and any files that looks like the security tool program.
Now go back to the start menu and click on run, run “regedit”. Now press Ctrl+F, this allows you to find anything that you type in. Put in that 8 or digit number that you copied down earlier, mine was 822020192. Delete the file that comes up for that number, now press F3 and it will look for it again in any other locations on the system, repeat the process until you have deleted all of those numbers.
You should have the bulk on the virus removed now.
Run any antivirus programs you may have, i used malwarebytes and that should clear up everything left over. All of this should be done in safe mode.
Once the scan is finished turn of the computer and run in normal mode. Everything will be back to normal and fine again. Good luck.
After going through the whole safe mode, process kill, malware scan which did not solve the issue I found a very quick and painless way of removing it. F8 on boot for Win7 provides a repair my computer option. I done a sys restore form there and job done, got rid of that clever annoying little shit in 5 mins. Hope this helps someone.
I am having the same problem. But I think i got it worst because by the time I was able to get to my computer it shut down and now I can’t get it to come back up does anyone have any ideas on this?
im am a computer retard i dontknow much all i know is i have this on my sisters lap top and she is going to kill me if i dont have this fixed tonight so when i shut the computer down how do i put it in safe mode remember i dont know much about computers so help please@Philly Keith
Ok im having serious problems. I re-booted in safe mode and then opened up task manager, there wasn’t any numerical processes running. Now the guides tell me to delete files but i cannot find the files to delete them
@Rick
My daughter’s computer caught this horride thing today and was freaked. I was going to do the Philly Keith solution, but your solution seemed better, especially for a computer only a month old. It worked. So far so good. Thanks.
Kate: scan with Spyware Doctor to identify processes. You might want to stop all processes that look like garbage : iotuwettww like this. It might be a case that there are versions of security tool that fully randomizes its file name.
i cant do anything… i mean anything without a pop-up from security tool!
my pop-ups tell me that “his worm is trying to send you credit card details using dllhost.exeto connect to a remote host” i can’t open anything and nothing works!
Please help me get rid of it
@Alan
O and adding on delete all the shortcuts from recycling bin and menu
Find the random name.exe file here
C:\Documents and Settings\csd5182\Local Settings\Application Data
Ok i have the Security tool, but when i got into Safe Mode and Networking after i do Task… Theres no Numerical numbers?
David: Security tool might be inactive in safe mode with networking, also there were couple signs that they started using fully random names (not just numbers). Do a full scan with scanners, or right-click on security tool icon on desktop and check where the file it lauches is located.
alright guys, I tried malware bytes twice with full scans, should take about 2 hours for the scans, if that doesn’t work then log on normally and as soon as the welcome screen goes press ctrl-alt-del for task manager, time it right and it will open before security tool does, then once its opened, there should be a digit process running end that and that will stop security tool for this log on but however does not remove it completely, next go to your c-drive (C:/) next look in the folder called “users” next the folder which you are logged on to (after you are done you can check the rest to be sure if you want)next there should be a folder called “AppData”, there should be a few folders but you want to go in the folder called “local”, it is not called “LocalLow” thats a different folder, go in the local folder then you should find a application file which is blue with a darker blue ex through it you delete that application and that should get rid of it.
and to be safe, look for any files or folder in the local folder and see when they were created and unless they are really essential, something crucial to you or your business I would delete those as well just in case they are an extension of the virus.
this method worked for me I cant promise it will work for everyone but as long as you delete the right application (the size for mine was around 1200-1600 KB so it was quite small and you EMPTY YOUR RECYCLING BIN DO AND DOUBLE CHECK IT. then after you have done this restart your computer normally and press the ctrl-alt-del buttons before anything else just to check.
I hope this works for you guys cause it worked for me. good luck
and sorry for the long winded explanation but its better to be exact laters.
btw it worked but I am 14 years old, so if you don’t feel comfortable then don’t try it.
laters
I have spent all day trying to fix this problem with comments from other web-sites. The one that worked for me was to end the numerical processes. Worked immediately. Thank you
I cant i just cant get rid or it. it doesnt let me play games watch videos or do anything
@Joe
Yep I have this pain in my computer as well. I have malware, and PC tool spyware doctor, and i cannot run the Malware, I continualy get Error messages. I can run the Spyware doctor, which finds this “rogue” file, removes it but it is still there when I boot up again. I’m ata loss now, and ready to send the computer through the nearest window. Any other sugestions to get this thing out of my computer ??? !!!
Monique: Update Spyware Doctor and do a full system scan, preferably in safe mode with networking. You might have to kill Security tool processes prior doing the scan.
Manual Removal Update:
Security Tool seems to have altered slightly the directory and registry entry it uses (which isn’t surprising). Thus, an update to Philly Keith’s reply is needed.
I was able to remove Security Tool manually with the following two actions:
[NOTE: The OS version I am running is Windows XP SP2]
1) delete file C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\9977807.exe
2) remove registry entry HKey_Current_User\Software\Microsoft\Windows\CurrentVersion\RunOnce\9977807.exe
NOTE: I opened TaskManager using CTRL-ALT-DELETE immediately after login, as described by kodykid168 and in other replies.
The exact name of the executable file may well be different for you.
After reviewing all the above I found a combo action that worked. First, I could not find the file, since there were no numbered files listed, I found it through the start menu to programs and found Security Toool, right clicked and properties to open file location. Can not delete it directly, so renamed it. Shut down and restarted, Security Tool did not start. I then found the file and deleted it. I was then able to run Malwarebytes app. All seems to working smoothly.
I did all the above but nothing seem to work.
What did work though is the following.
1. Restart computer, click F8 and select safe mode with networking.
2. Start run and type %temp%, delete everything in the folder that opens.
3. Download malware bytes (free version), install and run a quick scan.
4. When done click show results and click on remove selected.
Now this will fix this specific problem but means that you are open to these kind of malicious software so I did the following also:
5. Download and install Spyware doctor and register (yes register means pay).
6. Run a full scann and remove all remains.
7. Set scheduled daily runs at least for next few weeks.
8. Run malware tool embeded with spyware doctor every so and then to make sure nothing is crawling back in.
I hope that the bastard who create this malware go to hell with the rest of the bastards that pull similar crap.
Oh my god, thank you so much, Philly Keith, you are a total life saver!! 😀
There seem to be a few different versions of this malware floating about, which is why the instructions work for some but not for others.
I’ve just removed a version from a customer’s Windows 7 laptop by:
Use F8 at start to get into Safe Mode (where Security Tool doesn’t start)
Go to Start…Run and type “regedit” (to get the registry editor)
Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
You should see a couple of rundll entries either there, or in HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run (if they’re not in either, you have a different version, try other instructions). Delete those.
Now go to the Control Panel, Folder Options and enable viewing hidden files (so you can see Appdata in the next step) and disable hiding known file types.
Next, start Windows Explorer and go to C:\Users\\Appdata\Local (where is whatever username you’re using)
You should see a couple of dll files there (they will match the ones that rundll was starting). Delete them.
If you now reboot normally and Security Tool should not start up. Do a complete scan with Malwarebytes (update to latest first) to make sure you got everything.
Hope this helps someone!
I didn’t realise this board would strip out the <username> bit. It should read:
Next, start Windows Explorer and go to C:\Users\[username]\Appdata\Local (where [username] is whatever username you’re using)
I can’t get rid of Security Tool – HOW TO KILL IT AND IT’S PRECURSOR ROOTKIT virus (hopefully GOOGLE can pick up this tag and help other folks find this site)
Hi folks,
picked up this peckerwood last nite when I was redirected during an image search for a horror movie actor (Rondo Hatten) for no apparent reason, and then saw a cmd/DOS window pop open and disappear for no apparent reason. I knew something bad was afoot, and sure enough, 1 minute later started getting the popups and redirects keeping me off the interweb, wouldn’t allow me to run task manager, etc. The bastards that write these things should be castrated and then drawn and quartered. All you good folks and me losing all this time just for those screwheads.
So using a buddy’s machine found this page and the comments. I saved it as a .doc so I could get to it without being online.
Anyway, read the comments and got a lot of good tips.
a) how to find it
b) how to kill it
c) how to find the **#@!! rootkit virus that probably infected me with Security virus, which sure enough, was hiding in my machine.
Here’s my story, hope it helps someone.
… yesterday morning all was grand except when I logged on, my desktop went wonky and the pic I had put up the night before vanished. Went to redo it and found that the pic was still listed in desktop manager in the ‘desktop’ tab, but when I went to the file location, it was gone. Weird. I didn’t think about it but it turns out this is one of the clues you have a problem. I’m no expert but I think this was the rootkit manifesting itself.
So I redid the picture and my desktop and proceeded whistling past the graveyard all day with no problems. Then, last night while looking up Rondo, I clicked on a photo of him, got a redirect, then the cmd/DOS window opened and closed and everything went to hell immediately as described in my intro.
Tried Malwarebytes in Safe mode, it found 12 infections in two runs and then showed clean. Rebooted normally, still had it. Ran LanDesk (our corporate app) in Safe mode, it showed nothing, rebooted, still had it.
Found this site. read comments.
Started up in Safe Mode, tried digging around in all the folders with show all files and system files and hidden files turned on, still no joy. Went to DOS window and looked in the same places (sometimes viruses can hide in windows file manager views but not the DOS viewer), still didn’t see it.
Re read the comments and found how to start up taskmanager *IMMEDIATELY* upon normal boot before the virus starts, and this worked. Then I could see the virus, sure enough, with a random number.exe process. WRITE DOWN THIS NUMBER! Mine was not the 8 or 10 digit number, it was 5 digits.
Killed the process with taskman at that point. Then I went and found it in the Start/Programs folder and right clicked to get properties, and sure enough, it had been hiding in the docs and settings – users- my name – app data folder. clicked ‘take me to this location’ and zapped it. Emptied recycle bin.
Then I went to safe mode again.
then I opened ‘run’ and ‘regedit’. highlight the top level item ‘my computer’. Start the ‘find’ feature and enter the number you found. delete what it finds. Hit F3 to find the next instance. I found it in multiple places. Delete each location. When it said it was done searching, I closed regedit and restarted it, researched, and found three more. On the third run it found nothing.
Then I again went to file manager and emptied the recycle bin.
Now I thought about idea that a “rootkit virus probably is hiding or installing the virus” from this forum, so I went to my buddy’s machine and downloaded combofix and got the updated version, put it on a thumbdrive and ran it on my machine.
It is slow but very effective…don’t despair, it IS running. It will ask to install MS’s restore toolkit, so I did that. That took a while too. Then it started going for real, and nearly immediately said I had a rootkit virus and said it wanted to reboot. Fine. it rebooted into normal mode and just when I was panicking again, the combofix DOS window popped up so I knew I was OK. Then it chugged along at it’s leisurely pace reporting step 1 complete, 2, 3, etc until step 50 finally came..then a lag of a couple more minutes and it started deleting files and folders, then wrote me a nice log file. Combofix appears old school and clunky and slow, but by god it works and it works well. It probably took 20 minutes to run.
When it was done….my machine was clean, no *#&@@&&!! security tool and it’s running much faster too. I’d still like to rip the heads off the hackers who wrote this and *$$# down their neckholes, but at least I found a solution.
SO…
use another machine and get the latest combofix on a thumbdrive. rename it just in case!
Now, on your machine, boot normally and Start pressing cntrl-alt-delete the instant your desktop shows during normal boot and you can beat the virus to the punch
find the random number.exe process, write down the number, then kill the process
find the process in your start – programs menu and right click for properties, then go there with ‘find target’ which opens file manager on the target
zap it there
empty recycle bin
start in safe mode
go to run, regedit, highlight my computer, and use edit/find for all instances of that number and delete them, hitting f3 to repeat your find.
close regedit and repeat the search process until it returns nothing
empty recycle bin
start and run combofix and do what it tells you. it’s slow, be patient.
and that’s what did it for me.
Good luck folks, I hope this helps someone and may Karma place parasitic gangrenous gutrot starting in the ‘nether regions of the *%*#@!! hackers who write this crap.
If you cannot open your task manager in time when your comp is booting, try the following:
Click Start -> Run,
Type taskkill /f /fi “username eq ”
Your username should be what you log in to your computer as.
E.g if your username is JoeBlogs then type taskkill /f /fi “username eq JoeBlogs”
This should kill all of your processes, then press Ctrl+shift+esc and task manager should open.
In run, type: explorer and you have re-use of your computer again. (of course don’t forget to kill the virus process too.)
p.s this is not how to get rid of the virus, just read all the other entries, this is just how I managed to get task manager open to end the process.
@kody112
grateful thanks kody112….followed your advice and it worked a treat !
Had a horrible time with Secutity Tool. I finally just right clicked on the icon, changed the name to something else (any name will do) & the viris could not replicate itself. It could not find the file anymore. I then sent it to the recycle bin & hit empty. Walah, Security Tool was gone.
ATL- i want to say u really helped me i just wanted to say thank you so much!!
Boot in using the f8 safe boot option. Then, use your system restore. Worked for me.
@Keith Philly and kody112.
Thanks a bunch. Your advice worked a treat. Thanks
I think I may have a newer version of Security tool & it seems to be getting more vicious. It regenerated itself after I removed with malwarebytes, and also after I removed it myself by deleting the file & did the regedit. I also restored my netbook to factory settings 3 times doing the malwarebytes scan after each & also scanned with McAfee trial version. What finally worked for me (I hope) is this, I had to use a separate computer to fix it.
First I downloaded Combofix (for free) onto a memory stick with the safe computer. On the infected computer I went into safe mode w/network, then insert memory stick. Install & run combofix, follow prompts. It may ask you to reboot during the scan, and also will tell you to shut down any anti-virus programs etc. Also I briefly read to not pay for Combofix or download it from websites like combofix.org, or .com, etc. The website I used was bleepingcomputer, and the download link they supply is only good for 10 mins then you have to refresh the screen to get a new one if you need it.
Good luck to you all, I was using AVG free version when I caught the virus and received the McAfee free trial after the first time I restored to factory settings but neither of those seemed to help fight this nasty virus. Also for me everything had to be done in safe mode, I tried loading Combo fix saved under the name iexplorer.exe while not in safe mode & not only was it blocked but my computer actually erased the program from my memory stick!
Big thanks to keith philly
Also Angel your are an angel. Could not find folder but right clicking on security tool on safe mode and looking at file path to find it worked great.
Security Tool took over my daughter’s laptop. I have tried many different sites to try and remove it. I used MY laptop (a Mac which seems immune to such atrocities so far) to download Malwarebytes on a CD (I need to invest in a flash drive). I was unable to run that program in normal mode even after running rkill (security tool would not allow either to run). I ran Malwarebytes in safe mode. It took 50 minutes and found 204 (give or take) infected objects. I removed them. Rebooted in normal mode (per instructions) and the security tool was still popping up with all of the warnings. I came to this site and have been reading user comments for hours. I did what was suggested – I right clicked “Security Tool” in the start menu task bar whatever it is called and went to file location. Deleted the file with the numbers and was able to restart in normal mode. Of course I didn’t write down the number and I guess my next project is to find any other files with number-names. For the past 30 minutes I have been running a scan with Windows Defender. Then I plan on running the Malwarebytes scan again. Then I am going to check her firewall settings. And then I am going to prohibit her from ever using her computer again!
Thank you Combofix! I would post more but it would be an echo of what ~B~ above me, has said.
So far, so good.
This virus was on my hubbys laptop…we had one hell of a time trying to get rid of it. It destroyed Norton, and prevented us from downloading it again.
I looked through c documents in safe mode and we found a file that had a bunch of numbers but under that file was an error report so we deleted the numbered one…then deleted what was in the recyle bin.
when I rebooted normally, the second it rebooted I got task manager up and went to proccesses and there was the virus. I clicked “end process”
I have not had the virus since. 😀 and I was able to download antivirus and all of that. my windows defender started working again and found a few trojans and destroyed them.
The person who created this virus must be the Dr. Fu ManChu of the software world. It took me two days to bring my computer back to working status. I was able to locate a file called “Prefetch.” In this file was every trojan, virus and you name it!!! I tried to delete it, however, it wouldn’t let me delete it. It was running in conjunction with other files “rstrui.exe” and “rstrui.dat.” I kept trying to rename them and eventually succeeded. Then I rebooted and deleted them. I’m up and running with no problems. I still must locate and delete all the numbered files that are dormant.
This Security Tool is back with a vengence! I tried safe mode..ran mbam..deleted and it wouldn’t move it there. Wouldn’t let me boot in Safe Mode..F8 just didn’t work!.
So if you get this as of today..you need to boot and immediately ctrl/alt/delete to get task manager up..scroll and find the 958223 exe and stop it!
After this..download/update antivirus and mbam..run both…be sure to check your quarantine box to make sure it went in there, then delete. Best of Luck to all!
If mbam can not detect it at first time (if updated), it is unlikely it will detect another. I recommend trying out spyware doctor as well – it has bigger database than mbam, and it shows filenames it detects for free.
I got this security tool from somewhere and I had problems trying to remove it. So, here is the thing you have to do – run the pc on safe mode, open the containing directory and first rename the file which is some row of numbers (I put a name on cyrrilic) to anything else and then cut it and paste it to some other directory (the thing is you have to remove it from its original place, I put it into C:/Downloads). After that start windows normally and simply delete security tool from the new directory it’s been placed before, then delete the shortcut too, delete both files from recycle bin. It worked for me. Good luck!
I got hit with the wrenched piece of trash like two days ago and thought all was lost until I happened upon this website with suggestions from other victims! Thank God because it restored my sanity and potential damage to my wallet! Big ups to Angel by way of Philly Keith for the suggestions. After getting my blood pressure to stroke level, I tried your suggestions and they worked! Funny thing, I did it before but was not in safe mode so it didn’t work the 1st time around. It’s working now so let’s hope it stays that way!
I dont think this will help all of you but try it you got nothing to lose.Open your PC at safe mode then hit start. Security tool will be somewhere at the left above start button. Right click on it and then hit open folder location. there will be some files with only numbers for name-delete them all. It was six numbers for me but i dont think thats the only case. I have a toshiba satellite laptop and it worked for me.
Thanks a lot Philly Keith sir.It worked for my computer when I tried all stuff like rkill,mbam in vain.God be with you for your good and easy-working advice.
I GOT THE VIRUS OFF WITH AN EASIER WAY.
1)Boot the computer up in safe mode
2)Do a system restore a day before you got Security Tool
3)Restart computer
My computer is working fine! Try this if you can’t get a malaware program to run. Good luck!
My brother recently was infected with the badder version of this. We spent approx. 5 days trying to get rid of it. First we tried Safe Mode. It would not allow that. Then we tried control alt delete to manual halt the process, it would not allow that. We tried reg-edit, it would not allow that. It also kept taking us to a porn website. We then download R-kill. It worked if you hit it about 50 times in a row. Now we had some breathing room. We tried Malwarebytes anti malware. It wouldn’t allow it to run. We changed the name and manually installed it through a jump drive, it would start to open up and then be shut down. A very tricky virus/malware. Since it was not on my computer, it was a challenge, to my brother it was a pain in the butt. I ordered a popular anti virus for 29.95 that claimed it could cure it. (They billed me twice). After downloading the update to a jumpdrive, using R-kill we finally got it to load. It scanned the computer and found nothing. Finally I downloaded HitmanPro and Rkilled again, and low and behold Hitman found it and quarinteened it. My brother immediately bought Hitman Pro. So, this was the only solution we could find to eliminate this nasty super version of Security tools.
Lyle: I have heard some good about Hitman Pro. Though we had quite a success deleting Security Tool both manually and with Spyware Doctor, Malwarebytes, etc. However, it gets a bit more difficult because there are more than a single version of Security Tool
Ok, so I got this Security Tool virus/spyware (whatever you want to call it) twice now. Twice in 3 weeks. I’ve noticed that the spyware seem to upgrade itself somehow or like other say, have different versions. I’ve successfully got rid of it twice now (one of them 1 hr ago). It was frustrating but at least I got rid of it. Mind you that I already have Malware Anti… and Spyware Doctor even before I got the very first Security Tool. So the first time, I ran the Malware and spyware Doctor, it found some but didn’t find all. Therefore, it didn’t get rid of it. So I downloaded SuperAntiSpyware and ran that. THAT got rid of it in one tried (ran it in safemode by pressing F8). Now the second one, its a little more difficult. Pressing F8 didn’t work, so I held the power button for 5 secs until it turns off. Since you didn’t turn it off properly, your comp will ask you to load in save mode. Mind you that I’ve already ran my Malware, Spyware Doc, and SuperAnti at least 5 times each and everytime they delete security tool, security tool seem to regenerate. So, while in Safemode, delete the old Malware Anti… and go download the latest free version for installation (select updating after installation). Run that and Security Tool will be gone. I’ve also deleted the shortcuts from the start menu, but after reading the results from Malware, it seems like Malware would have gotten rid of the shortcut for me anyways.
So that’s how I got rid of it twice. I hope it helps.
Well this is fun, isn’t it?
We’ve been trying to fix our laptop for the past 2 days.
Rkill didn’t work
MBAM ran in safe mode and found some infections, cleared them, then we restarted in normal mode to find lovely Security Tool still sitting pretty as well as all the other pop-ups
Spyware Doctor couldn’t run in normal or safe modes
System Restore comes up with a quick dialog box which disappears too fast to read, but says something about being disabled by group policy, so can’t do that either
Task Manager will open if we ctrl-alt-del fast enough on rebooting, and we can delete the numerical process which stops the main Security Tool window appearing, but we still get all the other bogus security pop-ups and it still won’t let us run exe files such as Hitmanpro, even if we rename them
We also went through the process of showing hidden folders and unhiding system files so that we could see the folder for Security Tool in Program Files (we were looking for a random numerical sequence like the name of the process we disabled with Task Manager). We found the folder and deleted it, but after a reboot the pop-up warnings and Security Tool windows still come up as before. We have looked for the folder to re-delete it as we read that the virus re-creates itself and all its files and folders every time you reboot, but now we can’t find it anymore
So…we’re thinking this may be an even newer version of the virus? Has anyone had any experiences with the virus more recently? Any tips on other methods we can try? Any help would be so very greatly appreciated!
Martin : There are 2 versions of SD available (older and newer) They both install a bit differently, so you can try both.
I recommend running TDSS Killer now for all infected with modern rogues, as that rootkit is often the cause of the problems that can not be detected.
FLASHBACK Note:
Dear Admin,
This is the first time I have to deal with Security Tool thing. Then I searched online how to remove this security tool. I went across this site and it’s great. I have read all the comments above. Have so many advises and different methods on removing the security tool. I decided to use Philly Keith’s method since it seemed to be quickest and easiest. I located the 8-digit folder and deleted from Application Data folder. But Security Tool(ST) won’t let me deleted it. In face ST regenerated everytime I restarted the computer.
I’ve got my solution for this virus. Thanks to my old laptop (with minimum memory and slow speed. Hehehehehehe)
First i overloaded/floaded my memory by opening many software/program at the same time, than in the taskbar (bottom), right click this “security tool” than pick “close” . Try it in many time until you see “End task now”. just push space immediately. Its push that software to suicide. Try it as many time as possible until you success to kill this virus.
After that happen (Security tools closed). click start–>program/all progam, right click security tool–> properties. Select find taget. You’ll see 12345678.exe (or another 6-8 digit number. Write it down! DON’T TRY TO EXECUTE THIS .exe FILE!)
Now go to start menu –> run. Type “regedit”
Find (Ctrl+F) string named with 12345678.exe (or another 6-8 digit number you’ve wrote) Delete it all!
than use malwarebyte’s Antimalware to finish the curing process.
Note : I dont think this work on hi-speed CPU.
Same thing happened to be it can be very frustrating. I went into safe mode and had webroot sweep my computer. They detected the virus and removed it. After that, haven’t had a pop up since.
Can’t figure out how to eliminate manually. Can’t afford to buy fulol versions of any antivirus. What can I do?!?!?!
This morning my boyfriends Toshiba Satelite started up with a blue screen, then went to it’s normal screen with a “Security Tool” notification that the computer was full of viruses. I knew it was a virus since I couldn’t open the AVG and check it out. I looked it up to verify that it was a virus.
My first thought was to do a system restore. So I restored it to about 4 days prior. It restored fine… however, now the keyboard and mouse pad of the laptop will not respond at all.
I got into AVG with my USB mouse and was able to remove the viruses and a trojan. The keyboard and mouse are still not responding. Now the USB mouse will not work either.
So perhaps the way I removed the virus was wrong.
I am experienced but not a pro with computers. Any info, preferably step by step, would be greatly appreciated.
Thank you.
Kim : borrow non-USB keyboard and reinstall USB/Motherboard drivers to your bf laptop. I would guess Security Tool disables usb stack to prevent users installing antivirus using USB disks.
hi im 12 and my computer was infected with security tool today and i cant fix it i tried what you said but its cofusing
hi my laptop is infected with security tool i have tried what you said but i cant fix it even through the safe mode ..
plz help me to sort out the problem
THANKS A LOT PHIL
I find it at
C:\Documents and Settings\Administrator\Local Settings\Application Data
There will be a folder in there that has eight numbers as a name (ex 91908431)
Rename, Delete this bad boy, empty recycle bin
Restart
It’s Work!
@Philly Keith
Hello Philly Keith,
It Works, thanks so much. I had spent the whole day yesterday trying everything I could or thought and now today 15 minutes and my security tool problem seems disappeared…
Thanks again for your insight, may God bless you.
Thanks! Managed to start in safemode and did a system restore to last week. seems to have worked
@Joe
down load crap cleaner free–settings—delete easy mate
@JoBanana
for the longest time i couldnt find the location of this bastard, so i opened up the start menue and put the mouse over the shorcut and it told me where to find it. Thanks a bunch…hope it works! Also the nerd who created this abomination needs to die in a pit with mutant man eating babies!
Thank you Mr.Philly Keith.Your formula excellent.Thanks a lot.
@Nick nick
1) restart in safe mode and networking
2) down load crap cleaner
3) go in crap cleaners settings
4) programs to start on windows
5) say no to 54675686 (or what ever number it is)
6 now delete the bugger
7) restart in normal mode
BINGO
Hello Ladies and Gents,
I was looking to remove this bad boy on a customer’s PC…I found a little trick to it actually, you can boot into normal mode and remove this, but you have to be sneaky 🙂
The basis of removing this on normal mode:
Like the Author says, it’s a number process. After you terminate it, it’s easy…But the problem is, it won’t let you…So what you have to do (in normal mode, because for some reason I couldn’t find it in safe mode, and spyware doctor wouldn’t run in safe mode because it required an update…Although I guess I could have ran it with networking…Just thought about that…Lol)
Anyway:
HOLD DOWN CTRL+SHIFT ESCAPE UNTIL YOU SEE ATLEAST ONE OF THEM POP UP!!!!
Once you have a valid task manager up, you can terminate the named ‘number’ process, and proceed with windows like it was never on there…KEEP IN MIND you MUST leave your finger on the CTRL key, and you must use your mouse to click the process to terminate it.
That thing was annoying, to say the least…Just a bit of wisdom for my suffering friends.
Thanks for reading
-Chris J.
@Philly Keith
Keith, thank you so much. you are a lifesaver and it didn’t cost me an arm and a leg.
safemode
and delete security tools in what folder it save
i do it
and it works
@ KK I spent over an hour reading through the entire blog. It was your method that worked for me. Thank you so much!
Man Kodykid”s comment saved me because im not much of a computer person haha
THANK YOU SO MUCH!!!! IT WORKED 🙂
Juct run in safe mode, start, find in programs vhere is security tool, right click on it, properties find target, and delete.
(safe mode) while you starting your computer pres f8
Unfortunately, i paid for the program but called my credit card company and filled a claimed and blocked them from collecting any payments because its fradulent. Norton antivirus software scanned my system and took it off. I added the software immediately after. It also protects your computer from this stuff altogether.I suggest u get antivirus software asap.
@Weasel
After hours of trying different things This worked for me (on VISTA).
Thank you so much for posting this method.
Pete
Welp i guess ive been living under a network rock but I just had my first encounter with security tool. Holy f. I googled how to get rid of it over and over and read tons of threads..Spent prob 40 hours messing with it GAH! Anwho I fixed it and if anyone cares heres how: Ok so mixing and matching stuff I went to that rkill page and downloaded that…after having to shut my computer on and off 10,000 x’s until security tool didnt immediately pop up and i could actually get online and run a program. Patience is a virtue however and finally I got it to do its magic, (that inventor should be knighted) it killed S.T temporarily and allowed regular access to computer land as before. Then i tired to download that suggested antimalware software that was supposed to lasso it up and whatever else buuuut fter it scanned for an hour, didnt find a damn thing. Great. Not really. Heres the deepest secret nobody knows now though MICROSOFT SECURITY ESSENTIALS, which i downloaded off their site (i have a pc btw and deeply regret not getting a virus-ninja mac in the first place)this thing scanned my shit and found tons of stuff, including the specific files rkill told me it destroyed. Can I get an AMEN! I told it to remove em. Emptied out the recycle bin just in case and not a single hit on S.T yet.DAMN THE DUTCH!
Genius,
Removed within 5 mins and not returned. Can’t believe this worked so quickly.
Any who has issues, use this remove method.!!!!
Thanks
Ed the Net
This thing must be ever changing. I tried to get task mgr up and this darn thing kept closing up on me. Here is what I did;
First I went into programs and found the shortcut, I then right clicked and opened up properties. I opened that up and clicked on find thread. This was the only way I was able to find the main program files. I single clicked on the files in this folder that I did not know of to see the orrigination date. After this I shut my machine down and re-booted. As soon as windows came up I opened task mgr before security tool had a chance to load and close me out. I then shut the two files down and went back and removed them. Good luck, this ones no fun!!!
Hmm, Brian, I did what you suggested and it’s gone for now. I only found one file containing the string of numbers. I ended it on task mgr. and then removed the file and dumped recycle. Is there another file I missed? I haven’t rebooted yet to see if it’s gone permanently.
I downloaded Microsoft Essentials and it’s clean now. I rebooted and nothing came back. I checked my task mgr. and nothing was running for this. whew….this is one nasty bug. It gave the date and time it was installed and I wasn’t home but the computer was open for a teen-age visitor. I don’t know where it came from. Thanks Brian….you solution took about five minutes. I think those who have multiple files may have clicked on this thing numerous times.
Hey, Sorry to hear about all ur problems…I felt your pain today after the virus Security Tool appeared on my laptop when I tried (for old times sake) to log onto my Bebo account!
Anyway after a full days scan and every attempt! I was told by a computer genius what to do!!
1. Turn off Computer
2. Turn on computer and press F8.
3. Choose the Safe Mode option
4. Once loaded it will look like a really old windows setting.
5. Go to Start and in the search bar type in ‘System Restore’
6. It should take u back to when ur computer was working fine e.g. the date and time. Press Restore
7. It restarts ur computer into normal mode and vola!! it should be fixed!
8. I hope this works for you guys:)
BEST OF LUCK…
@blue carbuncle
yo guys create a new acc and delete the account u had security tool simple but my sisters are going to be pissed god speed
This fix worked great – the only difference was that it was a six number file name and there were two of them – thanks for the help
had this today, blocked every attempt at everything i tried, eventually rebooted and hit escape to enter system setup, then system restored from there, alls good now
Thanks lar, I’m a computer dinosaur but I was able to follow your steps and it worked, but there were three files Ihad to delete.
I would like to get my hands on the perv that did came up with system tool. I can’t get microsoft windows live onecare safety scanner to work. It just keeps bringing up the contract agreement page and I enter accept, it goes right back to the ageement page. Who are these people that delight in the destruction of another’s income and entertainment? I hope our national security isn’t infected. I’ve tried all the remedies without success. HELP!
thanks a lot, chris 793
i already try every which way i could find in the web, either been blocked or forced my computer to shut down, even try to ” regedie ” does not accessible.
finally, follow chris’s way and manually removed this fxxx spyware successfully.
Brian thanks a lot!!!!!
Crap cleaner rules!
Ok guys, i had the SAME! problem 3 hours ago, when they showed me that fake scanning and asked me to download i actually found the answer!!! I swear it made me bored to death and i even made a new account, but then i said let me try again, the answer is when you start your computer, dont go all open task manager and all, all what you have to do is Press F8 on the start and go to safe mode only, open start menu and click all programs, you will see the damn program there, Right-Click on it and Click the last option, propereties or whatever its called (Sorry I Forgot the name) Then it will open a little page and it says in the end of it find the location of this file or something like that, go there and delete it, its going to be a 7-digit number, with the symbol of the Program, delete it, go to recycle bin, delete the program completley, Shut Down your computer, Turn it on again, And be happy with your old buddy! I Hope this helped, because i only went to this website, and im telling you people its a big annoying pain in the ass to delete this program, but once you do what i told it wont take 30 seconds, i wish you guys luck and i hope people who made this bullshit go to jail. Thank you, have a great time.
Security tool is blocking any downloads I try to remove this nasty bug. Help!
Terry: Read full guide.
as soon as you log on and windows pops up hold down crtl-alt-del then click on security tool and en task it will stop it and you could put anti-spyware on computer without security tool stopping you
Click on the icon of security tolos located in programs, with the right button and mess with the properties of this application, selecting hidden, do not read, run as administrator, basically preventing it from running by itself.
ok ive heard about philly keith’s famous method, and im about to delete this crap, but wat do u mean by delete any leftover shortcuts?
My computer got this shit today. Trying my best to do everything to remove it. Hope its out by the evening.
I also had this annoying virus, this is what i did to remove it:
– Write down the 8-digit code, can be found in processes or when you hoover over the security tool icon
– Start up in safe mode (F8)
– Search for code in windows search (make sure to click, search hidden folders)
– It will probably in some application data folder, just remove it
– Profit $$$
Tried most things. Nothing worked.
Finally found a % 100 fix.
Start computer in safe mode
Switch off system restore(switch back on afterwards)
Delete all Temp folders C:Documents and settings\Administrator\Local Settings\Temp
Open up internet explorer>Internet options>Delete browsing history(cookies ect) and delete everything.
Delete all referance to this bug in ‘application data’(look posts before for nav instructions)
Runrkill
Run Malwarebytes
Restart
clean
this crap seems to be circulating from a fake UPS delivery service email too.
hope it doesn’t come back.
Perfect description and help! Best thanks, Phil.
Itzi
@SoAnnoyed
Leftover shortcuts are shortcuts, icons, etc. eventually left on your desktop even after deleting the malware.
If you see them, delete them. If you do not see them, it simply means that your system has already removed all malware crap and is functioning again. Ciao.
i tried but whenever i try ctrl shift and esc a security tool message pops up and says that it wont let me browse please people help me
I was looking up some info on what looked like a legitimate medical website and I got this quick flash of “java loading application”. After that this cr-p appeared.
Install latest version of Java software and delete old versions.
Also the world’s biggest porn site is down (XNXX). Is there a connection ???
KK comments really worked!!!
@admin
i restored my laptop to an earlier date..will it still come back? if so what do i use to prevent it from coming back? thanks!
This nasty thing comes from a false request to update Adobe Acrobat Reader, we found out the hard way
restart the computer in safe mode and delete the file in appdata…..
I got infected with this yesterday and have tried various ways of removing it. The problem is I can’t now find the location of the Security Tool folder. I start in Safe Mode and go to All Programms and right click on Security Tool, go to Properties and it tells me that is in in the Application Data Folder. However, when I search for it (the torch thing) it says it has been changed or moved – the name of the file is 74143.exe. If I go manually to the Application Data folder, it is not there. I have asked the computer to show all hidden files, etc. and still I can’t find it. Has anyone got any ideas. Whoever did this needs their balls chopping off!
Pete : Set your PC to show system files as well. Typically, files with attribute System are not shown even when hidden files are. Also, download and install process explorer and launch it instead task manager. It will show the location of each of the processes.
Thanks Admin but I still can’t find any folder with it in! I can’t install process explorer because I can’t get on line to do it (I’m using another computer now). My computer is completely useless as it freezes every time I open an application. I’m going to try and salvage what I can from it and start again!
I had some trouble finding the folder that the program was in.
Here’s the file name: cDgCp000902
It was located under:
My Computer> OS (C:)> ProgramData> cDgCp…
You might try searching for a similar file name. KK’s solution really helped! (If you want to find KK’s solution press “CTRL” and “F” at the same time. then enter “KK”.
P.S. If you’re having trouble with rebooting in Safe Mode, (safemode) *while* the computer is rebooting, press “F8” (located near the top of your keyboard, and hold it down until the option for safe mode apears. 🙂
Thank you all so much- I sucessfully deleted this awful virus! YES!!!!!!!!!
When your system’s OS has been nobbled like this the easiest way to repair a Security Tool infection is not to use your system’s OS. Remove this thing by downloading the free and excellent Hiren’s Boot Disk iso (http://www.hirensbootcd.net/download.html) and burn it to a CD using the free CDBurnerXP (http://cdburnerxp.se/download).
Once you have created your boot CD, boot the infected computer from the CD, not the Hard drive (you may have to make a boot priority change in your BIOS – hit Del or F2 when your PC boots up, depending on your BIOS). But many PC’s will look at the CD/DVD drive first before trying the hard drive. If there is a bootable CD in the drive (like the one you created above) it will run off it.
On the first menu you will find Mini Windows XP which is a small version of XP that boots directly off the CD, not your hard drive. Select it. Once you have got Mini Windows XP running you can explore the infected hard drive (normally C:\) using Windows Explorer and find the folders hiding the Security Tool executables. These normally hide here (the files and folders for Security Tool and Security Tool have random names consisting of a string of numbers, here represented by 123456789):
%AppData%\123456789
%AppData%\123456789\123456789.bat
%AppData%\123456789\123456789.cfg
%AppData%\123456789\123456789.exe
%UserProfile%\Desktop\Security Tool.lnk
%UserProfile%\Start Menu\Programs\Security Tool.lnk
On Win2K/XP %AppData% can be found here: C:\Documents and Settings\Application Data
On Vista/Win7 %AppData% can be found here: C:\Users\AppData\Roaming or C:\Users\AppData\Local
On Win2K/XP %UserProfile% can be found here: C:\Documents and Settings\
On Vista/Win7 %UserProfile% can be found here: C:\Users\
Once you have deleted the Security Tool executables remove the CD from the drive and reboot the PC. Now (download and) run Malwarebytes, SpybotS&D and HijackThis to locate and kill off the stragglers.
I’ve been removing Security Tool for a couple of years now from customers’ computers without any problems using this method, I hope it works for you. Wherever possible, please donate to the providers of the free software that allows you to regain control of your PC. But I know most people won’t bother once their PC is up and running again. Which is a shame.
Le Beret Gascon: Your way is way to complex. Usually you can easily kill security tool process with either task manager right after reboot, or process explorer. It is not THAT bad 🙂 I would prefer people to invest in good internet security suites and anti-malwares with real time protection first. Would be far less work for me 🙂
As an update, the newest version appears to be located in the Appdata/local folder as well and now goes by the name “028263.exe”. To locate where it is installed on your computer, just right click on the “Security Tool” icon (while your computer is booted in safe mode) and click “properties”. Under properties you should get the full path of the executable which you can then just navigate to and delete. Afterwards I recommend running something like Ccleaner to clear out registry values created by the malware.
Is there any way to file a class action lawsuit against these folks? I would like to see someone in jail for fraud.
Lynn: Poor chances. They are not a real company, but just a bunch of international scammers.
Alright this system tool is p****** me off. Not too familiar with all this technical jargon, and would like the simplest the way to remove this. I have been running in safe mode with networking all day and would like to return to Windows normally. I have Windows Vista and would like the simplest way to remove this please.
@Joe
try rebooting your computor. that, before Security Tool kicks in, launch Task Manager and when Security Tool does kick in, you can stop it. Task Manager is found if you press control delete alt simultaneously.
Jordan L: Simplest way is to run couple of anti-malware tools after stopping security tool processes. The executables can be launched if you rename them to iexplore.exe . For tools, I recommend Spyware Doctor, Hitman Pro and MBAM.
Real quick here, I rebooted my lazptop and brought up the task manager the instatnt Windows started up and the System Tools did not even try to start up. What will i need to do after this to make sure it is deleted or removed(in plain English please, cuz i have no idea what some of these comments are talking saying)?
Scan with Spyware Doctor. Install or upgrade your antivirus software.
I am running a full scan with both Windows Defender and with my Trend Micro Internet Security. Is there another way, other than manually removing and without buying SpyDoctor, to remove this?/
Jordan: You can try other tools as well. We had seen some versions of security Tool that were very resistant, and only Hitman Pro together with Spyware Doctor solved the problem (Hitman pro fixed some of rootkits, Spyware Doctor took out the rest).
Here’s how I just got rid of it:
1. Restart your computer. Hit control-alt-delete while it is going through start up. Look at the processes that are running, find the one that is 8-10 numbers followed by .exe; Write down the number, then click on it and terminate it.
2. Go to Windows Search. Use Search Companion and make sure that the “search hidden files” option is selected. Search “all files and folders” for the 8-10 digit number that you wrote down.
3. My search found two entries. Delete all of them (remove to recycle bin).
4. Restart your computer. Repeat the process until Security Tool no longer starts up. For me, two cycles of this did the trick. I restarted my computer a few more times to make sure it didn’t return. So far, so good.
Follow Philly Keith’s instructions to get rid of security tool. Works like a charm. Cheers Philly Keith!
Thanks zyzacks for that. It put me in the right direction. I’m running Win 7 and when I control-alt-delete’d I immediately was taken to system restore and recovery. Ran the wizard, rebooted and the application was gone.
i cant open task manager. i have tried akll of the workarounds, including copying it from the system files and renameg it “mozilla firefox” but i can only open it for a split secod before it gets shut off. plus i canniot enter safe mode. how can i work around this?
well, i finally got rid of it. i searched for “system tool”, then copied the shortcut i found onto the desktop. then i checked under properties, and found an 8-digit number. i then searched for that number, and when i foubnd the 8-digit files, i renamed them to “windows defender” . then, when i rebooted, the program blocked its own critical files, and failed to start up. the i could remove it! hope this helps.
in my C:\Documents and Settings\All Users\Application Data there are no 8 digit number..pls help me…. pls pls pls pls pls……
@Philly Keith
thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx thanx …very much!!!! ur trick is 100% working!!!!!!!!!!!
Also check c:\windows\prefetch Folder (providing C:\Windows is your installation location) for filenames similar too 73661202.exe-06EE1F55.pf.
Delete these twerps too.
Thanks for you help.
Continuing the saga of ‘Security Tool’ removal …
There is a ‘Security Tool’ shortcut located – c:\Documents and Settings\%Username%\Start Menu\Programs. Prior to removing it, note the .exe filename it is pointing too – say “73661202.exe” – its location – c:\Documents and Settings\%Username%\Local Settings\Application Data\ Filename.exe (Say73661202.exe”. Now delete both the Shortcut & the file in the Appication Data Folder.
just go into safemode w/ networking (restart your comp and push f8 a bunch of times) then the thing will pop up that tells you what safemode is…htey give you infor about recovery…click on the link
i found a way to get rid of it,while rebooting computer go on salf mode with networkand look in the help box that popsup and find something that sounds like it backs you computer into time. then you just pick when then it would be gone.
make sure it is before you downloaded security tool
HELP !!! This F**king security tool’s is disable my task and is like An S**t a**
i need to disable and kick security tool’s ass to Trash !!!
Need help need help need help aaAGRGHG
It would not let in anything.I did not know it was a infection.I gave them my credit card. It said that it would send email and call.But it just kept popping up could not do anything.Well they took my money to make a long story short I got McAfee to get it off my pc.How can I get my money back?????? And will they take more money
Thanks Philly Keith that worked
I’m so glad I got this freaking thing off my computer..
I was ready to throw my computer out of my window..
Theresa Livingston
Sure they will. That was the goal of their infection in first place. Contact your bank and ask them to change the credit card.
Went into safe mode clicked the srart icon. All programs right clicked security tool clicked open file location deleted file. Problem solved!
Somehow i managed to open task manager and shut the thing down but, everytime i open my computer, or turn it on, it starts up again. The Spyware Doctor did not do anything and i had to once again find a way to open task manager and delete it. I cannot keep doing this for as along as i have a computer!! HELP ME!!
Joe: Run first Hitman pro http://resellers.hitmanpro.com/9182137/HitmanPro35.exe , then Spyware Doctor. This combo works in such cases, Hitman Pro is surprisingly good against rootkits. Update Spyware Doctor before scan.
{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
{429CAD59-35B1-4DBC-BB6D-1DB246563521}
{755AC846-7372-4AC8-8550-C52491DAA8BD
Are these the type of files to be deleted while in safe mode.
Would say no. Security tool uses different naming. Search for executables (.exe ) in C:\Users\…. or C:\Documents and settings. Open the folder and see what is in it.
These files go to notepad with text I can’t read. In safe mode I have looked for .exe files in the folders you have suggested but don’t see any. Not sure what to do from here.
Omg im so stressed out with this stupid software sucurity tool :/ it closes down my computer automatically and the blue sreen of death come up so i hav 2 resart my computer by flicking the switch at the bak God!! some 1 plz help n give me some advice which will work i tryed rebooting nofin changes :@
Al:
Which folder they are at?
Folder is Application Data under All Users folder.
Each number has its own folder. When you click on folder icon it goes to a text file in notepad.
I just did a malware scan in safe mode and it found the virus which I deleted and restarted in safe mode. Should this have gotten rid of this virus or are there other areas where it will be found?
Problem fixed!! – While in safe mode went into another folder and there it was. Deleted it and also in trash folder, did a reboot and its all good. The key is doing a restart and as soon as it starts press F8 a number of times until you are in safe mode and follow earlier instructions as to the files and folders you need to get into. It does work. I also did a malware scan before and after and nothing was left. Hope this helps!
Al: It is good to hear that!
@lar Thank you, Lar! It seems the problem is fixed!!!!
wow guys , why go through all that? lol. just do this ; type system tool into your search box and open its file location. cut and paste the files in it on your desktop, restart your pc and delete it as fast as possible. boom you done.
@Philly Keith
You are THE genius. For all who have same security tool -virus problem, take Phillys advise and remember to show hidden folders. Thanks for million times! My dad’s company is saved now.
@youngdrew
Tried that and that way did not work!!!! But finally I read thru everyone’s suggestions and actually every little part worked and now That darn thing is gone. I am also going to figure out how to report this stuff This just was not cool at all!!!!
I do want to Thank the creators of this web site for all this information and lending a hand by allowing others say what worked for them. I have spent the past few days trying everything. Then this evening I came across this site. WOW thank you everyone for all your useful information. I had to use a little of everyone’s advise and it finally worked. My problem went away just a little while ago I am so happy!!!
First I went into safe mode and then went into the run and then This is what I typed in my run mode C:\Users\user\AppData\Local. Then when that came up It was right there System Tool not once but twice but two different ones. Deleted both the went to recycle bin and emptied it…then I shut my computer down waited for a few minutes and then started it back up again. System Tool is GONE!!!
Please help, I tried all the running of virus scans etc but none worked…. Donna I have Local openned but where is it saved??????HELPPPPPPPPPP!!!!!!!!!!!!!!
i restored my system and that still didnt work man I hate this!!! i have to work in the morning
This sucks I have tried everything above and I can never locate this virus in safe mode in the folders or processes
I have been working on this PROBLEM since 5:12pm yesterday.(well, I did sleep some) ANYway….thank you Donna..after rebooting in safe mode, I found the file in the C:\Users\user\AppData\Local. What a nightmare!!!!!
@admin
I too couldn’t find where the varmit was located and so did this:
search C drive for Security Tool, this will locate the shortcut. Them right click the shortcut and go to properties. That will show you the location of the offensive program, you will recognize it by it’s stupid shield Icon. Then rename as anything, I suggest weasel but you may wish to use stronger language!
Once that is done restart your machine then go back to that location, I was able to use “shift+delete” to exterminate the B******. You may then wish to run a reputible antivirus program to insure all traces are gone.
Good luck
Just followed instructions, deactivated process, ran Spyware Doctor and removed ‘System Tools’ -Thanks best £27 I have spent this year!
Nick: Run TDSS Killer, Hitman pro first. Then Spyware Doctor.
i just got this fucking virus but i have malewarebytes advanced system cear avg free and spy-bot search and destroy i ran all those and they are still running so i hope they can find the bug. or ill get my dad friend to get it out of the pc..
WTH DO I HAVE TO BUY THE spyware doctor to get rid of it?!?!
Kristoffer: If you want, you can delete the files Spyware Doctor detect manually. Same goes for registry entries. Spyware Doctor has a very good record for protecting and removing from threats like this, it has huge database. AVG free has some modules disabled, and malwarebytes free has no real time protection. That is main reasons you got the infection in first place – lack of protective programs.
nothing works can u help me?
Reboot into safe mode with networking, or do a scan from other account on PC.
I’ve just spent a day of my life trying to remove this parasite from my wifes laptop. I’m no computer geneius so i followed the advise given by this website and it looks as though thanks to you all the proplem is solved. I achieved it by using the ‘safe mode’ method and downloading ‘Malwarebytes Anti-malware’ all listed in detail above. Very big Thanks to you all and lets hope the designers of this ‘Security tool’ virus all catch a real life terminal virus and die.
it wont com up i keep clicking it & it wont com up
is spyware doctor free & affective
peter: Spyware Doctor is effective. Scanner is free, remover is not free. However, it shows locations of infections and you can remove files it detects manually.
I was able to get rid of it simply by going into Safe Mode and using System Restore. When my computer rebooted it was gone… don’t think there’s an easier way then that. I previously tried to using a malware removal program, but Security Tool went on the offensive and blocked me from opening any program, I couldn’t even open task manager.
Got infected on my notebook running Windows7. Can’t start the file manager, can’t help opening the machine on safe mode. My “Kas” generate a recovery but from the length extended to 10 hours and seems can’t get off from 24%. I found an 66888.exe under a program “Security Tool” What should I do?
Martin: try delete it, or try just to rename it and reboot. If you can, boot into safe mode and delete it from there.
Tristan: System restore does not clean underlying infections if they infect user account only or they are deeply embedded in system. Also, some forms of malware can infect restore points. Thus we recommend at least scanning afterwards with antivirus or anti-malware tools.
@kody112
I tried that I typed the exact thing and it sayed access is denied
. please help I’m getting very frustrated probably just like all of you did T.T
Okay what I did this MAY help. I currently have Windows 7.
reboot into safe mode. Search C:\Users then there is a lock on a folder which says Owner. click that folder and looks like there is a file that is invisible that is called AppData. Open AppData then there is another folder called Local. Open that. Scroll down and you’ll see an 8 numbered digit. Delete that crap. shut down restart normally go to recycle Bin and its there and delete it! There you go! Sorry for the messsyness T.T
reboot your pc in safe mode (pressing F8 just after reboot) then once in safe mode restore to an older date before programme was installed. Fixed mine
@Philly Keith
your info is good and working very well. I am using Win7 and the procesures are just the same. thanks.
Boot my Laptop in safemode and search for Security tool/location files/
I dealeted the profiles and also from the Recycle Bin. sure this can help someone too.
@Philly Keith
How do I reboot in safe mode effectively? I’m new @ using a computer. Thanks
Press F8 after reboot. Choose from menu.
i tried the hidden files and unchecked those boxes in the hidden files folder.. and there is no 8 digit numbers there 🙁 what do i do. i tried the msconfig and the regedit in safe mode and couldnt find the security tool folder after going through and clicking each folder that was recommended it wont let me do anything please help me im crying im so frustrated. please please help me 🙁
what do i do when the 8 digit number isnt there when you uncheck the hidden folders options? 🙁
Amanda: If you can not find it yourself, stop the process and scan then with Spyware Doctor and Hitman Pro. This will show where infected files are located.
@Philly Keith I tried it but that bullshit wont allow to delete because it says ‘acess denied’
@Philly Keith
Would love to get my hands on whoever spread this one… took me all day to get rid of it, worst one I’ve ever come accross – spyware all useless…
I finally found it in C:\documentes & settings\owner\local settings\application data\779872039.exe, plus a startup menu file in …all users\startmenu called security tool.
Hope it helps someone
B**stards… whoever did this – D
@Mahmoud
THANK YOU VERY MUCH!!!! THIS IS SO SIMPLE AND WORKS GREAT!
1. Once you start computer right after the welcome screen comes up quickly press CTRL+ALT+DEL go to process tab look for a numerical number, mine was 76237727 and end process.
2. Then make note of the number, search your computer for files containing that number and delete those files. (i had 1 file 76237727.EXE-0F1F63C7.pf)
3. do what dave said in previous post
C:\documents & settings\owner\local settings\application data\779872039.exe and C:\documents & settings\all users\startmenu called security tool.
4. do a scan with your ant-virus, then restart and hopefully it is completely removed from your computer
Have major problems on a laptop. Running XP no access to safe mode have removed advised files, unable to install any programs, no Ctl Alt Delete. The program still keeps comming up, any advise I would be greatfull
Paul : try hitting ctrl+shift+esc while being logged in before Security tool loads. It usually helped for Security Tool. If not, try starting removing in safe mode.
How I removed System Tool virus… My wife had it on a laptop running Windows Vista.
I found that it kept shutting down all applications, internet and worst of all Task Manager. Malwarebytes could not locate it 🙁 But found other stuff 🙂
Some of the information above was very useful – but the version on my wife’s computer did not have an 8 digit name. It had a name made of letters and digits that looked randomly generated. It is not completely random…
I found that if I logged out and back in I had just enough time to launch Task Manager before it was shut down – I could see some odd names in there. But I didn’t have time to read them all. Screen grabs did not work because System Tool stops you launching MS Paint. SO – I took a photo of the screen!
I could read a weird name and the it was described as ‘System Tool’. BINGO!
The name looks like “fdumjw01803.exe” for example… What I have found out is that the ‘01803.exe’ part is a constant. It is mentioned elsewhere online as a virus.
Restart your computer in Safe mode (pressing F8 on startup). And when all up and running search for ‘ *01803.exe ‘ (dont use ‘). Use advanced search – search ‘Everywhere’ and make sure you include hidden and system files.
You will find the .exe file and also a PreFetch file with the same name in a folder of the same name.
If you right click you can choose ‘Open file location’ and then you can see where they are. You can delete them.
I changed their name by adding a dirty word to the filename (in case other apps are calling them) and moved them to the desktop. I rebooted and all was well 🙂 Then I deleted the files.
Hope that works for you folks! 🙂
ey thx dude i first spild 1 houre to delete it by my self then i checkt ur site downloded hitman and the firus was deleted in 15 minutes
if i find the mhoter fucker ho build it im gonna kill him
p.s. if you wanna find the disine computer of a firu use infect track
help please i’ve been trying all the things you told me to do (above) and i cant find the folder and the only way i get on the internet is through firefox(safe mode) and then a blue screen pop’s up when im browsing and i only have 20 mins before the blue screen pop’s up again and say’s the same thing to resatart and delete any recent downloads could anyone help me with this?
Search for numerical files in your user account folder, max-payne fan. Delete them. Reboot into safe mode with networking, and scan with spyware doctor and hitman pro.
@kody112
Hi, I would love to use this method to get rid of the stupid thing, BUT I cant find ‘application data’ ?? I follow the steps and everything, but that folder wont show up. Does anyone know how I can find it ??
Nov. 20, 2010 Re: removal of “System tool 2011” from Windows XP
Plilly Keith’s method worked (so far) for me.
Slight differences: had to type in C:\Documents and Settings\all users\applications data because application data did not show when clicking on all users file. I then found a folder with numbers and letters as name. Opened it and found a file with 12 characters (letters and numbers) and the evil System Tool icon (combination lock looking thing), an .exe file.
Deleted both. Emptied recycle bin, rebooted nornally, and all is well so far.
Symantec was functional again (S Tool had disabled it). Updated it and I am running it now. Hoping for best. Thank you Keith.
Sarah: Its a system folder, you might not see it. On Windows 7/vista it is called AppData.
go into your user folder, for example C:\users\sarah , and then add \Application Data to the end of the folder in address bar.
I have two friends using Windows 7, who have been infected by the SecurityTool Rogue Anti-Spy ware. I removed it on both computers using instructions on this site. Thanks !!
But I was wondering: Have the computers been infected from an email or from a website? I think my friends used to know what links to click on and what not to click on. Any body knows?
Further I was wondering why AVG Antivirus or even Microsoft Security Essentials did not catch that crap?
I think the “market” of free anti spy and anti virus tools is some kind of jungle. Some tools pick some threads that others dont – and vice versa.
Kronsj: usually it is infected websites. There are some exploits, that can download and execute code without your consent. Or they are pretending to be something else, for example flash update or codec to see movies on web.
Antiviruses are slower at detecting such parasites than antispyware/antimalware tools which target that market. Furthermore, both antivirus versions you mentioned do not have firewall, which protects from network-based threats.
Personally, I use paid products for protection (ESET smart security and Spyware Doctor). Because I know, that if something bad happens and I need help (well, thats unlikely case! ), I will know whom to blame. Also, I would not be able recommend tools without using them myself.
Had to deal with Security tool which appears to be new version . No spyware tools would even detect it never mind remove it. I did however manage to remove it by hovvering the mouse over the icon in the tray, which yielded the number 5062031. I booted into safe mode done a search for the file (user\appdata\50623031) I then deleted this file from the search box. It does not appear if you just go to the file via explorer. I then ran regedit and searched for 5062031, there was two instances. I then deleted the two keys and hey presto gone. I hope this is helpful.
Mike: Most of anti-malware tools do not detect “new” version becouse of some additional processes to security tool. Do a scan with Hitman Pro and tdss killer, see that you got no additional infection.
I am using a 2007 Dell laptop, and I have Security Tool. However, I don’t know how to go to “Safe Mode” on this machine because it is different from your regular pc. It is blocking everything, from Malware Bytes to Task Manager. Also, I can’t find some of the files mentioned. Any clue as to what file extensions (“.exe”, “.dll”, etc.) they would be found under?
Adam: typically, just after reboot (while seeing dell logo, before you see windows loading, press F8. A menu should appear. There is safe mode.
The location of malware is easy to decipher by searching for its shortcut, rightclicking and opening properties: copy everything, except the name of file and extension. Then open any folder and paste the copied path to folders location bar. In that folder security tool will be installed. Delete the file whose name matches the last part from shortcut).
when you say “press F8 after rebooting” when exactly do i press F8? i restarted the computer then i pressed F8 when the little COMPAQ picture came up but nothing happened. Is anything supposed to pop up? How do i know the computer knows I pressed F8? HELP!!
btw, this security tool pop ups came up 4 times while typing this. FOUR! Please HELP!
nvm i got it on the safe mode and everything. BUT the ilfiles that are coming up when i press cntrl+shift+esc are the following and i don’t think thany of them are the security tool file:
explorer.exe
taskmgr.exe
svchost.exe
svchost.exe
svchost.exe
System Idle Process
System
smss.eze
csrss.exe
winlogon.exe
services.exe
Isass.exe
svchost.exe
svchost.exe
This is the exact order of them. PLEASE HELP! This virus is taking over my computer. If my parents find out i’m the one that put this program on here i’ll be in DEEP trouble 🙁
laura: run Hitman Pro in this case. You will have to run it in safe mode with networking. After that run SD or antimalware again.
Laura: A menu should appear. try pressing couple times slightly after(before windows logo).
Please read this: Hello I have a way how to remove security tool. Go to safe mode there are icons on the bottom right corner of the screen. Roll over an arrow it will say show hidden icons. Click on it and you will see 2 shields. A red shield with an X and a blue shield with a weird X. Roll your cursor over those shields. They both will say the same numbers. Go to “My Computer” Click on the search box (It won’t search for websites it will search your computer). You will see those shields. Right click the a shield and then it will say rename. Click on rename and name it whatever you want (A name you can remember) do the same thing for the other shield too. Restart your computer and go to normal mode. Security tool blocks anything it claims to be infected. It will claim itself to be infected therefore blocking itself from popping up. You may think it’s over but it isn’t you still need to delete it. Go to “My computer” and type in the name you had renamed the shields. Right click those shields, click on delete, go to recycle bin, and then delete those two shields permanantly. This may look long,hard, and complicated but it isn’t. It is suprisingly quick and easy. Please reply to this comment if it works for you guys. I want security tool to stopping taking time out of your lives. Thank you for reading this dang long comment.
@admin Please help me. How can I remove infections Spyware Doctor detects without registering?
Kevin: expand each of them. SD shows full path to them.
Hey, thanks for posting the best info I’ve seen. My brother tried fixing his Win7 64 box himself but got know where.
I took the instructions did the c/a/d and killed it in task manager. Spyware doctor found it and killed it but after a reboot it was back and Spyware doctor couldn’t find it. Btw, my brother downloaded the copy of spyware doctor is that pay ware, he paid for it so I hope he didn’t get scammed.
Anyway, now spyware doctor can’t find it but we still have the darn virus. I do the task manager trick to kill that copy and run cccleaner which finds a 8 digit file under one of the registry keys that will run it after a reboot. I go to the location and delete the file and have cccleaner remove the registry entry.
I’d really like to run MRT in deep scan mode but it looks like security tool deleted it.
So I take the computer over to my uncles house, mom who lives next door doesn’t have broadband, plug my brothers computer into the router and force windows update to do its thing. First thing it wants to do is install MSRT which is what I wanted.
After that is installed, I updated Microsoft Security Essentials that I installed on his box last month when I set it up. How Security Tool got past that and turned off real time scanning I have no clue. I’ve had good luck with MSE on my XP boxes.
While MSRT was scanning MSE found another virus that I think is what is creating the random names according the little info link in MSE. MSE found something else and asked permission to send data to the mother ship about it. We agreed considering what just happened.
My brother is not what I’d call a computer person, he runs quickbooks, surfs the web, and does some email. I wonder what he did. Last he remembers is he clicked on an icon, I think he means link, to something on Gweneth Paltro?
Oh well, it looks like I have his box working. It is a HP laptop which doesn’t come with the OS on external media. I told him to contact HP and pay for the restore cd/dvds and we will do a clean wipe just to be sure. I used to work IT ten years ago, I’d never trust a compromised system again nor the files on it.
Wes
Hmmm…sounds like a real pain in the rear to git rid of it..I just got it on my puter and had no clue there was a fix..mcaffee and windows defender never seen a vrus..Easiest way i found 2 git rid of it was format hard drive and reinstall win 7…
Also there r more of these programs out there..awhile back i downloaded a program which i cant remember the name now but it said i had viruses that avg and win defender never showed i had..When i didnt want too register it and uninstall the program i got hard drive knocked out..its pretty obvious some of these people r putting these viruses in the downloads 2 force people 2 buy their products..they all should be reported..pretty sorry way to run and git buiseness huh
Wes: we have seen similar case outselves when testing removal instructions. It happens, though the fastest way for us was Hitman pro + spyware doctor instead of msrt/mse. It is great to know that you fixed the PC.
Over the weekend, I was infected with the parasite, Security Tool. Thinking it was a legitimate product I promptly hit “remove” when the window finished running thru what I perceived as “threats”. Since then, as you’ve all experienced, I’ve been plagued with ST popups. In Safe Mode, I googled “Security Tool” and downloaded Spyware Doctor paying for the product but I couldn’t register so tried contacting SpyDoc via “chat”. Each time I tried I got knocked out by ST so, in frustration, phoned. After being on hold for a lengthy time, I talked to Marcus who was quite difficut to understand. I explained I was having trouble registering, etc. He helped me through that process explaining what to do as if were a child. I then ran the scanner in safe mode, rebooted into normal mode and aha! the ST was there to greet me! In normal mode, I ran the SpyDoc scanner AGAIN but the computer froze up ONE MORE TIME! After a lost SUNDAY, I gave up. I’ve been reading your blogs for the last hour or so and have printed off some instructions. I’ll have another “go” at it again tonight. I guess the longer it’s on there the more malicious it will become. I’m very disappointed the SpyDoc I purchased has been unable to help me. Also to enable SpyDoc I had to disable other protection programs so I’m completed naked now! I would appreciate it if someone from SpyDoc could explain to me why their Program is not working for me. Many Thanks! Alison
Alison: I have seen similar. The reason is that in this case there are more than one Security Tool -related processes. In the end the fastest way was Hitman Pro + Spyware doctor scans (in that order): Hitman Pro detected rootkit/trojan that was hiding and messing with SD, and SD removed the rest. Hitman Pro comes with 30 day trial.
im needing hep. i cant get onto the internet to uninstall or remove security tools.
im not a pc know er. i dont understand any of the instructions above.
can anyone help?
I do not understand what to do. I got theis cecurity tool thing >_<
I know what the 8 digit code is but i do not know how to find it on my computer to delete it
Katie: Look at its icon on the screen. right-click on it, and open properties. You will see the path to the file there. Just change folder to that one and delete (you can safely delete most of things you find there)
It will not let me delete it. It says Destination folder acess denied.
Katie: write down full path, reboot into safe mode and delete then.
@Randy
Randy, THANK YOU!!!! your instructions worked!!! NO downloading any more crap, and it was gone.
got a problem. i can’t run my laptop in safe mode. can i get some help?
Bob Smith: Security Tool can be deleted in normal mode as well, if you manage to launch task manager before it is fully loaded. the fastest way is hitting ctrl+shift+esc while being logged-in into windows. Kill numerical processes (like 235235235) and do a full system scan.
Way to go Kevin on 11/26!! IMportant: If you are denied access to delete the numbered file once you finally figure out how to get there in safe mode, you have to rename the file, restart in regular mode, delete the file you renamed, and empty the recyle bin. I’m so happy!!
I got Rid of Security Tool by downloading “Malware Bytes” it cost’s nothing, you can register it, I didn’t..registering gives you Memory performance..the Rouge spyware such as “Security Tool” it killed, after downloading it..close all programs..go into search, start tab, type in temp and clear all new temp files and clear all cookies and saved data..also..you have to put your PC on safe mode, so all the access of security tool are de activated..once Malware Bytes detects the rouge virus “sec.tool” ..It will delete and destroy the file..it worked for me for “FREE”..Try it..it does WORK..
Tony
Tony: Unregistered copy of malwarebytes does not protect from re-infections. At the moment I can not think of fully free and decently updated anti-malware program with real time protection.
I suggest either getting a full version or malwarebytes or spyware doctor , or updating your antivirus software to internet security version.
The “free” thing you advertise just postpones your decision to next infection.
Vista laptop – My husband’s computer got this “bad” thing Saturday. Did not tell me until Sunday night. It was listed on his computer as “System Tool” rather than Security Tool. In the first, 30 minutes of trying to figure out what was going on, I discovered “lsas.Blaster.keyloger” One g in loger; not two. THERE WAS NOTHING ON THE DESKTOP OR ANY SHORTCUT ANYWHERE that led me to anything pertaining to the blaster. I also did a search on dates looking for something that had changed in the last three days. These all turned up nothing.
After doing a search on it, I discovered there is a keyloger and a keylogger. Both appear to be the Security Tool that is discussed here; however, what this laptop had was named “system tool” nothing I did from here seemed to work. But The laptop had all the issues discussed here…
Long story short – here is what I ended up doing.
He had Ad-Aware on his computer, I brought the computer up in Safe Mode (hitting F8 many times as quickly as possible when bringing windows up). Then I used “Safe Mode with Networking”. This allowed me to get on line and I was able to run “hitman pro”. I could not save it to the computer because I was running in Safe Mode, so I ran it without saving it. I finally found the culprit. hitman pro also would not delete the problem for me; so I ran the latest version of Ad-aware with a full system scan. It took care of all the issues except the tool one. I was able to find the file under c:\programdata\dEHj01803 BUT ONLY AFTER I WAS RUNNING IN SAFE MODE. Vista (which I am not really famaliar with and was probably the biggest reason I was having so much trouble) would not let me uninstall it. So I simply deleted the culprit.
Evidently what I did deactivated most of the popups, etc. I was able to get on line and save hitman pro to the computer. I ran it again and it found a very small issue with “system tool” which it deleted for me.
Everytime I did something, I emptied the recycle bin – I think this is a very important step.
I ran hitman pro again and it was not able to find the issue. So I shut down the comptuer and brought it back up in the regular way. At this point, I was able to find the culprit.
After more than 8 hours, I think the issue is gone.
Part of what saved this comptuer was the Firewall that our DSL line has. It would not let anything go out to the internet. And the blaster would not let me download anything. These guys were good, I had a really difficult time telling the difference between the blaster issue warnings and the microsoft and IE warnings.
My apologies for the lengthy submission. And a hugh thank you for this site. Without it I wouild never have been able to even start looking. Without all the people sharing their discoveries and issues, I would never have had enough information at my fingertips to track it down. I think, the people “gave us this wonderful gift” are very brilliant. As I read down the messages, I realized that it keeps changing and I think my husband must have had the latest version–without hitman pro, it would not have been found, even the right click on anything brought up the please buy me popup.
Oh – I also should have noted that
He did not have a virus protection program
He got it when he tried to download a chess game – from a random game site.
He did not shut down his computer after he discoved there was a problem
He waited for 36 hours after his computer got it before he mentioned it
He keeps his computer records on his laptop
Our DSL firewall saved him from sharing a lot of information with anyone else.
IEs new security and microsoft’s warnings kept more issues at bay.
Thank you thank you…it was not how I planned to spend Sunday, but I learned more about blasters, malware, viruses than I ever wanted so will tell myself it was a real learning experience. lol
Sandy: for System tool there are easier pocedures like here : http://www.2-viruses.com/remove-system-tool (some of registration keys work to disable it). Personally, I recommend upgrading the defenses against malware in such cases (aka full mbam/spyware doctor) . And antivirus is a must.
I too got the blasted System Tool bug on 12/9. This string was by far the best in helping me! I rebooted in Safe Mode with Networking, downloaded Spyware Doctor, ran it, it found a bunch of crap including things named “Trojan…” and the sort. Removed all that, went back to normal mode, and like everyone else, the freaking thing was still there. Read this string closely then went back to Safe Mode. Searched C:\Documents and Settings\All Users\ Then had to go to Tools; Folder Options; View; and click on box for “Show Hidden files and folders”. This key advice from here finally got me able to see the elusive Application Data file! Inside I found the blasted file that contained System Tool. I had looked for a random 8 to 10 digit named folder and did not have any. HOWEVER, I had a folder equally suspicious called bElMl01803. Opened that folder and found a file of the same name and the System Tool executable file. So I deleted the whole folder (after writing down the name) and then dumped the recycle bin. Then I went into the registry and searched the file name and deleted the key that came up with the file name in it. The search brought up other keys but I didn’t delete them since I wasn’t sure how they were related, if at all. So I only deleted the key with bElMl01803 in it.
Rebooted to Normal mode and VERY HAPPY! System Tool appears to be gone and I’m posting this many hours later….so appears to not be back. My computer is acting a little slow. That is a problem for another day. I removed all of my old antivirus programs, updated my current one (Webroot), and am currently scanning with Webroot. Will scan with Spyware Doctor one last time before shutting down too. I’ll take the little slow for now over that blasted virus!
Thank you to everyone! Your info was invaluable. I would never have known how to find the hidden Application Data file without you or what to look for!
Every one please know that the file System Tool put on my computer seemed random too but included alphabet letters!!! So don’t look for only 8 to 10 digit random number file names!
Liz: we have special guides for system tool. They are more geared for System tool removal than this one.
I had this A**hole of a thing on my xp machine, it came in named “system tool 2011” i used philly keith’s method for removing it and it worked a treat I was gonna do a system restore back a few weeks to be on the safe side, then this other thing (looked similar) started to run. I’d already gone into system restore before it kicked in properly so i’ve no idea what it was but…
It was called HDD something or other
It had an icon that looked like the windows defrag icon
The desktop shortcut may have been hidden (it didnt show up in safemode though) *bizarre
anyway, i went ahead with system restore, took it back about 3 weeks and all evidence of both viruses (including desktop shortcuts) had vanished
everything seems ok now, but i rekon that they both came in at the same time so might be linked, maybe this will help someone, maybe not. just thought i’d mention it.
Cheers to philly keith for a crackin fix!
Pedro
Pedro: upgrade your anti-malware defenses – you get far too many viruses 🙂
the spyware wouldnt let me delete it cause its connected to my debugging system so i restarted my computer and right as its starts up at desktop i quikly opened task manager and stopped the process then proceeded to remove the file from my computer……..well before all that i found the virus folder and moved it to desktop to remove it right away quicker………….so now im scanning to see if any traces of it is left good luck pplz
@admin
Any suggestions??? im currently running Avast (free version) but it didnt spot this coming in.
pedro
The best way to get rid of this DUMB SHIT…. restore your computer. WOO HOO After 3 hours of goin’ f##$in’ crazy, restoring the laptop got rid of it. I HATE YOU CREATOR OF SECURITY TOOL.
Pedro: If you prefer single program, I recommend ESET Smart security, Kaspersky internet security, etc. If not, get decent firewall, antivirus of your choice. Having Malwarebytes full version or Spyware Doctor full version is good idea with or without Internet security suite. If you choose Spyware Doctor, use version 7 at the moment – version 8 has its own internet security suite which is good too, but might conflict with other antiviruses.
@pedro
Start computer in SAFE MODE then proform a SYSTEM RESTORE. That worked for me. I hope it helps you. Be blessed.
This is what I did and seems to have worked. I bought the newest Norton but hadn’t time to install it – well guess what – I got this stupid “System Security” virus and my PC screen went blue with red lettering telling me to get rid of the virus by starting a System Tool Scan – I ignored it knowing full well Windows does not call it’s security system by that name – it’s ‘windows defender” – I then tried to load the new Norton but it wouldn’t let me. So I went to Trend micro – PC House Call – at http://www.trendmicro.com and had it remove the virus so I could load Norton (of course the virus came back as Trend Micro only resloves the problem for a short while). The Norton immediately found and isolated it – then I did a “deep root” scan with Norton and it found and isolated another copy of this virus. So far I haven’t had any more trouble and the PC works just fine. But I wish I knew how to fully remove it as the Norton only isolates it. Any suggestions would be welcome – I’m running Windows 7 and it’s impossible to find the documents/applications menu – since it doesn’t exist in the same spot as previous Windows menus.