Jan 28, 2011
SYSTEM Tool is a computer infection from the same family as Security Tool. This infection is also categorized as a rouge antivirus program as it pretends to be an anti-virus program, but is actually a program that displays fake security alerts and scan results in order to make you think your computer is infected. System Tool is installed through the use of malware that will install the program onto your computer without your knowledge or permission. When installed, the infection files will be created in a random named folder in C:\Documents and Settings\All Users\Application Data\, in XP, or C:\Documents and Settings\All Users\Application Data\, in Windows Vista and Windows 7. It will then be configured to start automatically when you login to your computer.
Once running it will scan your computer and state that there are numerous infections present, but will not allow you to remove them until you purchase the program. It is important to understand that SystemTool is scripted to display fake scan results regardless of whether or not your computer is infected. Therefore, please do not be concerned if this program states you are infected. System Tool will also terminate any executables that you attempt to run in order to protect itself from being removed. When you attempt to run any program, it will terminate that program's process and then display a message similar to the following:
Once running it will scan your computer and state that there are numerous infections present, but will not allow you to remove them until you purchase the program. It is important to understand that SystemTool is scripted to display fake scan results regardless of whether or not your computer is infected. Therefore, please do not be concerned if this program states you are infected. System Tool will also terminate any executables that you attempt to run in order to protect itself from being removed. When you attempt to run any program, it will terminate that program's process and then display a message similar to the following:Warning!
Application cannot be executed. The file cmd.exe is infected.
Please activate your antivirus software.
Just like the scan results, this message is fake and should be ignored.
While System Tool is running it will also display fake security alerts and warnings from your Windows taskbar. These alerts are designed to scare you into thinking that your computer is severely infected and that you should purchase the program to protect yourself. The text of these messages include:
System Tool Warning
Your PC is infected with dangerous viruses. Activate antivirus protection to prevent data loss and avoid the theft of your credit card details.
Click here to activate protection.
System Tool Warning
Intercepting programs that may compromise your private and harm your system have been detected on your PC.
Click here to remove them immediately with System Tool.
Security Monitor: WARNING!
Attention: System detected a potential hazard (TrojanSPM/LX) on your computer that may infect executable files. Your private information and PC safety is at risk. To get rid of unwanted spyware and keep your computer safe you need to update your current securitysoftware .
CLick Yes to download official intrusion detection system (IDS software).
Warning: Your computer is infected
Windows has detected spyware infection!
Click this message to install the last update of Windows security software...
This infection will also change the background of your Windows desktop to display the following over-the-top, and almost insensible, warning:
Warning!
Your're in Danger!
Your Computer is infected with Spyware!All you do with your computer is stored forever in your hard disk. When you visit sites, send emails... All your actions are logged. And it is impossible to remove them with standard tools. Your data is still available for forensics, and in some casesFor your boss, your friends, your wife, your children. Every site you or somebody or even something, like spyware, opened in your browsers, with all the images, and all the downloaded and maybe later removed movies or mp3 songs - ARE STILL THERE and could break your life!Secure yourself right now!
Removal all spyware from your PC!
Just like the fake scan results and warning messages, you should not be alarmed with this message as they just tactics that the malware writer is using to try and scare you into purchasing the System Tool program.
As you can see, System Tool was created solely to make you think that your computer is infected so that you will then buy the program. It goes without saying that you should definitely not buy System Tool, and if you already have, please contact your credit card company and dispute the charges stating that the program is a scam and a computer virus. To remove System Tool and other related malware, please use the free removal guide below.
Tools Needed for this fix:
Symptoms that may be in a HijackThis Log:
O4 - HKCU\..\RunOnce: [cPpIg00902] C:\Documents and Settings\All Users\Application Data\lElLf00902\lElLf00902.exe
Automated Removal Instructions for System Tool using Malwarebytes' Anti-Malware:
- Print out these instructions as we may need to close every window that is open later in the fix.
- It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If you run into this problem when following the steps in this guide you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.
- Reboot your computer into Safe Mode with Networking using the instructions for your version of Windows found in the following tutorial:
- How to start Windows in Safe Mode
- When following the steps in the above tutorial, select Safe Mode with Networking rather than just Safe Mode. When the computer reboots into Safe Mode with Networking make sure you login with the username you normally use. When you are at your Windows desktop, please continue with the rest of the steps.
- This infection changes your Windows settings to use a proxy server that will not allow you to browse any pages on the Internet with Internet Explorer or update security software. Regardless of the web browser you use, for these instructions we will first need need to fix this problem so that we can download the utilities we need to remove this infection.
Please start Internet Explorer, and when the program is open, click on the Tools menu and then select Internet Options as shown in the image below.
- You should now be in the Internet Options screen as shown in the image below
Jan 28, 2011 by HUDA · 0
How can I tell if my computer has a virus?
If you can answer "yes" to any of the following questions, your computer might have a virus.Is your computer running very slowly? A common symptom of a virus is much slower than normal computer performance. However, there can be other reasons for slow performance, including a hard disk that needs defragmenting, a computer that needs more memory (RAM), or the existence of spyware or adware. For more information about spyware, see How to tell if your computer is infected with spyware.Are you getting unexpected messages, or are programs starting automatically? Some viruses can cause damage to Windows or some of your programs. The results of this damage might include messages appearing unexpectedly, programs starting or closing automatically, or Windows shutting down suddenly.Is your modem or hard disk working overtime? An e‑mail virus works by sending many copies of itself by e‑mail. One indicator of this is that the activity light on your broadband or external modem is constantly lit; another is the sound of your computer's hard disk continually working. These are not always symptoms of a computer virus, but when combined with other problems, can indicate a virus infection.To check for viruses, scan your computer with an antivirus program. New viruses appear every day, so keeping your antivirus program updated is important. For more information about computer security, go to the Security at Home page on the Microsoft website. To learn how to remove malicious software from your computer, go to the Microsoft Malicious Software Removal Tool webpage.
by HUDA · 0
Subscribe to:
Posts (Atom)

