SecurityTool and Security Tool Virus

23 September 2009 Rogue 61 Comments

SecurityTool with an alias “Security Tool virus” is another masterpiece of rogue program developer that will get into computer without escaping antivirus program’s detection. SecurityTool virus overruns computer when users visited malicious websites. You may not realize that it automatically downloads and execute threat on the system. This infection leads to browser hijacking and hook compromised system to remote server to bring in more files that are malicious.

Similar to other rogue posted previously, Security Tool affected computers may experience severe alert messages coming from all corners of desktop. By doing this frustrating procedure, it easily tricks users and makes them believe that computer is indeed infected. A pop-ups message mimics what used to be Windows layout to induce unwary victim to purchase the licensed version of Security Tool.

Since this bogus program is closely working with Trojan, it may give infected users a challenging removal process. Certainly, with its objective to stay resident, Security Tool virus does not include uninstall information and most of the files are hidden on various parts of the system. Certainly, using a confident solution like anti-malware will efficiently remove Security Tool, its files and configuration information completely.

Screen Shot Images:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)
SecurityTool is a fake security program that has no capability to replicate once it infects a computer. Its main payload is to devise misleading occurrences placing the entire system in danger. The malware stages a series of registry modification to load itself when Windows starts.

Malware Behavior
It produces numerous fake security warnings and runs virus scan as scare tactics. One false notice is this firewall alert.

Added Registry Entries:

HKEY_CURRENT_USER\Software\Security Tool
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "9863015261"

Associated Files and Folders:

%AppData%\9863015261
%AppData%\9863015261\9863015261.bat
%AppData%\9863015261\9863015261.cfg
%AppData%\9863015261\9863015261.exe
%UserProfile%\Desktop\Security Tool.lnk
%UserProfile%\Start Menu\Programs\Security Tool.lnk

This guide requires a tool called Malwarebytes' Anti-Malware. It is a free tool designed to eradicate various computer infections. MBAM scanner is distributed for free.

Boot Windows in Safe Mode With Networking

1. First thing to do is to reboot the computer in Safe Mode with Networking to avoid SecurityTool from loading at start-up. You may want to print this procedure as we have to restart the computer to complete the removal process.
- Restart the computer.
- Before Windows begins to load, press F8 on your keyboard.
- It will display an Advanced Boot Options menu. Please select Safe Mode with Networking.
- Windows will now start in Safe Mode.

Remove SecurityTool with MalwareBytes' Anti-Malware

2. Download removal tool from this page and save it on your Desktop or any location on your PC.
3. When finish downloading, double-click on the file to install the application.
4. Follow the prompts and install with default configuration.
5. Before the installation completes, you need to update the database.

6. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
7. When finished updating, the tool will run. Select Perform full scan on main screen to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to SecurityTool.
10. Restart your computer.

Note: If SecurityTool prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.