Only my sister-in-law’s account was affected, of five or so on the machine. The others seemed normal.

Here are some things that did not work to get rid of Security Tool:

- access to “taskmgr” ([CTRL-ALT-DEL]) was blocked by Security Tool
- access to “regedit” (via RUN start menu entry) was blocked by Security Tool
- access to “control panel” (via start menu entry) was blocked by Security Tool
- access to the directory tree of the affected account (via the command prompt) was “denied”, presumably by Security Tool
- restoring the machine to an earlier time (via System Restore) was impossible because there was only one backup listed in the restore calendar – Saturday, 27th Nov 2010 6:30 PM
- a “full” scan by Microsoft Security Essentials, a process that took hours due to the number of files on the machine, found three more viruses but did not get rid of Security Tool

Another odd thing was the appearance in all accounts of “Whitesmoke Translator”, which made its presence known by altering the menu of Internet Explorer (version 8). Timestamps again showed this appeared on Saturday, 27th Nov 2010 around 5:40 PM. Internet Explorer’s default home page for this account was re-set from Yahoo! to Bing. Navigation became difficult because of random re-direction whenever any link was clicked.

No one admitted to downloading and/or installing this software. The download package was found in a “Whitesmoke” directory in a “temp” directory, and a file in that directory was named “Whitesmoke Silent Install”.

After finding this list of comments (thanks everyone!) I found this to be fairly effective (fingers are still crossed):

- after selecting the infected account, pressing [CTRL-ALT-DEL] while the account was initializing brought up Task Manager before Security Tool obtained control
- on the “Process” tab, sorting on “Image Name” brought up Security Tool’s random alias at the top of the list (in this case, “441287″). This didn’t actually happen right away, as there was still a slight wait after Task Manager began running before Security Tool began running and displaying its annoying messages
- using Task Manager to “End Task” stopped “441287″ running. Full control of the account appeared to return
- a slight detour: brought up “Control Panel” and then “Add/Delete Programs” to try to get rid of “Whitesmoke Translator”. Two entries found: one for “Whitesmoke Toolbar” and one for “Whitesmoke Translator”. The first was deleted easily with no fuss (IE’s menus returned to normal). Deleting the second caused a message to appear: “‘mfptray.exe’ is preventing access to Whitesmoke Translator. Please stop this process and try again”
- found “mfptray” in Task Manager and stopped it running (oops)
- attempting to delete “Whitesmoke Translator” again brought up a message: “‘rundll32.exe’ is preventing access to Whitesmoke Translator. Please stop this process and try again”
- yeah, well, by now it looks to me like Security Tool is taunting me. ‘Mfptray.exe’, a little too-late research shows, is part of the McAfee anti-virus suite that came with the machine
- gave up on that and began looking for “441287.exe”. Set “Folder Options” to show all hidden and system files. Found “441287.exe” in “C:\Documents and Settings\[UserName]\Local Settings\Appplication Data”. Deleted the file.
- went through the entire directory tree under “C:\Documents and Settings\[UserName]” and deleted every file and directory I could find, but not confirm harmless, dated 27 Nov 2010 or later (bye-bye “Whitesmoke” directory)
- used RegEdit’s search feature to look for “441287″ in the registry. Found only one occurance at “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce”. Note this was not the “Run” key, and nothing was found under “HKEY_CURRENT_USER”, so apparently Security Tool doesn’t always do things the same way
- deleted “Security Tool” from the Start Menu. There was no desktop icon for it that I could see
- used the Start Menu “Search” to look for all files with “441287″ in their names, including hidden and system files and all subdirectories. “441287.exe” was already deleted and the search did not find any with different extensions (“.bat”, “.ini”, “.cfg”, etc)

Then I did a soft reboot, ie., selected the restart option without turning off the machine. Got back into the infected account, but only saw the backround image. No icons, no menu, no nothing. No way to shut down the machine the “nice” way.

Turned off the machine by holding the power button down long enough. Re-booted into the affected account. This time the icons and menus came up as expected. No Security Tool messages, no problem accessing anything.

So things appear mostly cleaned up. However…IE8 still shows signs of random re-direction. Whethere this is a remnant of Security Tool or some other “opportunitic” virus is not apparent. Microsoft Security Essentials reports failure to update to the latest definitions even when manually told to (definitions remained at “.654.”, 25 Nov 2010, before the infection, when latest were “.808.”). Another little present left behind by unwelcome visitors…?

The long term solution may be to wipe the drive and install Win7 – once my sister-in-law transfers off of it thousands of “must have” photos (the drive is almost full; no wonder Microsoft Security Essentials took so long to do a full scan).

Hope this helps someone!