System Diagnostic

16 March 2011 Rogue 0 Comment

System Diagnostic virus is malicious software that will disguise as a useful program in order to persuade computer user that a paid version is required to remove Trojans, viruses and spyware from the system. The truth is System Diagnostic was made to be spread and sold in an illegal manner. It does not really have the means to protect neither remove a virus from the computer. In fact, it has no real module and database to be in the list of genuine security product.

Usually, System Diagnostic virus is using a Trojan to spread a copy. It usually hides malicious code on contracted web sites. In addition, fake multi-media web site is utilized to have the rogue tool be installed on the computer without visitor’s full knowledge. It may pretend as a basic multimedia player required by your system to be able to view online movies. Once installed, System Diagnostic will alter computer settings that will make itself to rule the system and gain complete control. It may block your programs from running and will end security-related process. In the end, it will advise you to purchase the System Diagnostic registration key to make the PC usable again.

The only solution to this computer problem is to remove System Diagnostic and all of the components it has planted on the system. You can achieve this by following the removal procedures below. Be sure to have the database updated before running a full anti-malware scan to detect newly created threats.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Added Registry Entries:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random].exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'

Associated Files and Folders:

%AllUsersProfile%\Application Data\[random].dll
%AllUsersProfile%\Application Data\[random].exe
%AllUsersProfile%\Application Data\[random]
%AllUsersProfile%\Application Data\[random].exe
%AllUsersProfile%\Application Data\~[random]
%AllUsersProfile%\Application Data\~[random]

Manual Removal Procedure

1. Press Ctrl+Alt+Del on keyboard to stop the process associated to "System Diagnostic". When Windows Task Manager opens, go to Processes tab. Find and end this process.
(random characters).exe

2. You need to update your installed antivirus software. Please connect to the Internet and download the most recent database. This is a one-click process from your AV program’s console.
3. Thoroughly scan the computer and remove any threats found by your antivirus program. If delete option is not available, your best next choice is to quarantine the infected file. There is also a need to manually locate and delete malicious files. Please see the file section for items that are relevant to System Diagnostic Virus.

4. Next, you need to remove registry entries created by System Diagnostic. Please refer to registry section to view entries related to the rogue program. [how to edit registry]
5. Exit registry editor when you are done.

6. Get rid of System Diagnostic start-up entry by going to Start > Run, type msconfig on the "Open" dialog box. It will launch a new window containing System Configuration Utility. Click on the Startup tab and uncheck the following item.
(random characters).exe

7. Click Apply. You need to restart Windows.

System Diagnostic Virus Removal Tool

For not so technical users that cannot comprehend with the manual removal. This automatic detection and cleaner is recommended. However, you need to download and install a tool to complete this process. The tool is free to download. We highly advise the use of this program to automatically delete all files and registry entries created by System Diagnostic. Remember that erasing system files required by the operating system may cause erratic behavior. It may also lead to system malfunction. Proceed with System Diagnostic automatic removal.

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Click here to download and run SAS Portable Scanner.