System Tool

21 October 2010 Rogue 104 Comments

System Tool or also called as the SystemTool 2011 virus is another deadly and widely spread rogue security program. To penetrate a computer, this Trojan will take advantage of software and system vulnerabilities. It will expand contamination to as many computers that are linked via the Internet. When System Tool virus first hit the computer, some symptoms you may see includes browser redirects, homepage hijacking and a disabled anti-virus program. Moreover, your Internet browser homepage is pointed to fake online virus scanner web page where it will run a scan on your computer and give false findings.  Later, the fake AV advises you to download a copy of System Tool. It also suggests the same as tool as the only solution to get rid of detected threats. User who is not clever enough to identify fake from real program may suffer from the doom of this rogue software and begin to run into annoyances including many pop-up alerts and warning notices. Similarly, it will attempt to modify the Windows registry that may initiate System Tool virus scan every time the computer starts.

Refrain yourself from visiting dubious web site to avoid this malware because some of it will pretend as security portal and some are presented as a multimedia pages. Whichever page you arrived, it will require visitor to download a required program to be able to proceed.

For someone who is unlucky to be infected with rogue security product, immediately obtain our suggested anti-malware solution as stated below. This will instantly remove System Tool and other hidden files on the system. Besides, you should only entrust solving cases like this to genuine security product.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Malware Behavior
System Tool virus will modify desktop wallpaper and set an image as the default, it will contain the following messages:

WARNING!
YOUR’RE IN DANGER!
YOUR COMPUTER IS INFECTED WITH SPYWARE!
ALL YOU DO WITH COMPUTER IS STORED FOREVER IN YOUR HARD DISK.
WHEN YOU VISIT SITES, SEND EMAILS… ALL YOUR ACTIONS ARE LOGGED. AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS. YOUR DATA IS STILL AVAILABLE FOR FORENSICS. AND IN SOME CASES

Added Registry Entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\"[Random Letters and Numbers]" 
= "%SystemDrive%\Documents and Settings\All Users\Application Data\[Random Letters and Numbers]\[Random Letters and Numbers].exe"

Associated Files and Folders:

%Temp%\[Random]
%UserProfile%\Start Menu\Programs\System Tool 2011.lnk
%UserProfile%\Start Menu\Programs\SystemTool2011.lnk
%UserProfile%\Start Menu\Programs\System Tool\System Tool 2011.lnk
%UserProfile%\Start Menu\Programs\System Tool\SystemTool2011.lnk
%UserProfile%\Desktop\System Tool 2011.lnk
%UserProfile%\Desktop\SystemTool2011.lnk
%systemdrive%\Users\All Users\Application Data\oHaKo00902
%systemdrive%\Users\All Users\Application Data\oHaKo00902\oHaKo00902
%SystemDrive%\Documents and Settings\All Users\Application Data\[Random Letters and Numbers]\[Random Letters and Numbers].exe
%SystemDrive%\Documents and Settings\All Users\Application Data\[Random Letters and Numbers]\[Random Letters and Numbers]

File Location for Windows Versions:

• %UserProfile% for Vista/7 user is C:\Users\<Current User> for Windows Vista/7, for Windows XP/2000 this is C:\Documents and Settings\<Current User>.
• %SystemDrive% refers to any drive including external removable devices.
• %Temp% refers to C:\Windows\Temp\.

Manual Removal Procedure

1. Press Ctrl+Alt+Del on keyboard to stop the process associated to "System Tool". When Windows Task Manager opens, go to Processes tab. Find and end this process.
(random characters).exe

2. You need to update your installed antivirus software. Please connect to the Internet and download the most recent database. This is a one-click process from your AV program’s console.

3. Thoroughly scan the computer and remove any threats found by your antivirus program. If delete option is not available, your best next choice is to quarantine the infected file. There is also a need to manually locate and delete malicious files. Please see the file section for items that are relevant to System Tool.

4. Next, you need to remove registry entries created by System Tool. Please refer to registry section to view entries related to the rogue program.
- (Windows 2000/XP) Go to Start > Run, type "regedit" on dialog box then press Enter on keyboard.
- (Windows Vista/7) Go to Start > Search Program and Files, type "regedit" and press Enter.

5. Exit registry editor when you are done.

6. Get rid of System Tool start-up entry by going to Start > Run, type msconfig on the "Open" dialog box. It will launch a new window containing System Configuration Utility. Click on the Startup tab and uncheck the following item.
(random characters).exe

7. Click Apply. You need to restart the computer.

System Tool Remover

In order to remove "System Tool" virus completely, you need to download and run Malwarebytes Anti-Malware. This is a free malware removal tool. If Trojan infection blocks the downloading of this program, get it using a clean computer. Rename the executable file before executing on the infected PC.