"Security Tool" removal

Grumpy_Old_Duffer

The above malicious software installed itself on my partners laptop. Seen on websites that this can be removed manually, or using 'Spyware Doctor'. Not being overly confident in my ability to remove this manually I went to download 'Spyware Doctor' on her laptop, but when it gets to the end of downloading it seems that "Security Tool" has either deleted it, hidden it or done something so that I can't find it. So I downloaded 'Spyware Doctor' using my laptop then used a memory stick to copy it onto the Desktop of her laptop, but everytime I go to run/install the program "Security Tool" keeps preventing it from running and interupts any attempt with the £%@@** pop-ups.

Any advice greatly received. If it's best to remove "Security Tool" manually then I will need 'Janet & John' instructions!!:)

superrug_2

Firstly try using http://www.malwarebytes.org/ download and try and run , if this works will remove for you if not.

1. Stop Security Tool Processes: [random numbers].exe (CTRL+ALT+DELETE) click on the process tab.
2. Remove Security Tool Files
3. C:\Documents and Settings\All Users\Application Data\[random numbers]\
4. C:\Documents and Settings\All Users\Application Data\[random numbers]\[random numbers].exe
5. Remove Security Tool Registry Keys*HKEY_CURRENT_USER\Software\Security Tool
   *HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Tool
6. Remove Security Tool Startup Entry: [random numbers].exe

aliEnRIK

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_malwarebytes_anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM FULL SCAN then click SCAN
Post the COMPLETE log here AFTER youve deleted everything it finds


reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

Grumpy_Old_Duffer

Tried both methods. MALWAREBYTES won't run and Taskmgr won't open via Ctrl-Alt-Delete or by typing 'taskmgr' in the 'Start Search' box under Start. Each time I try to run 'taskmgr' the pop-ups from 'Security Tools' say it's infected with Lsas.blaster.keylogger.

Heeeeelp!

notbritishgas

Grumpy_Old_Duffer wrote: »

Tried both methods. MALWAREBYTES won't run and Taskmgr won't open via Ctrl-Alt-Delete or by typing 'taskmgr' in the 'Start Search' box under Start. Each time I try to run 'taskmgr' the pop-ups from 'Security Tools' say it's infected with Lsas.blaster.keylogger.

Heeeeelp!

Try running Malwarebytes in Safe Mode.
When the computer is booting up keep tapping the F8 key you should eventually get a menu giving several options, choose Safe mode + networking. That should enable you to update malwarebytes and then run it. You could also then try all of the other recommendations.

dogmaryxx

Hitman Pro 3 - Second Opinion Malware Scanner

Download Now (32-bit) | Download Now (64-bit) | Release History


Unlimited free scanning and free 30-day version to remove detected malware
Runs on Windows XP/Vista/2000/2003/2008 and Windows 7

Download above. To ensure being able to launch, hold down left Ctrl at same time.

John_Gray

By coincidence, I cleared "Security Tool" off a colleague's daughter's laptop (Win7 Home Prem) yesterday, using Malwarebytes in Safe Mode, once it had been installed. After Malwarebytes had run, SuperAntiSpyware only found some tracking cookies. After removing "Security Tool" then McAfee (which was already on there, and supposed to be protecting the laptop) suddenly started working again, and its scan found nothing further.

aliEnRIK

Reboot and keep pressing F8 to get into SAFE MODE WITH NETWORKING

Try from there
if still no good then RIGHT click the .exe files and RENAME them to something random (bf783qtgvq.exe)

Grumpy_Old_Duffer

Yeeeee Haaaah!!

Thanks all, worked a treat in Safe Mode with Networking, and MALWAREBYTES found 5 objects all relating to that crappy program and dealt with 'em.:j:beer::T:D

Browntoa

can we see the malwarebytes log file please

Grumpy_Old_Duffer

Browntoa wrote: »

can we see the malwarebytes log file please

Excuse me if I seem cautious, but why do you want to see the logs. I'm no expert so don't want to post anything on an open forum that could give information about a personal laptop.