Security Tool- BEWARE!!

John_Gray

Richie-from-the-Boro wrote: »

we are, each of us, only as good as the collective group.

Err, could you run that past me again, please?

Richie-from-the-Boro

John_Gray wrote: »

Err, could you run that past me again, please?

- No .. .. .. but thanks for asking !
- if however you have a point, hopefully not conjured gerrymandering but adjacent to eve13 's problem, feel free to make it !

kerleytops

This has appeared twice when I have been playing games on Facebook.The game grinds to a halt and there is a "message from the webpage" then it tells you you are infected with multiple viruses / trojans. So far I have just closed it down or cancelled it and then run a virus scan just to be sure. A complete nuisance.

thor

Leon_W wrote: »

It's difficult to remove because you can't get internet access easily to find the solution and the pop ups just keep on coming. I had to download a small program called rkill onto another computer and transfer it on a memory stick to the infected laptop, ran the program which ends the "Security Tool" process. Then, as mentioned above, you have to use Malwarebytes to get rid completely.
!

About a week ago, a friend called me up asking about helping him because a pop up kept appearing telling him he was infected and that he could not get rid of it. I thought it might have been a piece oflegitimate antivirus or spyware software but he could not describe it properly. I went over to have a look myself and saw that it was this security tool. Now I had never heard of it before so I decided I had better google it. Sure enough, I found out what a devious bit trickery it was and proceeded to remove it using the combination of rkill and malawarebytes as described above.
The lesson here is that if you read around enough most of these problems can be eradicated without having to pay through the nose(or even at all).

NiVZ

My cousin just had this on her laptop and asked me to take a look (as I work in IT)

It's exactly the same one that you guys have described here. I re-booted into Safe Mode and had a look in regedit at:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

I found one that looked suspicious that was located in C:\Program Files\xxxxxx where xxxxx was a long random number. Looked in this folder and sure enough it had the same blue shield icon.

I deleted that key, and deleted the folder and re-booted and it's now back on the internet again.

I'll probably run another scan, or wipe it anyway but at least it's back on the web and I can now get her personal files off of it.

NiVZ

CHR15

Richie-from-the-Boro wrote: »

- No .. .. ..not conjured gerrymandering

I like that word, it's my word of the day.
I will definitely try to use it today at some point. :beer:

Richie-from-the-Boro

CHR15 wrote: »

I like that word, it's my word of the day.
I will definitely try to use it today at some point. :beer:

Feel free CHR15 your more that welcome. John Gray and I are always come together like peaches & creosote ! :T

Richie-from-the-Boro

.. . .. . shoud be : more than . . :beer: