Part 1: Symptom of Security Tool

Part 2: Manual and automatical removal guide

Part 3: Solution of infection by a new variant

Security Tool is a rogue antispyware program. It belongs to a rogue program family, all variants of this rogue program family is listed below: they use the same method to infect your computer.

• XP Security Tool
• Vista Security Tool
• Win7 Security Tool

Once infected by one of above variant, one or two processes with random number name will appear in task manager:

This random process file is located in "Application Data" folder, the "Application Data" folder is :
For Windows XP : C:\Documents and Settings\%User Name%\Local Settings\Application Data
For Windows Vista/7 : C:\Users\%User Name%\AppData\Local
Note : %User Name% is the name you login.

This malware will add severy entries in registry so that it can be launched automatically every time Windows is restarted.Once it is active, it will protect those registry entries from being deleted. :

Modified registry entries by Security Tool :

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_Dlls



HKEY_LOCAL_MACHINE\Software\Microsoft\Window\CurrentVersion\Run\%Random Number%:C:\Documents And Settings\All Users\Application Data\%Random Number%\%Random Number%.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\%Random Character%:Rundll32.exe "C:\Windows\System32\%Random Character%.dll"

This malware keep poping up a window pretending to scan your computer and giving false malware infection report.

Manual removal instructions

Due to this malware add lots of entries in registry and protect itself from being removed, so manually removing this malware basically is a mission impossible, you better look for some antispyware programs to remove this malware automatically.

Automatical Removal instructions

Several antispyware programs can completely remove this malware:

MalwareBytes:
MalwareBytes is an excellent antispyware program, The company of MalwareBytes provides a free version for personal user.
Download and install MalwareBytes Anti-malware (MBAM).

Main interface of MalwareBytes' Anti-Malware

AVG Antivirus:
AVG Antivirus is another well-known antivirus protection tool. The AVG Free Edition is available free of charge to home users for the life of the product.

Download and install AVG Free Edition

Main interface of AVG

If you followed the steps above but still get this malware or some objects are denied to delete, your computer possibly gets infected by a new variant or there is some hidden objects that have not been detected. We provide a free diagnostic scan tool ("TheStubware") to scan your computer and generate a scan log file for analysis. This tool is especially used to find those stubborn malware. You can submit your log file to support@TheStubware.com, we will analysis it and send you back a removal script file to remove the new variant or hidden objects found in your log file.

Download and install TheStubware