« previous next »
Pages: 1 [2]   Go Down

Author Topic: Removing Security Tool malware  (Read 8915 times)

0 Members and 1 Guest are viewing this topic.

Offline LC EFA

  • Hickus Australianus
  • In Memoriam
  • Hero Member
  • *****
  • Posts: 4527
  • Reputation: +414/-33
Re: Removing Security Tool malware
« Reply #25 on: November 26, 2010, 04:21:59 PM »
The task manager supplied with windows is crap. It doesn't show "hidden" processes.

Try using either Process Explorer or AntiSpy.Info
Logged

Offline Chris_

  • Little Lebowski Urban Achiever
  • Hero Member
  • *****
  • Posts: 46845
  • Reputation: +2028/-266
Re: Removing Security Tool malware
« Reply #26 on: November 26, 2010, 04:23:46 PM »
Yeah, Process Explorer is good.  Usually, the name of the running process matches the .exe file.  Once you have that, you should be able to run a basic search on that string.
Logged
If you want to worship an orange pile of garbage with a reckless disregard for everything, get on down to Arbys & try our loaded curly fries.

Offline Texacon

  • Super
  • Hero Member
  • *****
  • Posts: 12311
  • Reputation: +1250/-55
  • All The Way!
Re: Removing Security Tool malware
« Reply #27 on: November 27, 2010, 01:16:35 AM »
BSS ... Have you run a program called rkill?  This program is designed to kill KNOWN malware processes.  Nothing more nothing less.  You run it then, without rebooting the machine try to install and scan with Mbam or SAS.

Another thing you may need to do is run a rootkit unhooker program.  RKUnHooker is a good one.

Be patient. 

KC
Logged
  Build a man a fire and he'll be warm for a day.  Set a man on fire and he will be warm for the rest of his life.

*Stolen

Offline BlueStateSaint

  • Here I come to save the day, because I'm a
  • Hero Member
  • *****
  • Posts: 32553
  • Reputation: +1560/-191
  • RIP FDNY Lt. Rich Nappi d. 4/16/12
Re: Removing Security Tool malware
« Reply #28 on: November 27, 2010, 06:40:29 AM »
Quote from: Texacon on November 27, 2010, 01:16:35 AM
BSS ... Have you run a program called rkill?  This program is designed to kill KNOWN malware processes.  Nothing more nothing less.  You run it then, without rebooting the machine try to install and scan with Mbam or SAS.

Nope.  I'll try that one, too.

Quote from: Texacon
Another thing you may need to do is run a rootkit unhooker program.  RKUnHooker is a good one.

I'm about to try almost anything--including physical violence.

Quote
Be patient.

It's tough!  Eventually, it reverts to "The Blue Screen of Death."
Logged
"Timid men prefer the calm of despotism to the tempestuous sea of Liberty." - Thomas Jefferson

"All you have to do is look straight and see the road, and when you see it, don't sit looking at it - walk!" -Ayn Rand
 
"Those that trust God with their safety must yet use proper means for their safety, otherwise they tempt Him, and do not trust Him.  God will provide, but so must we also." - Matthew Henry, Commentary on 2 Chronicles 32, from Matthew Henry's Commentary on the Whole Bible

"These anti-gun fools are more dangerous to liberty than street criminals or foreign spies."--Theodore Haas, Dachau Survivor

Chase her.
Chase her even when she's yours.
That's the only way you'll be assured to never lose her.

Offline Chris_

  • Little Lebowski Urban Achiever
  • Hero Member
  • *****
  • Posts: 46845
  • Reputation: +2028/-266
Re: Removing Security Tool malware
« Reply #29 on: November 27, 2010, 12:08:41 PM »
I tried rkill on the Security Tool infection and it didn't work.
Logged
If you want to worship an orange pile of garbage with a reckless disregard for everything, get on down to Arbys & try our loaded curly fries.

Offline Texacon

  • Super
  • Hero Member
  • *****
  • Posts: 12311
  • Reputation: +1250/-55
  • All The Way!
Re: Removing Security Tool malware
« Reply #30 on: November 27, 2010, 12:17:37 PM »
Quote from: chris_ on November 27, 2010, 12:08:41 PM
I tried rkill on the Security Tool infection and it didn't work.

Yeah, rkill didn't help me a lot on one of my infections but it did on another fake AV.  I'm thinking BSS has a rootkit infection but I'm no expert.  It just looks like some other stuff I've experienced.

KC
Logged
  Build a man a fire and he'll be warm for a day.  Set a man on fire and he will be warm for the rest of his life.

*Stolen

Offline Chris_

  • Little Lebowski Urban Achiever
  • Hero Member
  • *****
  • Posts: 46845
  • Reputation: +2028/-266
Re: Removing Security Tool malware
« Reply #31 on: November 27, 2010, 12:37:01 PM »
Have you found an executable for the virus yet, BSS?
Logged
If you want to worship an orange pile of garbage with a reckless disregard for everything, get on down to Arbys & try our loaded curly fries.

Offline BlueStateSaint

  • Here I come to save the day, because I'm a
  • Hero Member
  • *****
  • Posts: 32553
  • Reputation: +1560/-191
  • RIP FDNY Lt. Rich Nappi d. 4/16/12
Re: Removing Security Tool malware
« Reply #32 on: November 28, 2010, 04:19:21 PM »
Quote from: chris_ on November 27, 2010, 12:37:01 PM
Have you found an executable for the virus yet, BSS?

No, I haven't.  But, I did find "Automated Removal INstructions for System Tool using Malwarebytes' Anti-Malware" on Bleeping Computer.  I figure that, between the bad back and the two funerals I have to go to this week, I'll have enough down time to be able to fix this damned thing.
Logged
"Timid men prefer the calm of despotism to the tempestuous sea of Liberty." - Thomas Jefferson

"All you have to do is look straight and see the road, and when you see it, don't sit looking at it - walk!" -Ayn Rand
 
"Those that trust God with their safety must yet use proper means for their safety, otherwise they tempt Him, and do not trust Him.  God will provide, but so must we also." - Matthew Henry, Commentary on 2 Chronicles 32, from Matthew Henry's Commentary on the Whole Bible

"These anti-gun fools are more dangerous to liberty than street criminals or foreign spies."--Theodore Haas, Dachau Survivor

Chase her.
Chase her even when she's yours.
That's the only way you'll be assured to never lose her.

Offline Chris_

  • Little Lebowski Urban Achiever
  • Hero Member
  • *****
  • Posts: 46845
  • Reputation: +2028/-266
Re: Removing Security Tool malware
« Reply #33 on: November 28, 2010, 08:17:24 PM »
Quote from: BlueStateSaint on November 28, 2010, 04:19:21 PM
No, I haven't.  But, I did find "Automated Removal INstructions for System Tool using Malwarebytes' Anti-Malware" on Bleeping Computer.  I figure that, between the bad back and the two funerals I have to go to this week, I'll have enough down time to be able to fix this damned thing.
oh :(

Sorry to hear about the funerals.
Logged
If you want to worship an orange pile of garbage with a reckless disregard for everything, get on down to Arbys & try our loaded curly fries.

Offline BlueStateSaint

  • Here I come to save the day, because I'm a
  • Hero Member
  • *****
  • Posts: 32553
  • Reputation: +1560/-191
  • RIP FDNY Lt. Rich Nappi d. 4/16/12
Re: Removing Security Tool malware
« Reply #34 on: December 01, 2010, 05:14:17 PM »
Now I'm confused.  Yesterday, I tried to remove the System Tool 2.12 according to the directions on Bleeping Computer (again, Texacon, thank you for that!) but the process would seize up at around Step 4.  I tried it three times.  I was thoroughly distraught.  Not a good thing to be going into my wife's grandmother's wake.

I made it through the wake alright (back issues drove me nuts, though).  I didn't make it to the funeral, though, because of the back issues.  Anyway, I just went to turn on my PC, and accidentally signed in on my userid.  The System Tool 2.12 didn't show up.  Not sure why that was.  I just hope it stays off.

Thanks to all of you who helped me.  Even though you may not have suggested anything, knowing that someone was here to babble to means a lot.

I'll distribute H5s to all.
Logged
"Timid men prefer the calm of despotism to the tempestuous sea of Liberty." - Thomas Jefferson

"All you have to do is look straight and see the road, and when you see it, don't sit looking at it - walk!" -Ayn Rand
 
"Those that trust God with their safety must yet use proper means for their safety, otherwise they tempt Him, and do not trust Him.  God will provide, but so must we also." - Matthew Henry, Commentary on 2 Chronicles 32, from Matthew Henry's Commentary on the Whole Bible

"These anti-gun fools are more dangerous to liberty than street criminals or foreign spies."--Theodore Haas, Dachau Survivor

Chase her.
Chase her even when she's yours.
That's the only way you'll be assured to never lose her.

Offline Texacon

  • Super
  • Hero Member
  • *****
  • Posts: 12311
  • Reputation: +1250/-55
  • All The Way!
Re: Removing Security Tool malware
« Reply #35 on: December 01, 2010, 05:19:18 PM »
Quote from: BlueStateSaint on December 01, 2010, 05:14:17 PM
Now I'm confused.  Yesterday, I tried to remove the System Tool 2.12 according to the directions on Bleeping Computer (again, Texacon, thank you for that!) but the process would seize up at around Step 4.  I tried it three times.  I was thoroughly distraught.  Not a good thing to be going into my wife's grandmother's wake.

I made it through the wake alright (back issues drove me nuts, though).  I didn't make it to the funeral, though, because of the back issues.  Anyway, I just went to turn on my PC, and accidentally signed in on my userid.  The System Tool 2.12 didn't show up.  Not sure why that was.  I just hope it stays off.

Thanks to all of you who helped me.  Even though you may not have suggested anything, knowing that someone was here to babble to means a lot.

I'll distribute H5s to all.

BSS please make sure you post those logs on BC to make sure your machine is clean.  I've cleaned a couple (I thought) only to have the damn thing come back in spades.  It won't hurt to have your post working through the steps at BC because it takes so long for them to get to you.

KC
Logged
  Build a man a fire and he'll be warm for a day.  Set a man on fire and he will be warm for the rest of his life.

*Stolen

Offline Chris_

  • Little Lebowski Urban Achiever
  • Hero Member
  • *****
  • Posts: 46845
  • Reputation: +2028/-266
Re: Removing Security Tool malware
« Reply #36 on: December 02, 2010, 10:09:22 AM »
Argh!  Someone at work brought in their computer with this infection. 

Maybe I'll get lucky and I can just wipe everything out and start over again.
Logged
If you want to worship an orange pile of garbage with a reckless disregard for everything, get on down to Arbys & try our loaded curly fries.

Offline Janice

  • Hero Member
  • *****
  • Posts: 1446
  • Reputation: +169/-101
  • This election is about paychecks v. food stamps
Re: Removing Security Tool malware
« Reply #37 on: December 05, 2010, 09:38:01 PM »
This particular infection is one of the worst. I "deal" with it all the time.

Its best to handle this by initially slaving this to another machine (preferably one with a decent processor and memory) and running a thoroughly udpated version of Malwarebytes on it from there. Then put it back into the native machine and run Malwarebytes on it from there. (If you have to, you can run rkill initially to "clear the path" for installing and running Malwarebytes.) Then scan with an updated version of Spybot.

There ... squeaky clean and all good to go. :)
Logged
Reagan bankrupted the Soviet Empire ...

Obama is bankrupting the American Republic

Offline Thor

  • General Ne'er Do Well, Troublemaker & All Around Meanie!!
  • In Memoriam
  • Hero Member
  • *****
  • Posts: 13103
  • Reputation: +362/-297
  • Native Texan & US Navy (ret)
Re: Removing Security Tool malware
« Reply #38 on: December 05, 2010, 09:47:06 PM »
Quote from: Janice on December 05, 2010, 09:38:01 PM
This particular infection is one of the worst. I "deal" with it all the time.

Its best to handle this by initially slaving this to another machine (preferably one with a decent processor and memory) and running a thoroughly udpated version of Malwarebytes on it from there. Then put it back into the native machine and run Malwarebytes on it from there. (If you have to, you can run rkill initially to "clear the path" for installing and running Malwarebytes.) Then scan with an updated version of Spybot.

There ... squeaky clean and all good to go. :)

Most people don't have the knowledge to do that or the luxury of having multiple systems.
Logged
"The state must declare the child to be the most precious treasure of the people. As long as the government is perceived as working for the benefit of the children, the people will happily endure almost any curtailment of liberty and almost any deprivation."- IBID

I AM your General Ne'er Do Well, Troublemaker & All Around Meanie!!

"Congress has not unlimited powers to provide for the general welfare, but only those specifically enumerated."-Thomas Jefferson

Offline Janice

  • Hero Member
  • *****
  • Posts: 1446
  • Reputation: +169/-101
  • This election is about paychecks v. food stamps
Re: Removing Security Tool malware
« Reply #39 on: December 05, 2010, 10:28:33 PM »
It could also be "handled" on the infected machine alone as well. It takes a bit of skill and a lot of time for that too. What I would do is this:

Have rkill on a flash drive or preferably on a cd handy before starting the infected machine. And while your at it have malwarebytes and spybot installers on their as well. Start the machine. As it is loading to the desktop insert the flash drive or cd. Its very important to open that flash drive or cd and run rkill before the virus has a chance to "start" its "madness" because thats what rkill does ... it kills the virus processes before the virus has a chance to stop you.

The "skill" part is getting rkill working before the virus has a chance to "cut you off". It may take a few tries (restarting the machine) to get it. But its well worth the effort. Its a bit of a foot race to get the rkill going before the nasty does its business.

Once the virus processes has been stopped you are free to install and run malwarebytes. I would recommend staying off the internet at first run. But after the first run go ahead and go online to update malwarebytes. Install and update spybot too. You may have to check that proxy server is unchecked and that automatically detect settings is checked in the internet option > connections box as suggested above to get back online.

Its a pain .. but it works.
Logged
Reagan bankrupted the Soviet Empire ...

Obama is bankrupting the American Republic

Offline Thor

  • General Ne'er Do Well, Troublemaker & All Around Meanie!!
  • In Memoriam
  • Hero Member
  • *****
  • Posts: 13103
  • Reputation: +362/-297
  • Native Texan & US Navy (ret)
Re: Removing Security Tool malware
« Reply #40 on: December 05, 2010, 10:57:55 PM »
On systems that I can put my hands on, I just slave the infected hard disk. If I'm feeling lazy, I'll burn Malwarebytes and whatever other programs are needed to CD and do a safe mode install from the CD. I have the luxury of a five PC home network, though. Three of them run off of a KVM switch and are at my fingertips. I haven't had a virus since I quit running AVG and switched to Avast.
Logged
"The state must declare the child to be the most precious treasure of the people. As long as the government is perceived as working for the benefit of the children, the people will happily endure almost any curtailment of liberty and almost any deprivation."- IBID

I AM your General Ne'er Do Well, Troublemaker & All Around Meanie!!

"Congress has not unlimited powers to provide for the general welfare, but only those specifically enumerated."-Thomas Jefferson
Pages: 1 [2]   Go Up
« previous next »