Rogue Anti-Virus! Created 13 years ago2011-02-21 17:58:21 UTC by Suparsonik

Help would be appreciated. This nasty-assed program called "System Tool" decided to take a seat on my computer and will not let me get rid of it, I've tried using regedit to try to counter it, but it calls the program infected and will not let me do it. Is there any other ways to stop this without having to wipe my computer and start factory again?

Call the insurance guys.

Or install an antivirus program if you didn't already.

Have you tried safe-mode?

This will allow you to get to regedit and the taskbar to kill the little bastard. It's just a running program that is cutting off access to primary functions, such as regedit and possibly the taskbar.

Have you tried killing the process that is running this?

If you can't get your functions back in safe-mode chances are that you might not be able to handle it on your own. Seek more help locally.

My wife's and daughter's computer always get these things and most are harmless and easy to get rid of. You can also get rid of most of these things simply by making a new user account in windows. Alot of stupid malwares sit in your created user directory and not windows actually. If you have a folder called windows in your c:documents and settings/(your name) then you might want to be cautious.

Old malwares used to sit in the windows and sometimes the windows/system folder but Microsoft has done something to limit this now and like I said most malware ends up in your documents and settings. I usually just find my user name and search that entire folder for new items that were created maybe within the last day or two or whenever you got this "virus". Then, like I said, go into safe-mode and do some shredding. Most of the files are pretty easy to spot. If you are not comfortable with this then get some better advice.

The only reason I break it down is so that you will understand it a little better. It's better than the generic, "get spybot" response. These programs don't really work. I don't care what anyone says.

HiJack this is a nice little registry editor that will help you clean up alot. Google it and I am sure you will find a free version. If not, I have it around here somewhere and it's small enough to mail. lol

Hope this helps...

Thanks, I visited a few sites as well to see what I can do to kill it, and found a few answers. Thanks for the help though, I'll be checking out my docs.

If regedit doesn't work, perhaps you can remove it from msconfig. Do it in safe mode if you can, it's never a bad idea.

Tracked the fucker down and killed it, thanks for the help guys.

Well this is just great, apparently I didn't do a good enough job and I've been hit by another called "XP Home Security" Anyone else had to deal with this one before?

Format your PC and then stop downloading porn from shifty websites.

It's the same virus, lol. Sometimes they come in multiple pieces. Looks like your just renamed itself and started over. You really have to know your task manager and what is supposed to be running. Go in safe mode and kill the processes, find them in docs and settings, and then clean the registry. If you are not cleaning the registry then you might as well hang it up because it is just self-replicating.

And you don't need to format your pc every time and I get alot of these annoying viruses from searching yahoo images. Mostly re-directors tho.

I went through documents and setting multiple times, but didn't find anything out of the ordinary.

Yeah, I've had these nasty little buggers before. The one I had periodically opened a Internet Explorer window to an advertisement for something. I searched for it everywhere without luck, then I went to the task manager and found a suspisous program running called 'aaa' which I would end task. Then five seconds later, it was running again.

I tried to delete the actual program, but it would copy itself, give itself a different name and keep going. So, With Avast, i sent the executable to the virus vault and did an antivirus delete on the bastard. Gone forever!

So, how am I supposed to get avast or avg or whatever on my computer when it blocks everything I do?

EDIT: computer didn't have very many important things on it anyhow, just gonna format.

Does Safe mode work at all? Try and download a standalone installer (ie, doesn't need to go on the internet and download the files for you) then restart in safe mode, try installing it, wait, ???? , Profit (maybe)

You have the most common virus right now. Stop proning or torrenting.

In the mean time, use this. It will remove st2011

http://security.symantec.com/nbrt/npe.asp?lcid=1033

i would recommend imaging your drive once in a while(i do mine once a month or so). this way, if you get a nasty bugger like this, you can just restore your machine exactly to your last image. (pm me if you'd like more info on disk imaging)

either way, you should definitely format imo...

Get Spybot Search&Destroy. It helps to remove unwanted software and to undo most of what it does.

There are loads of guides on the internet on how to remove each of these infamous rogue spywares. Stop googling for cracks, I remember that's how I got it once back 6 years ago.

Yeah looking up cracks or serial numbers on google can get this kind of shit coming your way. There are plenty of other ways anyway, but this is an easy one.

Then again, you can get them out of nowhere. Last virus/malware I got, just popped up by itself as I hadn't visited any new or suspicious sites. And nobody else uses my computer.

no one here is really dumb enough to google for cracks/serials, are they?!

raises hand
Never gotten viruses from the rare occations I have though.

Anyway, don't take it the wrong way, it's not a matter of idiocy, rather ignorance. Most of us did it at some stage.

There's no harm Googling for serials (just don't download anything and don't do it in Internet Explorer). As for cracks, I totally agree. Ask people for trustworthy sites instead. I know two good ones but I'm not sure if I'm allowed to post their names on TWHL.