Security Tool
Security Tool is a rogue antivirus application that deliberately gives reports of false system security threats on your computer and displays fake security alerts or notifications to make you think your PC is infected with malware. The misleading application is from the same family as Total security 2009 and System Security. When installed, SecurityTool will be configured to start automatically when you log on into Windows. Then it will imitate system scan and display a variety of infections that can't be removed unless you purchase the program. The files detected during the scan are either harmless or legitimate system files and can't cause any damage to your computer.
Security Tool is pushed through the use of Trojans, fake online anti-malware scanners and other malicious software. It is installed along with Trojans FakeAV that display fake security warnings and promote SecurityTool malware. Once running, the bogus program will block legit programs and especially anti-virus software. Another interesting thing is that if you click on Updates button, you will see "Updating", but actually there is no network activity. It's just another argument why Security Tool is classified as a rogue security application. What is more, this parasite will impersonate Windows Security Center and constantly display warnings/notifications about serious security threats and privacy issues. It may claim that your computer is under attack by an Internet virus or that private data can be stolen. For example:
"Security Tool Warning
Spyware.IEMonster activity detected. This is spyware that attempts to steal passwords from Internet Explorer, Mozilla Firefox, Outlook and other programs. Click here to remove it immediately with SecurityTool."
To make things worse, SecurityTool will hijack web browsers and block certain security websites obviously to protect itself from being deleted. It should be already obvious that this p...
Thu, 11 Mar 2010 13:03:46 CST
Virus Protector
Virus Protector is a rogue anti-virus program that reports false threats or infections on your computer and then prompts you to pay for a full version of the program to protect yourself and to remove the infections which don't even exist. Besides the rogue program creates numerous fake files and then detect those files as serious infections. As you can see this is nothing more but a scam. And you probably didn't install this program, so why should you purchase it anyway. Instead, please use the removal guide below to remove Virus Protector from your computer either manually for free or with an automatic removal tool. One way or another, this infections should be removed from the system as soon as possible.
[Figure 1. Virus Protector graphical user interface]
Most of the time, Virus Protector is promoted through the use of trojans and other malware. Trojans come from fake online scanners or other bogus sites and then download this fake program onto your computer. Once installed, VirusProtector will run a fake system scan and display a list of infections that can't be removed unless you first purchase the program. Obviously, it wasn't designed to do that, so it won't remove any infections. What is more, it will display many fake security alerts and pop-ups claiming that your computer is under attack or baldy infected by Trojans. Non of these statements are true. Don't be fooled, Virus Protector just tries to scare you. Some of the fake alerts states:
Process Blocked!
Harmful memory infection was detected.
Process [name].exe was terminate
Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of Virus Protector and remove spyware threats from your PC.
Without a doubt, Virus Protector was created for only one purpose - to steal money from inexperienced users. Don't trust this bogus soft...
Thu, 11 Mar 2010 12:03:49 CST
Sdbot.add
Sdbot.add is a dangerous widely spread worm that propagates mostly through unprotected network shares found on a local network. Once executed, the parasite drops a rootkit that allows the remote intruder to break into the infected system. Sdbot.add also runs a backdoor controlled through the IRC network. This backdoor gives the attacker unauthorized remote access to a compromised computer and allows to control it. Sdbot.add secretly runs on every Windows startup.
Thu, 11 Mar 2010 10:03:29 CST
Lsas.Blaster.Keylogger
Lsas.Blaster.Keylogger is a bogus security threat displayed in a fake security alert from rogue anti-spyware application called System Security. The fake alert states that Internet Explorer is infected with worm Lsas.Blaster.Keyloger and that this worm is trying to send your credit card details using Internet Explorer to connect to remote host. System Security displays this fake alert in order to trick you into purchasing the program. Simply ignore this fake alert and remove System Security from your computer immediately.
Thu, 11 Mar 2010 09:03:56 CST
XP Guardian
XP Guardian is a fake anti-spyware program that is distributed through the use of Trojans or comes bundled with other malware. Once a Trojan virus is installed, it will impersonate an Automatic Windows Updates window and download the rogue program onto your computer. When the rogue program is active, it will imitate a system scan and report false system security threats. What is more, XPGuardian will constantly display fake security alerts and impersonate Windows Security Center to make the scam look more realistic. Finally it will ask you to pay for a full version of the program to remove the infections which don't even exist. Don't purchase it and remove XP Guardian virus from your computer upon detection.
[Figure 1. XP Guardian graphical user interface]
The worst thing about XP Guardian is that it actually protects itself quite well. It blocks legitimate security software and hijack web browsers. In some cases it blocks all programs, not only anti-virus or anti-spyware software. Furthermore, it will detect many of well known and reputable websites as harmful and display fake security alert stating that you may infect your PC if you open a particular website. And of course, it disables certain Windows functions such as Task Manager or Regedit. It's possible to remove it manually, but you have to re-enable those Windows functions at first. You may also download an automatic removal tool, but again have to fix some registry entries and terminate the main process of XPGuardian which is AV.exe to be able to run the removal tool.
XP Guardian removal instructions:
1. Click Start->Run (or WinKey+R). Input: "command". Press Enter or click OK.
2. Type "notepad" as shown in the image below and press Enter. Notepad will open.
3. Copy and past the following text into Notepad:
Windows Registry Editor Version 5.00
[-HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand]
[-HKEY_CURREN T_USERSoftware...
Thu, 11 Mar 2010 01:03:46 CST
|
