Security Tool

What is Security Tool?

Security Tool is scareware that performs various fake security scans and tries tricking PC users into buying it's full version. After Security Tool infects users computer, it will start automatically on every system startup.

The program is able to hijack your browser, monitor your Internet browsing activities, and change system files. This software attempts to imitate a genuine antivirus program by scanning your computer and displaying false scan results.

Do not purchase this program, it is a scam. Security Tool is a fake program created to scare you into believing that your computer is highly infected with spyware in an attempt to sell you the Security Tool license.

In fact, Security Tool does not actually scan your computer and none of the ‘detected’ security issues actually exist.

The scan process is imitated and the scan results are fake. The list of security threats is long and only displayed to scare you.

You should not trust Security Tool. This program is designed by Internet criminals to steal money from your credit card account.

Fake security warning messages generated by "Security Tool" virus:

“Spyware.IEMonster activity detected. This is spyware that attempts to steal passwords from Internet Explorer, Mozilla Firefox, Outlook, and other programs. Click here to remove it immediately with SecurityTool.”
“Some critical system files of your computer were modified by a malicious program. This may cause system instability and data loss. Click here to block unauthorised modification by removing threats (Recommended).”
“Security Tool WARNING: Programs have been intercepted on your system that may compromise your privacy and harm your PC. Click here to remove them immediately with Security Tool.”
“Security Tool WARNING: 23 infections found!!!”

Bear in mind that these security warnings are as fake as the Security Tool program itself. If your computer is infected with this fake antivirus program, you should remove it immediately.

Security Tool is mostly propagated via Trojans or malicious websites and is often bundled with shareware or other downloadable software. After a Security Tool infection, your system performance may decrease.

If you see a Security Tool window on your desktop, you should remove it from your computer immediately. This is a rogue antivirus program and its purpose bears no resemblance to that of a genuine security program.

Do not be impressed by the professional appearance of this program. It is a scam that should be removed from your PC.

Use the information provided below to remove this bogus program.

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is Security Tool?
• STEP 1. Remove Security Tool using Safe Mode with Networking.
• STEP 2. Remove Security Tool manually by deleting files and registry entries.

Security Tool virus removal

1. Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK.

During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.

2. Download HijackThis and save it to your desktop. Some malicious programs are able to block HijackThis, so when you click the download link, in the Save dialog, rename HijackThis.exe to iexplore.exe and only then click the Save button.

After saving the file to your desktop, double click it. In the main HijackThis window click the “Do a system scan only” button.

Select the following entry (place a tick at the left of the entry):

O4 – HKLM\..\Run: [96015930] C:\Documents and Settings\All Users\Application Data\96015930\96015930.exe

After selecting the required entry, click "Fix Checked". After this procedure you can close HijackThis and proceed to the next removal step.

3. After this procedure, you should be able to download anti-spyware software and eliminate Security Tool. Recommended download: Malwarebytes antimalware.  If you cannot run Malwarebytes antimalware, Rename mbam-setup.exe to something.exe (or another name) and run it.

After you have installed the software, try to launch it. If nothing happens (the program doesn't start), go to the folder "C:\Program Files\Malwarebytes' Anti-Malware" and create a copy of the "mbam.exe" file and rename it to "start.exe" and run it. After this procedure, your software should run OK.

4. After downloading anti-spyware software, install it, update it, and then run a full system scan. Remove all infections found.

Some malicious software modifies browser settings and disables downloads of spyware and virus removal software. If you have problems downloading anti-spyware software with Internet Explorer, try downloading with an alternative browser, such as Chrome, Firefox, Opera, etc.

If you are unable to remove Security Tool, you can use these manual removal instructions. Use them at your own risk, since if you do not have strong computer knowledge, you could harm your operating system.

Use them only if you are an experienced computer user. (Instructions on how to end processes, remove registry entries...)

End these Security Tool processes:

4946550101.exe

Disable these Security Tool dll files:

doguzeri.dll

Remove these Security Tool registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SecurityTool”
HKEY_CURRENT_USER\Software\Vista Antivirus 2010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SecurityTool
HKEY_LOCAL_MACHINE\SOFTWARE\SecurityTool
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "4946550101"

Delete these Security Tool files:

%System Root%\Samples
%User Profile%\Local Settings\Temp
%Program Files%\SecurityTool
%Program Files%\SecurityTool
C:\ProgramData\[random numbers]\
%Documents and Settings%\All Users\Start Menu\Programs\SecurityTool
%Documents and Settings%\All Users\Application Data\SecurityTool
doguzeri.dll
4946550101.exe
4946550101.cfg

Summary:

The fake antivirus programs (also known as "rogue antivirus programs" or "scareware") are applications that tries to lure computer users into paying for their non-existent full versions to remove the supposedly detected security infections (although the computer is actually clean). These bogus programs are created by cyber criminals who design them to look as legitimate antivirus software. Most commonly rogue antivirus programs infiltrate user's computer using poop-up windows or alerts which appear when users surf the Internet. These deceptive messages trick users into downloading a rogue antivirus program on their computers. Other known tactics used to spread scareware include exploit kits, infected email messages, online ad networks, drive-by downloads, or even direct calls to user's offering free support.

A computer that is infected with a fake antivirus program might also have other malware installed on it as rogue antivirus programs often are bundled with Trojans and exploit kits. Noteworthy that additional malware that infiltrates user's operating system remains on victim's computer regardless of whether a payment for a non-existent full version of a fake antivirus program is made. Here are some examples of fake security warning messages that are used in fake antivirus distribution:

Computer users who are dealing with a rogue security software shouldn't buy it's full version. By paying for a license key of a fake antivirus program users would send their money and banking information to cyber criminals. Users who have already entered their credit card number (or other sensitive information) when asked by such bogus software should inform their credit card company that they have been tricked into buying a rogue security software. Screenshot of a web page used to lure computer users into paying for a non-existent full version of security tool rogue and other rogue antivirus programs:

To protect your computer from security tool rogue and other rogue antivirus programs users should:

• Keep their operating system and all of the installed programs up-to-date.
• Use legitimate antivirus and anti-spyware programs.
• Use caution when clicking on links in social networking websites and email messages.
• Don't trust online pop-up messages which state that your computer is infected and offers you to download security software.

Symptoms indicating that your operating system is infected with a fake antivirus program:

• Intrusive security warning pop-up messages.
• Alerts asking to upgrade to a paid version of a program to remove the supposedly detected malware.
• Slow computer performance.
• Disabled Windows updates.
• Blocked Task Manager.
• Blocked Internet browsers or inability to visit legitimate antivirus vendor websites.

If you have additional information on security tool rogue or it's removal please share your knowledge in the comments section below.

▼ Show Discussion