Security Tool Virus a rogue anti-virus spreads via a fake warning page that looks just like the Firefox block page. The fake site prompts users with updates for Mozilla Firefox, but the update is actually an installer for Security Tool Virus. The story was originally reported by F-Secure.
If a user downloads the Mozilla fake update, they will be warned about an infection on the computer. The user, if convinced, will only be purchasing scareware authored by cyber-criminals in attempt to steal your money.
Image provided by F-Secure
The rogue application will automatically attempt to install itself on the machines of prospective marks in cases where scripts are enabled, net security firm F-Secure warns.
Firefox’s genuine attack warning technology is all server-side and never requests that users download updates. The attack relies, in part, on the ignorance of the majority of potential victims on this point.
If you were a victim of this scam and your computer is infected, please follow the removal instructions listed below and also visit the related articles to learn more on how to remove Security Tool Virus.
How to Remove Security Tool Virus
Manually
- Stop Security Tool Processes: [random numbers].exe
- Remove Security Tool Files
- C:\Documents and Settings\All Users\Application Data\[random numbers]\
- C:\Documents and Settings\All Users\Application Data\[random numbers]\[random numbers].exe
- Remove Security Tool
Registry Keys
*HKEY_CURRENT_USER\Software\Security Tool
*HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Tool
- Remove Security Tool Startup Entry: [random numbers].exe
Automatically
- You can also download MalwareBytes Anti-Malware to remove Security Tool Virus.
- F-Secure has already updated their AV product to block and remove Security Tool Virus. They offer a 30 day free trial of Anti-Virus 2010.
Related Articles
Security Tool Virus Spreads Via Fake Adobe Update
Security Tool Installs as a Firefox and Flash Update
Security Tool Virus Update and Removal
How to Remove Security Tool Virus
Quite informative and useful but technically a little difficult to understand but thanks a lot for sharing it with us.
Here’s a simpler method I just used, though maybe this was a little too simple? I found where the file was loacted on my harddrive. It wouldn’t allow itself to be deleted because it was running. But it did allow me to rename the file. I changed the file suffix from .exe to .jpg, then restarted the PC. Of course, the file didn’t load at reboot, so I was able to go in, delete it, and its shortcut too. I then deleted it out of my recycle bin, and it really seems to be gone: no sign of it now. Did I really get rid of it, or was this just a little too easy of a solution?
Wow. That’s actually really clever and would definitely fool a lot of people. When I first saw the screenshot, I was also confused and thought that Firefox gave that warning until I saw that mysterious Download Updates button.
According to that F-Secure link, it looks like there’s a Google Chrome version of that page too.
Thanks for sharing! :)
Brian,
It’s pretty clever for sure on how they pass this download. Thanks for the comment!
Hi, we have this virus on one of our pc’s at work..tried all suggestions to get rid, but pc switches itself off before I can complete any downloads!!!
Any ideas??
Cheers,
Helen
Helen,
There are a few articles here on how to remove Security Tool have you tried any of them?
thak you for this useful article….i have had with the problem in firefox,so i use chrome..but after getting this solution i can able to work with firefox properly…thanks again.