Security Tool Installs as a Firefox and Flash Update

by on 07/28/2010 in Fake Antivirus, Security

The pesky Security Tool Virus is back again, but this time, the rogue distributors are using a different tactic to get users to install this malicious and fake antivirus program.

The old trick was false and exaggerated scans that would make a user believe that their system is infected. The playing field has changed as these criminals are now using a fake Firefox “Just Updated” page. This is the page that loads immediately after an Firefox update.  The page shows a message that tells the user that they need to update their Adobe Flash Player.

Fake Firefox Update Installs Security Tool Virus

Once a user is on the “Just Updated” page, a download dialog box will pop-up automatically without the user clicking anything on the page. If the user clicks “Save File” the rogue antivirus program will be installed. This rogue program will wreck havoc on a users system and cause the system to be unusable.

Security Tool Virus

How to remove Security Tool Virus

Manually

  1. Stop Security Tool Processes: [random numbers].exe
  2. Remove Security Tool Files
  3. C:\Documents and Settings\All Users\Application Data\[random numbers]\
  4. C:\Documents and Settings\All Users\Application Data\[random numbers]\[random numbers].exe
  5. Remove Security Tool Registry Keys

*HKEY_CURRENT_USER\Software\Security Tool
*HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Tool

  1. Remove Security Tool Startup Entry: [random numbers].exe

Automatically

  • You can also download MalwareBytes Anti-Malware to remove Security Tool Virus.
  • F-Secure has already updated their AV product to block and remove Security Tool Virus. They offer a 30 day free trial of Anti-Virus 2010.

Read more removal instructions and comments here.

18 Responses to “Security Tool Installs as a Firefox and Flash Update”

  1. Elaine

    Jul 28th, 2010

    Hi,
    I accidently (don’t ask how) downloaded and installed this irritating virus and cannot get rid of it. I’ve tried to scan my system with malwarebytes anti malware-tool but it doesn’t help. When I start my computer in regular model the virus is still there. I cannot stop the process because I cannot open the task manager to do that because the virus blocks task manager.

    What should I do?? Is there another way to stop processes than by using windows task manager?

    • Frank Jovine

      Jul 28th, 2010

      Elaine,

      Try following the manual removal instructions. If you do are not sure what to do, read through the comments in the post here.

    • ChubbZ

      Aug 8th, 2010

      Hello, I had the same issue with task manager myself. The trick that worked is to do the following:
      1 Hard reboot the computer
      2 once the computer shows loading personal settings hit CTRL+ALT+DELETE

      The virus works on sysstems when its up and running if you get this open prior to ST’s boot process you will be golden. From there you enter proccesses and close out the (random number) exe process. mine was 3621351.exe yours may be similar. once that it stopped you can enter what you wish but i recommend downlaoding the free version of Malwarebytes intsalling it and running it on full imediatly.

    • ChubbZ

      Aug 8th, 2010

      Hello, I had the same issue with task manager myself. The trick that worked is to do the following:
      1 Hard reboot
      the computer
      2 once the computer shows loading personal settings hit CTRL+ALT+DELETE
      The virus works on sysstems when its up and running if you get this open prior to ST’s boot process you will be golden.

      • Frank Jovine

        Aug 8th, 2010

        Chubbz,

        Thank you for the added help to remove this virus.

  2. BobJam

    Jul 29th, 2010

    I hate to say it, and don’t mean to start a flame war here, but this is just one more reason to use ‘nix.

    • Frank Jovine

      Jul 29th, 2010

      Bob,

      It sounds like an article for a guest post. :)

  3. Neil Asher Scam

    Jul 30th, 2010

    great post , very useful for me.thanks for sharing.

  4. Shane

    Jul 30th, 2010

    Does this also infect Macs?

    • Frank Jovine

      Jul 30th, 2010

      Shane,

      It only affects Windows based systems as the program can only be installed on Windows.

      • Shane

        Jul 30th, 2010

        That’s good to know. One of my family members just asked me about difficulties they had installing the latest version of Flash on their Macbook. Possibly downloaded the Security Tool, but could not install?

        • Frank Jovine

          Jul 30th, 2010

          Shane,

          I haven’t heard of any news about Macs being vulnerable to this rogue virus.

  5. Elaine

    Jul 30th, 2010

    Hi again,
    Thanks a lot for the instructions! Unfortunately even those didn’t help me. The virus blocks the acces even to regedit. So I cannot delete anything from registry-> I cannot get rid of security tool. I also tried to run a tool which would clean the editor but security tool doesn’t let me to run it..

    Is there anything else I could try?

    • Frank Jovine

      Jul 30th, 2010

      Elaine,

      You can try installing Hijackthis. This program will find settings changed by spyware, malware, or other unwanted programs. Go to http://free.antivirus.com/hijackthis/. If this doesn’t work have you used system restore? You would have needed to restore your system recently in order to use this windows utility. You just need to select a date when you think your system was clean.

    • Daniel

      Aug 1st, 2010

      Hi Elaine,

      The method I used to remove this nasy virus was to restart the computer in safe mode, on the start bar you should have an icon saying ‘security tool’, right click this and COPY the file name (should be 6 numbers? something like that) then go into regedit > search registry, you then want to PASTE the file name into the search and delete any entry relating to that file name (I think there was 4 or 5 entrys), then go back to start, right click the file once again and get the whoel path name and delete the .exe

      After that run a virus scan, registry scan and restart the computer, should be good to go after that.

      Hope that helps, if you havnt already sorted it :)

  6. zezebel

    Jul 31st, 2010

    Thank you Frank.
    I hope this solution of yours will work on my office PC.
    A dialog box keep asking me to save a file everytime I login to some flash games online.

    • Frank Jovine

      Jul 31st, 2010

      zezebel,

      Let me know if the removal is successful on your office PC.

  7. Relemac

    Aug 3rd, 2010

    Good Posting ! keep it up.