Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Infected by System Tools 2011 - Please HELP!

  • This topic is locked This topic is locked
2 replies to this topic

#1 mikesandypenny


  • Members
  • 34 posts
  • Gender:Female
  • Local time:09:03 AM

Posted 14 December 2010 - 04:02 PM

My computer runs Windows XP. When I turned it on this morning, just after it booted up, the screen went blue with some type of advertisement about my computer being infected. Then a window popped up called System Tools 2011 and looked like it was running a scan. When I tried to stop it. It went to a screen called Total Security with prices starting at around $50 to be paid to "remove" spyware. Got these windows closed and tried to run AVGFree but couldn't. System Tools 2011 opened a pop up that said that AVG had corrupted files.

Did a search on computer and found several System Tools 2011 files and System Tools files and changed their names. Rebooted computer into safe mode and ran AVG's "command line only" virus scan. AVG did not "find" any infections, but, also didn't open "locked" files. Restarted computer to normal mode and found that System Tools 2011 is not as quick getting control of computer. It did take control again, interfering with access to AVG and Internet Explorer. IE only partially loads and then a pop up says that its files are corrupted. Right now running in Safe Mode with Networking.

I am a casual computer user, not a programmer or expert, so please use simple terms.

Would really appreciate any help you can give.

Thank you.

BC AdBot (Login to Remove)


#2 vajmh


  • Members
  • 12 posts
  • Local time:09:03 AM

Posted 15 December 2010 - 03:37 AM

This is basically the same thing I've had in the past only my version was called sysguard.exe

You're off to a good start, using ctrl alt del to identify the process name, searching for it, and then manually renaming or deleting its file components. However you also need to look for it in your registry. Go to run and do msconfig and look for it in start up and anywhere else, uncheck it so it wont start up with the computer. You should probably get it out of your registry too but I dont know exactly where it would be in there.

Also, Hitman pro downloaded free from CNET is great for getting rid of ransomware so try that too.

#3 Andrew


    Bleepin' Night Watchman

  • Moderator
  • 8,260 posts
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:07:03 AM

Posted 16 December 2010 - 07:38 PM

Reference: http://www.bleepingcomputer.com/forums/topic367512.html

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the logs you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Removal Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users