Security Tool Removal Guide

Security Tool is a rogue anti-spyware program that uses fake security alerts and system scan results to make computer users believe that they must purchase the Security Tool program to remove the found threats. Security Tool comes from the same group of attackers that made the fake security programs System Security and Total Security 2009.

Removal Tool 1: Security Tool Removal Tool. (Download it here.)
Removal Tool 2: Remove Fake Antivirus. (Download it here.)

Removal Guide
Kill Process
(How to kill a process effectively?)
SecurityTool.exe
4946550101.exe
[random>=8digits].exe (95750127.exe, 14507623.exe, 9048246710.exe etc)

Delete Registry
HKLM "SOFTWARE\SecurityTool"
HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SecurityTool"
HKCU "Software\Vista Antivirus 2010"
HKCU "Software\Microsoft\Windows\CurrentVersion\Run " "SecurityTool"
HKCU "Software\Security Tool"
HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "4946550101"

Remove Folders and Files
$PROGRAMFILES\SecurityTool
$APPDATA\4946550101
$DESKTOP\Security Tool.lnk
$STARTMENU\Programs\Security Tool.lnk

Read more »

Antivirus Live Removal Guide

Antivirus Live (also known as AntivirusLive) is the latest Rogue Anti-Spyware creation from the notorious Magic Software stable. Antivirus Live uses malicious cutting-edge techniques, including the use of backdoor Trojans. Once active, Antivirus Live disables the computer's security options, making it extremely difficult to uninstall through the Control Panel or via Safe Mode. Antivirus Live then starts spewing annoying popup ads and runs a security scan which reports the fake detection of numerous viruses and threats. Antivirus Live will recommend buying its licensed copy to solve the alleged spyware problems. Do not fall for Antivirus Live's trickery. This hazardous parasite should be terminated from the system immediately

Removal Tool: Remove Fake Antivirus. (Download it here.)

Removal Guide
Kill Process
(How to kill a process effectively?)
[random]sysguard.exe

Unregister DLL files
iehelper.dll

Delete Registry
HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}"
HKCU "Software\AvScan"
HKCR "CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}"
HKCU "Software\Microsoft\Internet Explorer\Download" "RunInvalidSignatures"
HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings" "ProxyOverride"
HKCU "Software\Microsoft\Windows\CurrentVersion\Internet Settings" "ProxyServer"
HKCU "Software\Microsoft\Windows\CurrentVersion\Policies\Associations" "LowRiskFileTypes"
HKCU "Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" "SaveZoneInformation"

Remove Folders and Files
$WINDIR\[random]sysguard.exe
$SYSDIR\iehelper.dll

Read more:
Constants in manual removal guide

Read more »

Personal Security Removal Guide

Personal Security is a clone of the rogue security software, Cyber Security. Personal Security also known as PersonalSecurity, typically spreads via sneaky Trojans or false advertisements. Personal Security will conduct a fake system scan once it has entered a system, and then produce alarming results of several parasite infections on the system. This is done to scare the user into purchasing the full version of Personal Security in order to remove all the purportedly detected parasites. Personal Security may also display numerous pop-ups and warning messages to scare the user even more. Personal Security is not a legitimate security program and should be removed immediately.

Removal Tool: Remove Fake Antivirus. (Download it here.)

Removal Guide
Kill Process
(How to kill a process effectively?)
psecurity.exe
Inst_2013[1].exe

Unregister DLL files
win32extension.dll

Delete Registry
HKLM "SOFTWARE\Personal Security"
HKCU "Software\Microsoft\Windows\CurrentVersion\Run" "PSecurity"
HKCR "CLSID\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}"
HKLM "SOFTWARE\5FFB10D58FFCF482208906E6A889FD56"
HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform" "WinTSI 01.12.2009"

Remove Folders and Files
$SMPROGRAMS\Personal Security
$SMPROGRAMS\PSecurity
$PROGRAMFILES\Personal Security
$PROGRAMFILES\PSecurity
$APPDATA\Personal Security
$APPDATA\PSecurity
$PROGRAMFILES\Common Files\PSecurityUninstall
$APPDATA\Microsoft\Internet Explorer\Quick Launch\PSecurity.lnk
$SYSDIR\win32extension.dll

Read more:
Constants in manual removal guide

Read more »