ISSUE

A customer had an Acer laptop running Microsoft Windows Vista and when starting Internet Explorer, they would see a ‘System Tools’ application starting to analyse the PC.  This System Tools application looked very professional and appeared to scan the system very quickly so after only 10-15 seconds it showed that there were 30 critical viruses on the laptop.  In order to allow System Tools to remove these threats, the user would need to click on the option to purchase the full version of the System Tools software.

RESOLUTION

There are several malware applications around that load themselves onto computers, then appear to run and find dangerous viruses on the unsuspecting users computer.  In this case and many others, the only invading software on the computer is the malware itself and it’s only purpose is to try and trick the user to pay out for a removal tool that doesn’t do anything.

The first step in removing this malware was to start up the computer without the malware being loaded.  Often once the malware is loaded, it stays hidden so that the process cannot be seen from the Task Manager.  In the case of this System Tools malware code, it does appear in the Task Manager running as a process with an 8 digit name.  For this type of Trojan, the name of the executable file can differ and in this case the process could be seen as 21639728.exe.  Stopping this process prevented the program from causing us problems as we went onto the Internet.

There are a variety of tools that can remove viruses, spyware and malware such as this trojan and we first tried Spyware Doctor.  This program is supplied by PC Tools and can be easily found on the Internet.  The benefits of this tool is that it runs quickly (on this Acer laptop is only took 4 minutes to scan), and it found the malware causing our issue.  The malware was found as Trojan.Agent/Gen-FakeAlert(AV).  The downside is that once it detects the malware you then have to purchase the full program to remove it.  At the time of writing this article, the cost was £29.95 for 1 year and it could be installed onto 3 PC’s.

Note, if you want to use this application to just remove a current threat, go to uninstall the Spyware Doctor program and it will open up an IE window and bring you to a web page offering you a 60-day version for £5.99.

In order to keep costs down for the customer we ran another anti spyware application called Super AntiSpyware to see if it could also find our threat.  The benefits to this  software is that it is free to home users and in our case it found the malware program causing the problem.  It does take longer to scan however, and in this case took over 40 minutes.

It is interesting to note that the free edition of Super AntiSpyware found well over 100 tracking cookies as well as our malware code, compared to Spyware Doctor finding just over 50.

Once the Trojan/Malware application was removed, a quick test after a restart showed that we could now load Internet Explorer without any pop-up windows for System Tools appearing.

___________________________________________________________________________

Torian IT Solutions Ltd offer PC repair and virus, malware, spyware and trojan removal services to businesses and home users in West Yorkshire region (Leeds, Wakefield, Kirklees, Bradford, Castleford, Pontefract)

Generally, computers can run well and do everything you need, but after a while they can become sluggish as they have additional programs running.  If you find this to be the case, we can run a health check on your machine to see how well the registry is configured, identify any malicious software and scan for virus files on your disks.

Please call 01924 200325 or 0779 546 0557 for a call out.  We call out to customers in the Leeds area and review your computer repair requirements, then quote for any potential work you may require.

Generally, computers can run well and do everything you need, but after a while they can become sluggish as they have additional programs running.  If you find this to be the case, we can run a health check on your machine to see how well the registry is configured, identify any malicious software and scan for virus files on your disks.

Please call 01924 200325 or 0779 546 0557 for a call out.  We offer a free call out service to customers in the Wakefield area and will review your computer(s) and quote for any potential work you may require.