How to remove My Security Engine (Uninstall instructions)

Do you have pop-ups or your computer infected with trojan or spyware ? Learn how to ask us for help, click here!

How to remove My Security Engine (Uninstall instructions)

My Security Engine is a rogue antispyware program from the same series of rogues as early appeared Security Guard and Cleanup Antivirus. The difference between this new fake antispyware of others very slightly. Firstly, changed the name of the program and secondly, have been partially modified the core component of the program in order to protect it from detection by the legitimate antivirus and antispyware tools. Otherwise, everything remained as before.

My Security Engine distributed usually through fake online malware scanners. When you opens a page with this scanner, it simulates a system scan and once finished, tells you that your computer is infected with a lot of infections. Then offers to install an “antivirus”. This “antivirus” is a trojan, that once started, will download and install My Security Engine onto your PC.

After breaking into your computer, My Security Engine first step will configure itself to run automatically when Windows starts, then add several lines into HOSTS file so that when you open Google, Yahoo or Bing, you will be redirected to a malicious website and create a lot of fake malware files with random names, that absolute harmless, but later during the scan will be reported as worms, trojans and viruses. Of course, the scan results are false, because the fake antispyware tool identifies harmless files as dangerous infections. Important, do not trust the result of the scan, simply ignore them! My Security Engine want to force you to believe that your computer is infected.

For a more complete picture of what your computer is infected with dangerous viruses, My Security Engine will display numerous warnings, fake security alert and notifications from Windows task bar. Some of the alerts:

Warning
Warning! Virus detected

System alert
Click here to remove all potentially harmful programs found
immediately using My Security Engine.

What is more, My Security Engine may block Task Manager and legitimate antivirus and antispyware programs and hijack Internet Explorer so that it randomly shows a warning page when you browsing the Internet. The title of the page is “There is a problem with this websites`s secuirty. Possible spyware threat detected”. However, all of these alerts and warnings are fake and like scan false results should be ignored!

From the above, obviously, this program is an unwanted guest on your computer, which should be removed from the system upon detection. Please follow the instructions below to remove My Security Engine and any associated malware from your computer for free.

More screen shoots of My Security Engine

Symptoms in a HijackThis Log

O4 – HKCU\..\Run: [My Security Engine] “C:\Documents and Settings\All Users\Application Data\9be96\MS515.exe” /s /d

Use the following instructions to remove My Security Engine (Uninstall instructions)

Step 1. Remove My Security Engine and any associated malware.

Download MalwareBytes Anti-malware (MBAM). Once downloaded, close all programs and windows on your computer.

Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MalwareBytes Anti-malware onto your computer. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to “Update Malwarebytes’ Anti-Malware” and Launch “Malwarebytes’ Anti-Malware”. Then click Finish.

MalwareBytes Anti-malware will now automatically start and you will see a message stating that you should update the program before performing a scan. If an update is found, it will download and install the latest version.

As MalwareBytes Anti-malware will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main menu. You will see window similar to the one below.

Malwarebytes Anti-Malware Window

Make sure the “Perform quick scan” option is selected and then click on the Scan button to start scanning your computer for My Security Engine infection. This procedure can take some time, so please be patient.

When the scan is finished a message box will appear that it has completed scanning successfully. Click OK. Now click “Show Results”. You will see a list of infected items similar as shown below.
Note: list of infected items may be different than what is shown in the image below.

Malwarebytes Anti-malware, list of infected items

Make sure all entries have a checkmark at their far left and click “Remove Selected” button to remove My Security Engine. MalwareBytes Anti-malware will now remove all of associated My Security Engine files and registry keys and add them to the programs’ quarantine. When MalwareBytes Anti-malware has finished removing the infection, a log will open in Notepad and you may be prompted to Restart.

Step 2. Reset HOSTS file.

Run Malwarebytes Anti-malware. Open Tools tab. Under FileASSASSIN label click to Run Tool button. In the open window navigate to C->Windows->System32->Drivers->etc and select HOSTS file. Click Open button. Click YES to confirm. Close Malwarebytes Anti-malware.

Click Start, Run. Type notepad and press Enter. Notepad opens. Copy all the text below into Notepad.

127.0.0.1 localhost

Save this as HOSTS to your C->Windows->System32->Drivers->etc. (Remember to select Save as file type: All files in Notepad). Close Notepad.

Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.

Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.

My Security Engine creates the following files and folders

%UserProfile%\Application Data\My Security Engine
%UserProfile%\Application Data\My Security Engine\cookies.sqlite
%UserProfile%\Desktop\My Security Engine.lnk
%UserProfile%\Start Menu\My Security Engine.lnk
%UserProfile%\Application Data\My Security Engine\Instructions.ini
%UserProfile%\Start Menu\Programs\My Security Engine.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\My Security Engine.lnk
C:\Documents and Settings\All Users\Application Data\9be96\MS515.exe

My Security Engine creates the following registry keys and values

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | my security engine
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download | RunInvalidSignatures = “1″
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes | URL = “http://findgala.com/?&uid=1002&q={searchTerms}”

Share and Enjoy:

79 Comments »

RSS feed for comments on this post.

This worked for me.
Thank you very much!

Comment by Thieu — April 26, 2010 #
It worked for me too.
Thanks a lot!

Comment by Julian — April 27, 2010 #
Arrg, it won’t let me replace the HOSTS file. I had already completed your step 1 and it seemed to solve everything except that when you use google search it reroutes you to Gala. I searched “My Search Engine” and Gala (on a different PC of course) which lead me to your helpful site. The malwarebytes tool seemed to work at first. I selected the file name with “hosts” in it (but it wasn’t just hosts it was ifghosts or something random like that). I figured that’s what you meant and clicked open and yes. Then I did the notepad thing, but when I went to save it it says that the file “HOSTS” already exists (even though it is not appearing in the file!) It asks me “Do you want to replace it?” I say “Yes.” Then, it says “hosts This file is set to read-only. Try again with a different file name.” BOOOO! Let me know if there is something I could try to fix it. Thanks for your helpful site!

Comment by reesey — April 30, 2010 #
reesey, try another way
Download HostsXpert. Unzip file and run it.
In the main menu click to “Restore MS Hosts file” button.

Comment by Patrik — April 30, 2010 #
The first step worked, but I have no HOSTSfile ???
What can I do now ?
Thanks for your help !

Comment by Steph — May 1, 2010 #
Okay, now I have the same problem as reesey – I fond the hostsfile and it wasn’t named hosts but something random so I chose this.
I tried the programm from Patrik but it doesn’t work. I have an Error named “Cannot create file Window …” .. so, what can I do now.

Comment by Steph — May 1, 2010 #
thanks for this
i m really scared abt that
but really thanks for my help

Comment by jay — May 2, 2010 #
ive tried.running malware twice but even thougj i remove theviruses i still cant access the internet and the pc is still infected i can’t.even use internrt explorer at all, help

Comment by naz — May 2, 2010 #
Steph, you have tried remove a HOSTS file using Malwarebytes ?

Comment by Patrik — May 2, 2010 #
naz, ask for help in our Spyware removal forum.

Comment by Patrik — May 2, 2010 #
It worked. Many thanks.

Comment by Dreeny — May 3, 2010 #
I have problem with My Security Engine. Please help me with how to remove it through internet.

Comment by jawad — May 4, 2010 #
jawad, if the instructions above does not help, ask for help in our Spyware removal forum.

Comment by Patrik — May 5, 2010 #
Is Windows 7 different? When I go to C->Windows->System32->Drivers->etc and select HOSTS file,

there is no “etc” and I cannot find a HOSTS file.

At least when I restart my computer now the My Security Engine seems to be gone.

Comment by Laurie — May 5, 2010 #
just downloaded sdasetup and have icon Spyware Doctor but Spyware Doctor won’t launch. Help Please!

Comment by neil — May 5, 2010 #
My goodness! This is really confusing. I just want all of the viruses OUT. Especially the STUPID “My Security Engine”! HELP!

Comment by Faith — May 5, 2010 #
Plus, how do I know that this isn’t a virus as well?

Comment by Faith — May 5, 2010 #
Caution! Just connected that Spyware Doctor is not Malwarebytes. I searched My Security Engine on Google and website on front page gives this forum under Spyware Doctor website. I uninstalled Spyware Doctor and installed Malwarebytes Anti Malware from Malwarebytes website and it works great. Thanks guys.

Comment by neil — May 5, 2010 #
neil, looks like you have clicked to a google ads.

Comment by Patrik — May 5, 2010 #
I still need help! My Security Engine appears to be gone (thank you!), but now my iTunes will not work (can’t live without that, eek), and I wonder if it is b/c I cannot reset the HOSTS file. More help w/ that? Thanks!

Comment by Laurie — May 6, 2010 #
My security engine doesnt allow me to search anything on the laptop that isnt working. So i cant download it because i cant view the website on the laptop.

Comment by Olivia — May 6, 2010 #
I cannot reset the HOSTS file

Why ? Give me more information.

Comment by Patrik — May 8, 2010 #
Olivia, reboot your computer in the Safe mode with networking and try the steps above once again.

Comment by Patrik — May 8, 2010 #
I am having exactly the same problems as Steph. I have run through all of the steps for removing My Security Engine and it seems to be gone. (ty But I still can’t connect to the internet and the HostsXpert is telling me that it “Cannot create file”. Help plz.

Comment by Robert — May 8, 2010 #
Robert, what shows your PC when you trying open any site ? You have tried remove infected HOSTS file with the help of Malwarebytes and make a clean one.

Comment by Patrik — May 9, 2010 #
malwarbytes actually removed the security engine, after restarting havent seen anything popping anymore. Now I tried to find the file HOSTS, but no luck
what should I so now?

Comment by Vlad — May 9, 2010 #
Patrik i have same error with steph u told that she has to delete hosts file with malware how to do that?

Comment by Ermm — May 9, 2010 #
if you’re having trouble trying to find the HOSTS file, use this guide:

bleepingcomputer.com/virus-removal/remove-my-security-engine

scroll down and download hostsperm.bak ; that should give you access

I’d also recommend (as someone already mentioned) to use this guide on safemode.

Comment by Paul — May 9, 2010 #
Vlad, you have tried to remove infected HOSTS file using Malwarebytes ? it not exist ?

Comment by Patrik — May 9, 2010 #
Ermm, follow the step 2 above.

Comment by Patrik — May 9, 2010 #
C->Windows->System32->Drivers->etc and select HOSTS file. i cant find this

Comment by Ermm — May 10, 2010 #
Ermm, you have tried to make a new one and save it to C->Windows->System32->Drivers->etc (where C is your system drive which contains Windows folder).

Comment by Patrik — May 11, 2010 #
Oh great! It works, though I have not tried the host file

Comment by facebookgolddigger.com — May 12, 2010 #
new one refers to?? D

Comment by Ermm — May 12, 2010 #
new one – is a file that contains “127.0.0.1 localhost” w/o quotes. Save it as HOSTS (select filetype: all files) to C->Windows->System32->Drivers->etc

Comment by Patrik — May 12, 2010 #
Whew!
I google-you,and my problem with that stupid My Security Engine has just-vanished!!
Thank you so much!
And I’m keeping this file too,in case my friends have the same problems!

Comment by April — May 12, 2010 #
Hi All,

In my case, the software downnloaded has removed My Security Engine. I hope that I shall not have any further problems.
What sucks is that I purchased McAfee anti-virus in the past. My subscription is still valid and when i contacted their customer support team regarding My Security Engine they refused to removed but after paying extra £60!!!!!!!
I believe this is rip-off.

Thanks,

Tigres

Comment by tigres — May 12, 2010 #
i dont have a file named etc

Comment by Ermm — May 13, 2010 #
HELP!!! i did all the steps but could’nt find the host file. so i downloaded the Hostsperm.bat and now could find the host file and delete it. BUT now i want to save the new host file and the etc. folder can’t be found ?!?!?! i don’t understant it!! and i’m going crazy …
i must say that if i search this folder, it’s there, but id i want to save the new information there, then it’s gone…
PLZ HELP

Comment by Liri — May 13, 2010 #
so now i tried to save it again, and found the etc. folder, but when i actually press the save button a message appears- “you don’t have permission to save this in this location. contact the administrator (which is ME) to obtain permission”. but when i try to change myself to the administrator, i can’t…
what’s going on???
HELP

Comment by Liri — May 13, 2010 #
report : MBAM_ERROR_ADD_TO_RESULTS (0,6)

when i scan the computer , it show this and report to your support ! thanks !

Comment by Yan — May 13, 2010 #
Ermm, “etc” is a folder name.

Comment by Patrik — May 15, 2010 #
Liri, open a new topic in our Spyware removal forum. I will check your PC.

Comment by Patrik — May 15, 2010 #
Yan, please start a new topic in our Spyware removal forum. I will help you.

Comment by Patrik — May 15, 2010 #
thank you so much!
you save my life.

Comment by pooh — May 17, 2010 #
I am running windows 7 which does not have a folder beyond “drivers” with a hosts file. There is a file HOSTNAME however in the “System32″ folder. Is this the one I should be correcting?

Comment by Joel — May 17, 2010 #
Pessoal, muito obrigado Pela uma juda Que vcs me com removedor deram.consegui Sucesso Esse Programa do Meu PC. porfavor não baixem esse programa, ele é uma farça, My Security Engine.

Comment by sandro costa — May 18, 2010 #
thanks you very very much !

Comment by Thanks You — May 19, 2010 #
can this thing remove the damn shit screaming on my computer??

Comment by pearl — May 19, 2010 #
Joel,
Click Start, Run (or type the following text in a search field).
%WinDir%System32\Drivers\etc
Windows Explorer window opens with contents of etc folder.

Comment by Patrik — May 19, 2010 #
pearl, looks like your PC infected with a trojan. Please begin a new topic in our Spyware removal forum. I will help you.

Comment by Patrik — May 19, 2010 #
Hi, Patrik!
My laptop got infected My Security Engine, but Malwarebytes didn’t work. It scanned & found objects. However, it didn’t show “Show Results” screen at all. I don’t know what to do. Internet is messed up & won’t let me in.
I’m so helpless. Please help me!!

Comment by regina — May 19, 2010 #
Regina, please start a new topic in our Spyware removal forum. I will help you.

Comment by Patrik — May 19, 2010 #
I have been reading the posts but still need help. I did the the removal process through bleepingcomputer.com but i dont have c:\windows\system32\drivers\etc\hosts i have everything except the hosts file i have lmhost. do i delete that? I still dont understand how to change it. thanks!

Comment by shelly — May 19, 2010 #
I have been reading the posts and Im still having problems. I dont have the C->Windows->System32->Drivers->etc and select HOSTS . I have lmhost.sam but i cant open it. Also if i try to retype 127.0.0.1 localhost in the notepad and save it to the above file it says i dont have permission. Im not sure what im doing wrong. Then I have problems getting on the interent. Please help me THANKS!!

Comment by Shelly — May 19, 2010 #
so wt is host file??

After I got into the drivers, I could not find a folder called etc. so wt should I do now???

Comment by Hannah — May 19, 2010 #
Shelly, start a new topic in our Spyware removal forum. I will help you.

Comment by Patrik — May 20, 2010 #
Hannah, click Start, Run. Type
%WinDir%\system32\drivers\etc
Windows Explorer window opens with contents of “etc” folder.

Comment by Patrik — May 20, 2010 #
It worked. Thanks.

Comment by ngerol — May 21, 2010 #
i dont have a folder named etc too

Comment by Ermm — May 21, 2010 #
thanks Patrick i think i figured it out. I deleted the lmhost file and resaved the right file through notepad. Ive ran mcafee, avast, and iola system mechanics and it fixed a bunch of stuff. All scans come back clean now. Thanks!!

Comment by shelly — May 21, 2010 #
Ermm, try steps from my previous comment.

Comment by Patrik — May 22, 2010 #
thank you so much ! it worked for me. im so close to reformat my computer.then i found u ! THANKS !

Comment by jeffrey — May 22, 2010 #
thanks patrik for helping me removing my security engine. I was afraid of the virus detection and for that reason I even downloaded Norton Antivirus to save my Window 7. Is it necessary to do step2 of gost file?

Comment by baseer — May 22, 2010 #
thanks man u saved my computer worth 1 g really appreciate it spending your time for others. i’m a 13 yr old, it wasn’t that hard.

Comment by KC — May 23, 2010 #
i have try this >Download HostsXpert. Unzip file and run it. But before displaying the main menu, it display this warning (“Your HOSTS file is marked as a system file and cannot be manipulated, press OK to remove the system file attribute, CANCEL to quit. ***HOSTS will NOT reset these attributes***) and then i press OK button. and it still show this warning but for different reason, it because Your HOST file is a Hidden File. So, i press OK button and the main menu is displayed. In the main menu i click to “Restore MS Hosts file” button and need confirmation from me, so press ok button but it cannot be restore the HOSTS File. and it shows this error (ERROR: Cannot create file c:/windows/system32/DRIVERS/ETC/hosts)
My very grateful to you if can help me…..

Comment by balkis — May 23, 2010 #
Hi,

My computer had the “My Security Engine” Malware/Virus…this is how I got rid of it, plus solved my browser Hijack.

1. First I Ran Malwarebytes Anti-Malware (twice)!
1st a quick scan then a full scan…781 files came back as infected.

2. After that Malwarebytes came back clean I scanned with my Anti-virus, then I scanned with my Anti-spyware program. Once those were clean I opened Internet Explorer…my browser was still hijacked going to “Gala.com, Findgala, scour…etc”

I went into Tools > Manage Add-ons > Search Providers > I deleted the search providers that were hijacked to go to findgala.com (the default can’t be deleted). Google was still pointing to google, so I selected “prevent programs from suggesting changes to my search provider…” Then I went to internet options and configured my security settings to prevent Active X controls from running automatically, but have to ask permission instead.

3. I went to C:\Windows\System32\Drivers\Etc …but surprise surprise no Hosts file.

so then I went to tools > folder options > view > selected “show hidden files and folders… > then unchecked “hide protected operating system files…” Now the hosts file was shown! Of course I was not able to change anything with notepad, because the permissions were changed, but I was determined.

I right-clicked on the hosts file > selected “properties” > selected “Security” Tab > then clicked “Edit” to change permissions > I checked “write”. Then I went back to notepad (run as administrator for Vista and 7) opened the hosts file and deleted the entries by the Malware…then I selected saved…Problem fixed.

Remember to go back and hide the files again.

Comment by JaymeeGirl — May 23, 2010 #
Thanx a lot guys. I finally got rid of 700+ viruses(all belongs to my security engine). I was nervous when I read some of the comments above but I just followed the steps mentioned and I had no problem. Thank you very much

Comment by Sam — May 24, 2010 #
baseer, yes you need reset your HOSTS file.

Comment by Patrik — May 25, 2010 #
balkis, remove the infected HOSTS file using Malwarebytes, then make a new one manually how i posted above or using HostXpert.

Comment by Patrik — May 25, 2010 #
thanks to patrik and jaymeeGirl… it worked for me…

Comment by balkis — May 26, 2010 #
It worked perfectly. However the file name was lmhost and not host. I removed lmhost file and created HOST file as per your instructions. Please Advise it is ok to do like that.
Thanks!!
Naved

Comment by Naved — June 7, 2010 #
Naved, its ok. Safe surfing.

Comment by Patrik — June 7, 2010 #
I am trying use Malwarebytes. some antivir cant be instaled, but Malwarebytes can.

Comment by delta — June 18, 2010 #
im not able to run malwarebytes anti-malware after installing it…
and there is no msg shown or neither its starting automatically..
n no other software is running bcoz of d my security engine..even after installing d malwarebytes anti-malware nt able to do anythng…need help..!! any help!! wat do i do..???

Comment by malvika — July 3, 2010 #
malvika, open a new topic in our Spyware removal forum. I will help you.

Comment by Patrik — July 3, 2010 #
it worked …thank u n now d stupid my security engine has vanished..
but am not able to find folder named etc..
wat do i do???
plzz help me..!!

Comment by malvika — July 4, 2010 #
Malvika, try the following instructions to reset HOSTS file:
download OTM by OldTimer from here and save it to desktop. Run OTM, copy, then paste the following text in “Paste Instructions for Items to be Moved” textarea (under the yellow bar):
:Commands [resethosts]
Close OTM.

Comment by Patrik — July 4, 2010 #
thank you man 4 your help. it really worked 4 me thanks

Comment by hajji2006 — October 28, 2011 #