Do you have pop-ups or your computer infected with trojan or spyware ? Learn how to ask us for help, click here!

How to remove System Tool and SystemTool (Uninstall instructions)

System Tool or SystemTool is a fake security program which is a clone of Security Tool. The program is classified as a rogue antispyware tool because detects numerous false infections and displays a lot of fake security alerts in order to scare you into thinking your computer in danger. It hopes that you will then purchase its full version. But you should know, System Tool is unable to detect or remove any viruses, trojans, worms nor will be protect you from legitimate future security threats. Thus, you need to remove this malware from your computer as soon as possible.

SystemTool is distributed through the use of malware that pretends to be flash updates, or even video codecs required to watch an online movie. Once started, it will configure itself to run automatically when Windows starts. Next, the rogue will perform a system scan and report numerous infections to make you think that your computer is infected with trojans, spyware and other malware. Then it will prompt you to pay for a full version of System Tool to remove these threats. Of course, all of these infections are fake and don’t actually exist on your computer. So you can safely ignore them.

While SystemTool is running, it blocks the ability to run any programs, including legitimate antivirus and antispyware applications. The following warning will be shown when you try to run any program:

Application cannot be executed. The file {file name} is infected.
Please activate your antivirus software.

More over, System Tool will display a lot of false security alerts and nag screens. Some of the alerts:

System Tool Warning
Intercepting program that may compromise your privacy and
harm your system have been detected on your PC.
Click here to remove them immediately with System Tool

System Tool
WARNING 23 infections found!!!

System Tool Warning
Some critical system files of your computer were modified by
malicious program. It may cause system instability and data

SystemTool will also replace your current Windows background with a fake security warning that states:

Your’re in Danger!
Your Computer is infected with Spyware!

Of course, all of these warnings and alerts are a fake and like scan false results should be ignored!

If your computer is infected with SystemTool, then most importantly, do not purchase it! Uninstall the rogue from your PC as soon as possible. Use the removal guide below to remove System Tool and any associated malware from the system for free.

Symptoms in a HijackThis Log

O4 – HKCU\..\RunOnce: [{RANDOM}] C:\Documents and Settings\All Users\Application Data\{RANDOM}\{RANDOM}.exe

Automatic removal instructions for System Tool

Step 1. Reboot your computer in Safe mode with networking

Restart your computer.

After hearing your computer beep once during startup, start pressing the F8 key on your keyboard. On a computer that is configured for booting to multiple operating systems, you can press the F8 key when the Boot Menu appears.

Instead of Windows loading as normal, Windows Advanced Options menu appears similar to the one below.

Windows Advanced Options menu

When the Windows Advanced Options menu appears, select Safe mode with networking and then press ENTER.

Step 2. Remove SystemTool and any associated malware

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

Malwarebytes Anti-Malware Window

Select Perform Quick Scan, then click Scan, it will start scanning your computer for System Tool infection. This procedure can take some time, so please be patient.

When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.

System Tool remover
Malwarebytes Anti-malware, list of infected items

Make sure all entries have a checkmark at their far left and click “Remove Selected” button to remove System Tool. MalwareBytes Anti-malware will now remove all of associated SystemTool files and registry keys and add them to the programs’ quarantine. When MalwareBytes Anti-malware has finished removing the infection, a log will open in Notepad and you may be prompted to Restart.

Step 3. Reset HOSTS file

System Tool will change the Windows system HOSTS file so you need reset this file with the default version for your operating system.

Please download OTM by OldTimer from here and save it to desktop. Run OTM, copy, then paste the following text in “Paste Instructions for Items to be Moved” textarea (under the yellow bar):


Click the red Moveit! button. Close OTM.

SystemTool removal notes

Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.

Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.

System Tool creates the following files and folders

C:\Documents and Settings\All Users\Application Data\{RANDOM}
C:\Documents and Settings\All Users\Application Data\{RANDOM}\{RANDOM}.exe.

SystemTool creates the following registry keys and values


October 24, 2010 on 7:58 am | In Malware removal, Rogue Anti Spyware | 260 Comments |


RSS feed for comments on this post.

  1. thank you for your help.. the process/ instructions you shared helps me to remove the system tool that prompts on my computer.. now i can already install and download again..

    Comment by chen — December 7, 2010 #

  2. The paste to OTM does not work. I get the message
    cannot create file C:\WINDOWS\System32\drivers\etc\Hosts
    Other than that, your fix was dabomb. That bullshit System Tool is gone! Thank you Thank you.

    Comment by john Calabrese — December 10, 2010 #

  3. Calabrese, if you using Vista/7 then you need run OTM as administrator. Right click to OTM and click Run as Administrator option.

    Comment by Patrik — December 11, 2010 #

  4. I already had Malwarebytes but had to update it, after which it ID’d 150-plus infections and took System Tool away! Thanks!

    But OTM doesn’t work (I have Windows XP). It opened; I dopied
    under yellow bar, clicked “Move It” and “Commands” when over to under the green bar, leaving “[resethosts]” under the yellow bar. Then OTM went “not responding” and won’t do anything, like close. I tried “End Task” and it doesn’t work on OTM, which appears twice on that screen. What should I do???

    Comment by Basil — December 11, 2010 #

  5. Whoops! OTM is gone. I went to desktop, re-opened and recopied and it told me the action was complete and it had created a log. I clicked exit and that worked too. I presume I’m all set to trot normally.

    Thanks for great instructions and help!

    Comment by Basil — December 11, 2010 #

  6. I ran the quick scan and it tells me the is nothing there but the system tool is still all over my computer how do I get rid of this thing…

    Comment by Matt — December 11, 2010 #

  7. This has not helped me…i ran through the entire process, and system tool is still on my laptop?

    Comment by Jennie — December 11, 2010 #

  8. Thanks for the help, it was invaluable. Wasted about an hour or so running a full scan, without updating, then finally updated and did quick scan, but rebooted without taking out the file folders and the regkey. Followed your instructions again to the T and got rid of it. No idea where I picked it up…twitter? Anyway I’m back on track again. Thanks and mahalo!

    Comment by officer808 — December 12, 2010 #

  9. I followed all the steps and BINGO! that “system tool” is gone! You saved my day. You saved my MIND!

    Comment by Gloria Fuerte — December 12, 2010 #

  10. Ran program but after re starting virus [System Tool] is still here

    Comment by tom claybo — December 12, 2010 #

  11. oh man [resethosts] is not working. Keep getting the same message even after making it ambass. ahh broke heart. any suggestions?

    Comment by cameron — December 13, 2010 #

  12. not working for me…
    so, i have restarted my comp in safe mode, run rkill, updated MBAM, run MBAM, manually deleted all “system tool” paraphernalia and restarted my comp regularly and it STILL is 100% infected.
    any pointers??

    Comment by Morgan — December 13, 2010 #

  13. Thank you, thank you, thank you. This saved my life and so much of my time. I thought my computer was kaput. It took me less than 40, 50 minutes to uninstall System Tool. Man, thank you so much.

    Comment by Michelle — December 13, 2010 #

  14. do you restart before resetting the host

    Comment by renee — December 14, 2010 #

  15. Matt and Jennie, ask for help in our Spyware removal forum.

    Comment by Patrik — December 14, 2010 #

  16. Perfect! thanks

    Comment by Jeremy — December 14, 2010 #

  17. Information to remove system tool was very helpful I’m glad that bullshit is gone thanks

    Comment by Tyler Stewart — December 14, 2010 #

  18. thank you, thank you, thank you! I worked twelve hours today trying to remove system tool from my computer. and once i discovered this helpful page it took all of ten minutes. you are my hero!

    Comment by ATaylor — December 15, 2010 #

  19. Morgan, probably your computer is infected with a trojan that reinstalls the rogue. Start a new topic in our Spyware removal forum. I will help you to remove this malware.

    Comment by Patrik — December 15, 2010 #

  20. renee, yes, reboot your computer before resetting the hosts file.

    Comment by Patrik — December 15, 2010 #

  21. this virus SUCKS. i didnt trust it from the start ><

    Comment by mike — December 15, 2010 #

  22. Has anybody run into a problem where system tool does not show up as an infection using mbam?

    Comment by Stephen — December 15, 2010 #

  23. So it says that i got it off on safe mode but once i start my computer again it’s still there. So i went back to safe mode to rescan but it says 0 infections found! HELP!

    Comment by Fatimeh — December 16, 2010 #

  24. Great help, thank you. All steps worked and I’m now much more up-to-date on general protection tools.

    Comment by Ben — December 16, 2010 #

  25. do i need to reboot my pc in safe mode or the regular one? bc i rebooted in regular and stupid system tool came back :S
    help plz

    Comment by tish — December 16, 2010 #

  26. Stephen and Fatimeh, try the following:
    Reboot computer in Safe mode with networking. Download HijackThis from here. Run HijackThis and click Scan button to perform a system scan. Place a checkmark against each of lines:

    O4 – HKCU\..\RunOnce: [{RANDOM}] C:\Documents and Settings\All Users\Application Data\{RANDOM}\{RANDOM}.exe


    O4 – HKCU\..\RunOnce: [932849] C:\Documents and Settings\All Users\Application Data\832748\123123.exe

    Note: list of infected items may be different. Template of the malicious entries:
    O4 – HKCU\..\RunOnce: [{RANDOM}] C:\Documents and Settings\All Users\Application Data\{RANDOM}\{RANDOM}.exe
    If you unsure, then start a new topic in our Spyware removal forum. I will help you.

    Place a checkmark against each of them. Once you have selected all entries, close all running programs then click once on the “fix checked” button. Close HijackThis.

    Comment by Patrik — December 16, 2010 #

  27. tish, you need use Safe mode. It will stop the rogue from autorunning.

    Comment by Patrik — December 16, 2010 #

  28. Thankyou Patrik – You DA MAN! =)

    Comment by tish — December 16, 2010 #

  29. Tough nut to crack. Had to search through registry for all RunOnce instances. Found one that pointed to the random-named folder/file. They used a guid/SID/class in the registry path that threw Malwarebytes off. Erased by hand.

    Comment by Dave — December 16, 2010 #

  30. I too had trouble tracking this one down. With hijack this I was able to delete an odd RunOnce entry that was random but was not in the Documents and settings\all users\application data folder mentioned above. It was in Program Data folder.

    Comment by Kevin — December 16, 2010 #

  31. Followed all directions in safe mode everything seemed great, found virus, deleted it and restarted and its still there. Now when i run quickscan it doesnt find anything. I also couldnt get the OTM thing to work. This has been an all day thing with no luck :(

    Comment by Michelle — December 16, 2010 #

  32. I got hit with System Tool 2010 on my Windows 7.

    The way to get rid of it is shut down your computer. No programs will work anyway until you get rid of the virus.

    Then restart your computer tapping F8 repeatedly to get to the log on screen.

    Start in Safe Mode.

    At that point download freeware:


    Security 360

    Microsoft Security Essentials

    Advanced SystemCare

    Download all and run all. They will kill different aspects of the virus and other garbage on your system.

    No single anti-vuris program will get it all so run all of them.

    That should kill Security Tool 2010 and anything else in your computer.

    Then schedule Microsoft Security Essentials to run at 4 AM every day, assuming you leave your computer on 24 / 7. The others you have to buy to use auto-scheduler function.

    Oh yeah, make sure you download all the most recent updates before running the programs.

    Also, if you can’t get Explorer to run on teh infected computer download all programs onto a flash drive on another uninfected computer. Then plug into infected computer in safe mode, cut and paste .exe programs off flash drive to infected computer and run.

    Comment by john — December 16, 2010 #

  33. Life saver………..Thank YOU!!!!! This f**ki* virus.. people should be shot

    Comment by Sunny — December 16, 2010 #

  34. Top man. Thanks, killed the system tool maleware. Like to go to the originators house and put a physical virus on his/hers computer. Thank you for all your technical help and guidence

    Comment by adrian — December 17, 2010 #

  35. Kevin, is right. Looks like you have removed a new version of the rogue.

    Comment by Patrik — December 18, 2010 #

  36. Michelle, start a new topic in our Spyware removal forum. I will help you.

    Comment by Patrik — December 18, 2010 #

  37. Instructions are perfect! Did as you suggested and the enemy is gome!


    Comment by J Daniel Donovan — December 18, 2010 #

  38. Thank you so much

    Comment by eric — December 18, 2010 #

  39. excellent program bro . thanks so much

    Comment by assassin — December 20, 2010 #

  40. wat boot device should e choose…i cannot understand…..i am clicking f8 during computer restarts and some boot device is coming…advanced menu options are not coming….please help….

    Comment by Rahul — December 22, 2010 #

  41. Rahul, press F8 here once again.

    Comment by Patrik — December 22, 2010 #

  42. Thanks so much!!! Worked perfectly!!!

    Comment by April — December 23, 2010 #

  43. Whoever made these steps and everything, are those kind of people that are just BADASS!! Thank you so much!!

    Comment by chase — December 24, 2010 #

  44. By the way… Fuck System Tool!!!

    Comment by chase — December 24, 2010 #

  45. Thanks…this was so easy to do…thanks again!

    Comment by kristy — December 25, 2010 #

  46. What a way to start off Christmas morning – some bogus crap on my laptop I gotta get rid of. Downloaded the Malwarebytes tool and things seem back to normal. Thanks. Merry Christmas.

    Comment by Mike — December 25, 2010 #

  47. System Tool showed up on my home computer on CHRISTMAS MORNING! What a joke. This website DEFINITELY removed the virus completely. Thank you very much.

    Comment by Chris — December 25, 2010 #

  48. Thank you!!!!!!!!!!!!!!!!!!Man first hit…..scared me to death!!! Thank You!!!!!

    Comment by Cook — December 25, 2010 #

  49. This was fucking amazing!!!!

    Comment by Squeak — December 25, 2010 #

  50. I have renamed the Malware Anti-virus Tool and ran it but it only runs for 20 seconds at most then disappears. Tired of this rogue virus. Very annoying!

    Comment by Jay Riffe — December 25, 2010 #

  51. I have also run the HiJack executable but it doesn’t stop long enough for me to click the registry lines.

    Comment by Jay Riffe — December 25, 2010 #

  52. It seems like a lot of people got this on Christmas morning- so did I! I nearly shat myself every time I tried to open an .exe file and the system tool would block it. Then they change my desktop wallpaper to some “Oh no, your computer is infected” BS? In the immortal words of Will Smith, “AW HELL NAW!” Going into Safe Mode and using System Restore shut that system tool bullshit down for good! Thanks!!!

    Comment by paul — December 26, 2010 #

  53. omgooodd thankyouuuuuuuuuu sssoooooooooooooo muchhhhh ! IT REALLY WORKS IM SO HAPPY IT ONLY TOOK 3MINUTES THANKYOU THANKYOU THANKYOU :o)

    Comment by Breezy — December 26, 2010 #

  54. I have deleted the system tool, but I don’t see at reason to re-edit the HOSTS thingie…

    so Im asking why do HOSTS need change?

    Comment by christian kloster — December 26, 2010 #

  55. I’m computer illiterate. I need step-by-step instructions. I’ve tried your instructions and my computer doesn’t come up with what you say I should have.

    Comment by Dale — December 26, 2010 #

  56. You’re a good guy, Patrik. This saved me a huge headache. Thanks!

    Comment by Mateo — December 26, 2010 #

  57. I am a computer illiterate! When my comp. was infected by system tool, I freaked out tremendously. Thanks to your post, I was able to remove it successfully (even though i spent a while to figure out how things work step by step). Once again, ppl like you make it easier for me. thanks

    Comment by Christy — December 27, 2010 #

  58. thanks alot, I was so freaked out when it hit but the instructions worked perfectly. Gotta be more careful now these scumbags are getting better at this

    Comment by Greg — December 27, 2010 #

  59. I think that everything is allright again

    hope that the virus dosn’t show it’s face again!

    Comment by christian kloster — December 27, 2010 #

  60. whats with the HOSTS DON’T get it.



    Comment by christian kloster — December 27, 2010 #

  61. Thanks a million. It worked to tee. I couldn’t get online so I had to download the Malwarebytes onto a flash drive from another computer to get started, and just followed your instructions. Thanks again.

    Comment by Luke — December 27, 2010 #

  62. System Tool popped up on one of my notebooks on Christmas; couldn’t do anything to fix it. Your site came up on Google and I gave it a try. After downloading the program to a USB stick and booting the notebook in SAFE mode, I ran the program and it worked perfectly. Thanks for the help!

    Comment by Greg — December 27, 2010 #

  63. christian, the rogue may change the Windows system HOSTS file, so you need reset it with the default version for your operating system.

    Comment by Patrik — December 28, 2010 #

  64. So everyone had been attacked by SystemTool in that Christmas and every website I find on how to delete the virus suggests ONLY malwarebytes.. Making an educated guess and you could easily found who create this virus.. Am I being paranoid?

    Comment by French Sun — December 28, 2010 #

  65. Thank you very much for the information, It really helped me to get rid of the %#$/&()#?) system tool, Thanks.

    Comment by Fidel — December 28, 2010 #

  66. Whoever you are, you are my hero. Terrifying, awful, bewildering beast that has plagued me all night and you have saved me. Go well and thank you! x

    Comment by Rob — December 28, 2010 #

  67. Hi I got hit by system tool too. My computer won’t open in any safe mode thing, it just goes to a black screen afterwards. I’ve tried system restore but that doesn’t work either. No programs will run nor the internet. Could use your help for any new ideas….

    Comment by Jason — December 29, 2010 #

  68. Actually no need to reply to my last post. I tried system restore in another user account again and it worked this time around. Thanks to whoever’s comment I robbed that idea from. What a bunch of basterds that made this thing, and thanks to anyone who helps us computer idiots out of a jam.

    Comment by Jason — December 29, 2010 #


    Comment by mlawa — December 29, 2010 #

  70. thank you very very very much…

    Comment by taftazani — December 29, 2010 #

  71. Thank you so much, it’s good to have guides like these online!

    Comment by Isaac — December 29, 2010 #

  72. This worked GREAT! You ROCK!

    Comment by JosT — December 31, 2010 #

  73. My computer will not boot in safe mode. I have got this system tool infection and nothing will run in normal mode. Neither will the .exe file in \allusers\application data be deleted – it says it’s in use. So without safe mode I am stuck – and it won’t go into safe mode. Any suggestions? Perhaps I should open a new topic in spyware removal forum?

    Comment by broigel — December 31, 2010 #

  74. thanx alot I got rid of that system tool don’t know how i got it can u tell me how can i get my pc save from that system tool thanx again u saved me

    Comment by sania — January 1, 2011 #

  75. French Sun, Malwarebytes is a good and legitimate malware remover. You can use it for free to remove the rogue.

    Comment by Patrik — January 1, 2011 #

  76. broigel and Jason, try the following:
    Run Internet Explorer, Click Tools -> Internet Options. Select Connections Tab and click to Lan Settings button. Click Advanced button to open Proxy settings. Copy and paste the following text into “Do not use proxy server for addresses beginning with:”;;;

    Click OK to save Proxy settings, then Click OK to close Lan Settings and Click OK to close Internet Explorer settings.

    Download HijackThis from here. Once Save dialog opens, you need first to rename hijackthis.exe to


    Further click Save button to save it to desktop. If you are using the Firefox, then you need right click to the above link to open a Save dialog.

    Run HijackThis. Click Scan button. Select entries that looks like:

    R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http={RANDOM}
    O4 – HKCU\..\RunOnce: [{RANDOM}] C:\ProgramData\{RANDOM}\{RANDOM}.exe


    R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=
    O4 – HKCU\..\RunOnce: [kEdGm06300] C:\ProgramData\kEdGm06300\kEdGm06300.exe

    Place a checkmark against each of them. Once you have selected all entries, close all running programs then click once on the “fix checked” button. Close HijackThis.
    Reboot your computer.
    Go to step 2 above.

    Comment by Patrik — January 1, 2011 #

  77. Hi,

    I downloaded malwarebytes and ran it under safe mode – it came up with two errors whicc I removed – after that I rebooted the computer in normal mode – but the system tool is still there.

    Any suggestions on what I can do different to remove it?

    Comment by NItin — January 2, 2011 #

  78. system tool is gone but my pc is not starting normally I’m so fed up

    Comment by sania — January 2, 2011 #

  79. i cant go to start safe mode.
    i cant click on it..

    Comment by Afel — January 2, 2011 #

  80. oh and uhh
    i cant download the malware

    Comment by Afel — January 2, 2011 #

  81. This thing latched onto my computer on January 2, 2011. What a way to start the new year! Thank GAWD we found your site and followed the instructions!!! Working great now….Thank you, thank you, THANK YOU!!!!!!!!!!!!

    Comment by KENJAE — January 2, 2011 #

  82. when i try to reboot in safe mode, it goes to the black screen and says “no boot device”. It seems my hard drive is kaput. should I still have hope?

    Comment by rachel — January 3, 2011 #

  83. i’m stuck with my computer its not working properly after removal of the virus it says something about hardware settings changes im so tense plz plz smbdy help me……………..

    Comment by sania — January 3, 2011 #

  84. Worked perfectly, thanks, that thing fought me every step of the way. At one point disabled my internet connection, disabled spybot, couldnt bring up task manager. Once I was in safe mode, I nailed the bastard.

    Comment by Carlo — January 3, 2011 #


    Comment by Eldar Zeynalov — January 4, 2011 #

  86. NItin and rachel, try use HijackThis to remove this malware. Look my previous comment.

    Comment by Patrik — January 4, 2011 #

  87. sania, what you mean “but my pc is not starting normally” ? Computer won`t boot in Normal mode ?

    Comment by Patrik — January 4, 2011 #

  88. Afel, use HijackThis. See my answer to “broigel and Jason”.

    Comment by Patrik — January 4, 2011 #

  89. superb Patrik.. from a very gracious UK customer.

    Comment by Ade — January 4, 2011 #

  90. Saved my ass big time.
    Worked a treat in less than 20 minutes.

    Comment by zjaknight — January 5, 2011 #

  91. god dear.!. it workted! thnx

    Comment by henktank — January 5, 2011 #

  92. Thanks, but i can’t get my computer to start at all. Not in safe mode or otherwise.

    Comment by rachel — January 5, 2011 #

  93. I got this crap on me, and every time i boot and press F8, windows boots, how do i fix it?

    Comment by Josh — January 6, 2011 #

  94. hello!i have a pb. The thing is that i did everything i had but while i had to restart my computer i forgot to choose the option with default version for operatig system as u said!so i tried to redo the previous step with malwareb to provoke another occasio to choose the right option. But it doesn’t work. what im trying to say is that i ddint the file with the efault version for my operatig system. If by that you on the black screen i should have cosen the recommaded option instead of the one which said “start windows normally” or something like that. is it really that important i diddnt retasrt my laptop as u said? and if it is, how do i do now? can i still download OTM?

    About system tool, i don’t see it aywhere aymmore, plus apparently there isn’t anythig infected anymore according to malwareb. Tell me if you don’t understand what im sayig cause english isn’t my native language!
    Im waiting for you answer and instuctions, coach! :)
    thanx in advance!

    Comment by soraya — January 7, 2011 #

  95. i used COMBFIX and it got ride of it.

    Comment by dave — January 7, 2011 #

  96. Everything worked perfectly except the part with OTM. I put in the command but on the results side all that was said was:
    File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

    I have vista, so I used the “run as administrator button” but it still said that. So far the computer seems fine, but just to be on the safe side, I posted this.

    And thank you sooo much! Your help was really invaluable :D.

    Comment by Andrew P. — January 7, 2011 #

  97. rachel, if you can`t boot your PC in any modes, then start a new topic in our Spyware removal forum. We will try another way to restore your PC.

    Comment by Patrik (Myantispyware admin) — January 8, 2011 #

  98. Josh, try remove this malware in Normal mode. Follow the instructions in my answer to “broigel and Jason” – Comment by Patrik — January 1, 2011.

    Comment by Patrik (Myantispyware admin) — January 8, 2011 #

  99. soraya, if no any signs of the rogue on your computer then anyway you need to run OTM with the script that i have published above.

    Comment by Patrik (Myantispyware admin) — January 8, 2011 #

  100. Andrew, try the following steps to reset HOSTS file:
    Run Malwarebytes Anti-malware. Open Tools tab. Under FileASSASSIN label click to Run Tool button. In the open window navigate to C->Windows->System32->Drivers->etc and select HOSTS file. Click Open button. Click YES to confirm. Close Malwarebytes Anti-malware.

    Click Start, Run. Type notepad and press Enter. Notepad opens. Copy all the text below into Notepad. localhost

    Save this as HOSTS to your C->Windows->System32->Drivers->etc. (Remember to select Save as file type: All files in Notepad). Close Notepad.

    Comment by Patrik (Myantispyware admin) — January 8, 2011 #

  101. Thank you sooooo much .. started to install it

    Comment by Anoud from Kuwait — January 9, 2011 #

  102. This virus suddenly appeared on my computer. All the sypmtoms were as described in the introduction above. The 2 protection systems I have,MS defender and AVG would not run. I was getting ready to follow the suggestions above and entered the safe mode/networking(by repeatedly clicking F8 at computer beep during turn on) to check if I could use the internet explorer in that mode.After finding that I could,I shut off the computer and restarted it in the normal mode. To my surprise,all the weird stuff were gone. I immediately ran AVG (somehow it worked). It found and isolated 2 Trojan horses. After few hours,my computer is still running normally.
    I do not know what fixed the problem(Virus committed suicide when it figured our it was being cornered?!!!) since the only thing I did was that I entered and left the safe mode. This may be worth trying for anyone else infected with this virus.

    On a different subject, I wish there would be an international organization to go after the SOBs creating these viruses. If they can charge(credit card?) for their “good for nothing” fixes, it should not be too difficult to find them.

    Comment by Gurkan Gokce — January 10, 2011 #

  103. Thaank you so much for your help!!
    it is explained well and it worked right away
    thank you!!!! greets

    Comment by thommy&deez — January 11, 2011 #

  104. Thank you so much for your hints. You saved my computer and my relationship! Thank you so much!

    Comment by Natalie — January 11, 2011 #

  105. thanks so much

    Comment by gareth — January 12, 2011 #

  106. Hey, I found this forum on Google, thought I’d give this fix a try…

    System Tool popped up on my computer this morning, idk why, but I am currently in Safe Mode with networking. I updated and ran the quick scan in Malwarbytes and it’s giving me this message:

    The scan has been completed successfully. No malicious items were detected. A log has been saved to the logs folder.

    WTF?! I have this crippling virus and it’s telling me my computer’s not infected?? What do I do?

    Comment by Allie — January 13, 2011 #

  107. thankyou very very much it worked pefectly thank god for people like you step by step it was awesome

    Comment by gazman05 — January 14, 2011 #

  108. Allie, try remove the rogue using HijackThis tool. Follow the instructions in my previous comment (Comment by Patrik — January 1, 2011: answer to broigel and Jason).

    Comment by Patrik (Myantispyware admin) — January 14, 2011 #

  109. Thanks so very much. I am sooo relieved! Your instructions were wonderful. I think I was surfing way too fast or just not paying attention to what I was clicking on when this rogue (fake) virus landed. Glad I had two more computers in the house so that I could download your program onto a flash drive and tranfer over to my laptop.

    Comment by Kev — January 16, 2011 #

  110. Thankyou!!!

    Comment by Paul — January 17, 2011 #

  111. THANK YOU SO MUCH! perfeccttttt

    Comment by Alyssa — January 19, 2011 #

  112. thanks i could not have done it without your very much appreciated help

    Comment by e ryman — January 20, 2011 #

  113. HOLY CRAP THANK YOU SO MUCH! you guys REALLY need to make this more noticeable on google i tried like 3 other things on being stop zilla you should really put more info that STOPzilla is a very very bad place to go because i called that place they gave me a “diagnoses” said oh you could crash at any moment and other bull crap in the end the guy’s like oh you should pay 209 dollars… and yeah i’m pretty sure that was actually the real company it was an 888 number and it was definitely a call center in india. anyway thanks for not ripping me off and helping successfully fixing my computer

    Comment by Zach — January 20, 2011 #

  114. Wow I know nothing about computers but this guide helped me remove the virus. I’m feeling incredibly pleased with myself. Thank you!

    Comment by Lexiloox — January 23, 2011 #

  115. Hey thank you dear brother/sister.
    May god bless you!

    Comment by Grateful — January 25, 2011 #

  116. Bless YOU –You ANgel OF MERCY!!!!!!!! I will NOT be as dumb again to run these crazy unfamiliar programs. Again I thank u much!!! MUAHS!!!

    Comment by Tbone — January 25, 2011 #

  117. thanks its so easy and it works….thanks guy…god bless you always…….

    Comment by jhun — January 27, 2011 #

  118. thanks a lot!!

    Comment by ge — January 28, 2011 #

  119. Nice job with the instructions. Job well done Every thing is working fine
    Thanks and all the best to you

    Comment by Allan Boxler — January 28, 2011 #

  120. I just wanna say thank you that systemtool crap scared the shit outta me i was so pissed i was about to throw this computer away and then i saw your website and it worked. THANKS YOURE AWESOME!!

    Comment by MrBaywatch — January 28, 2011 #

  121. Awesome!

    This guide saved my laptop!
    Thnx a lot!!

    Comment by dutchdude — January 30, 2011 #

  122. Malwarebytes and Ad-aware wouldn’t remove it…. it would reappear once rebooted.
    HiJackThis WAS able to find and remove it!
    It was located in the C/ProgramData folder.
    I’m using Windows Vista….
    Thanks for the help!

    Comment by Walt — January 30, 2011 #

  123. thank you very much…. big help for me.. thanx a lot…i was relieved of loose.. thnx..

    Comment by MAE DAE — January 31, 2011 #

  124. It helped me remove system tool!It worked!Thank you so much!

    Comment by Marek — January 31, 2011 #

  125. thanx so much in your directions u might want to state change hosts before restarting—a blessing thannks again

    Comment by John Mess — January 31, 2011 #

  126. All these infomation worked like Magic! Thxs sooooo much!!! (: You just saved my COmputer!!! 😛 x

    Comment by Victoria — February 1, 2011 #

  127. Patrick!!! you saved my life!!!
    thank you so much.. now I can use my laptop without any worry

    Comment by Joe Kim — February 1, 2011 #

  128. thx for helping..

    Comment by lkboy — February 2, 2011 #

  129. Thank you so MUCH!!

    I didnt do OTM because i dont understand it

    Comment by abdul — February 2, 2011 #

  130. our pc was infected with System tool last night.. i saw these steps to remove that freakin virus and have it printed.. ive tried it several times, used \Safe Mode\, run Rkill, install MBAM, run Malware, deleted those infections and after i restarted the PC, system tool is still there..i could not open any program and even our internet connection was disabled..need help please..

    Comment by Jiezel — February 2, 2011 #

  131. thank you thank you! i tried and tried before thinking maybe i should google the problem.. i should of done that first!!!

    Comment by angelica — February 3, 2011 #

  132. Thank you so much! This completely got rid of the virus!

    Comment by Fernando — February 4, 2011 #


    Comment by Amy — February 5, 2011 #

  134. Thank you for this! Very quick fix – appears to be totally gone.

    Comment by Matt — February 7, 2011 #

  135. you legend nothing more to say

    Comment by love you mate — February 7, 2011 #

  136. Jiezel, ask for help in our Spyware removal forum.

    Comment by Patrik (Myantispyware admin) — February 7, 2011 #

  137. Many Many thanks for the clear instructions and software to fix this problem.

    Comment by Nathan — February 9, 2011 #

  138. Ditto just about everything said above, thank you so very much

    Comment by Don Alafa — February 10, 2011 #

  139. works for me. Thanks

    Comment by Kārlis — February 11, 2011 #

  140. hey i cant download i cant open anything and i cant boot up in safe help i have windows 7

    Comment by Ron — February 12, 2011 #

  141. For those of you who get boot disk option pressing F8 need to press F12. Had the same issue. Huge thanks for the fix, works wonderful.

    Comment by Cass — February 12, 2011 #

  142. Unbelievable. Worked in 10 mins. Annoying virus… thanks so much.

    Comment by Tanya — February 12, 2011 #

  143. Thank You so much!
    That retarded system tool is off my computer.

    Comment by TJ — February 13, 2011 #

  144. PHEW!!! It took me a few times to get the order right, but I finally did it, I had to use OTM while rebooting and get it off before that stupid virus kicked in, ty, semper fi!!

    Comment by Jeff Z — February 14, 2011 #

  145. Ron, try the the instructions that i have posted above (answer to broigel and Jason).

    Comment by Patrik (Myantispyware admin) — February 14, 2011 #

  146. Hi,
    In order for me to completely remove system tool 2011, I had to rund Malwarebyte’s three (3) times. So if you still have problems after a scan and reboot, simply run the scanner once or twice more times. (Depending on if the program reveals other infected files.)
    The third time I ran the scanner, I didn’t get any infected files warning, and upon reboot, the machine was fixed.

    Note: On Windows 7 you might still experience that the background image is that of System Tool. This is a static picture that will not be automatically removed. Simply right click the desktop and set your own/default background image.

    Hope this helps.


    Comment by untz — February 15, 2011 #

  147. thank you thank you thank you !!! , you saved my information with this advice.

    I owe you a beer 😀

    Comment by xander — February 16, 2011 #

  148. Thanks! That worked like a charm! :)

    Comment by Petra — February 17, 2011 #

  149. Hi, someone PLEASE help. System Tool anti virus installed on my pc, i looked around forums that said start up in safe mode. The virus now prevents my computer from starting up at all, and i cannot boot in safe mode, safe mode with networking, or with command prompt. It’s an absolute nightmare. I have files i cannot lose on the computer so rally could do with getting this sorted. Thanks, Ben

    Comment by Ben — February 17, 2011 #

  150. Thank you so much for everything! God will truely bless you.

    Comment by Kellie — February 18, 2011 #

  151. Thanks! I got hit with that Systemtool thing and within an hour I was back to normal.

    Comment by Matthew — February 19, 2011 #

  152. This just happened to me and I can’t even get into safe mode. It won’t even let me do that? any suggestions?

    Comment by shane — February 19, 2011 #

  153. My computer won’t let me connect to the internet in safe mode to download malwarebytes??? What am I doing incorrectly?

    Comment by Brenton — February 19, 2011 #

  154. By the way, when I boot up regular I have no problem connecting.

    Comment by Brenton — February 19, 2011 #

  155. Wow, thank you. Your instruction saved my day. I did not get any problem to fix it as guided. Thanks!

    Comment by Jess — February 20, 2011 #

  156. It actually worked and I know nothing about this stuff! Thanks a million!

    Comment by Lina — February 20, 2011 #

  157. Shane, try the instructions that i have posted above (answer to broigel and Jason,omment by Patrik — January 1, 2011).

    Comment by Patrik (Myantispyware admin) — February 20, 2011 #

  158. Brenton, you need to use “Safe mode with networking”

    Comment by Patrik (Myantispyware admin) — February 20, 2011 #

  159. Patrik, even my Internet Explorer isn’t working. It opens and says Connecting… and then the tools menu only lets you click on “Compatibility Settings” and “Suggested Sites”. ????

    Comment by shane — February 20, 2011 #

  160. I am currently using mozilla firefox.

    Comment by shane — February 20, 2011 #

  161. I am on a company network and when I reboot it will not allow me in to the screen to go into safe mode. How can I get around this to get rid of the System Tool virus? Thx

    Comment by Irene — February 20, 2011 #

  162. Wonderful info, worked like a charm.

    Comment by bee — February 22, 2011 #

  163. What a relief! Thank you

    Comment by aleka — February 24, 2011 #

  164. my husband fell for this scam and ordered the full System tool program. Was supposed to be $59 and they drafted our bank acct for 79.90 and 8.63. Help??? I will use above info to remove but how do I get my money back?

    Comment by Shelly — February 25, 2011 #

  165. Thanks for the help. With the combination of Malwarebytes and HijackThis, I was able to get rid of this mess. A couple of tips:

    1. Be sure to download the updates for Malwarebytes before running it. I didn’t do that the first time, and I still had System Tool.

    2. To be sure you can download the updates, use a wired connection to your router. I found that I could not get a wireless connection in safe mode, so that’s why I ran Malwarebytes the first time without the updates.

    Comment by Bob — February 25, 2011 #

  166. Thank you thank you thank you!! you saved my life and education!!!
    you have no idea how much this means to me!

    Comment by Kasper — February 26, 2011 #

  167. Works perfect!
    Thx :)

    Comment by Sebring — February 26, 2011 #

  168. Thank you,
    I had no problem removing system tool folling the instructions provided.

    Comment by fred greenberg — February 26, 2011 #

  169. woow thank you so much this was really helpful saved my day,one question though, what type of sites should we avoid allowing this to happen again?

    Comment by Mark — February 26, 2011 #

  170. It does work exactly as you recommended. Many thanks for your professional assistance. Best regards from Geneva, Switzerland.

    Comment by Mercz — February 26, 2011 #

  171. many thanks for this – the steps worked & the system tool was removed quickly & easily. Many thanks for your help!

    Comment by dylan & sharon — February 26, 2011 #

  172. I just did it!
    I spent all day trying to get rid of that freakin thing.
    I have McAfee(piece of s…t) it let it thru.
    I coudnt get my PC to the Safe mode until I hold the F8 key down right from the point of shutting down to start (my PC dont make any beeps when it starting up). Then I got to the Control Panel and click on Recovery. It works like a magic!
    It restored my system to as February 24, didnt effect any of my documents and freakin thing is GONE!!!!!!!!!
    I hope it will never come back!
    I think the problem started when I downloaded Explorer 9, but I’m not sure.
    Good luck to all of you!

    P.S I run full scan for 2 hours with McAfee before I did “Recovery” – and it didnt detect anything!!! Is that something!

    Comment by Marina — February 26, 2011 #

  173. Just want to say a MASSIVE THANK YOU to Patrik for the advice! I have just had a mare of a Saturday night when my computer got infected with System Tool. Your Internet Explorer advice eventually worked and my laptop is (hopefully) fixed. If my friend Amie hadn’t found this advice on the net I dont know what I would have done. Thank you so so so much, I cant thank you enough!

    Comment by Katie — February 26, 2011 #

  174. Just got infected by System tool and removed it in under 10 minutes without using safe mode or downloading anything. Solution is simple: reboot your pc, and the very split second your desktop appears press Control+Alt+Delete to launch Task Manager. Under Processes you will see an application whose name is an incoherent string of letters and numbers appear, that is the System Tool virus. Highlight it, click End Process. Now you have all the time you need to find where the virus saved itself on your C:/ drive (usually it’s under program files, program data or in a temp folder) and kill it.
    Note the virus normally prevents you from starting Task Manager. For the above to work you literally have to execute the commands I described in under 4 seconds which is the time it takes for the virus to launch itself. Within 3 seconds of having launched the virus will shut down Task Manager. It took me 3 tries to be quick enough!

    Comment by maerev — February 26, 2011 #

  175. Bloody awesome. Thanks heaps for your help. Well laid out and easy to follow – even for an absolute non-techie like my husband. Cheers all.

    Comment by Becky — February 26, 2011 #

  176. The MBAM scan says the system tool is gone but my computer is running so slowwww. What did I do wrong?

    Comment by Chelsie — February 27, 2011 #

  177. This is what I have, but my computer will not start in safe mode at all. Any suggestions? I have a recovery console option for start up.

    Comment by Sarah — February 27, 2011 #

  178. thank you so much i have been going out of my mind with this nasty little virus thanks to this ite my pc is restored and all the iteunes music for my wedding is back instead of being infected an excellent site many thanks

    Comment by sarah — February 27, 2011 #

  179. Shelly, contact your credit card company and tell them what has happened.

    Comment by Patrik (Myantispyware admin) — February 27, 2011 #

  180. I am having a real problem with this. All I get is a blank screen. On reboot I can get to f8 menu but even when choosing safe mode I get a blank screen. If I press ctrl alt and delete it seems to restart the computer and the whole process starts again ending with a big blank screen!

    How can I remove the virus? Any help would be much appreciated. Thanks in advance


    Comment by Toddster — February 27, 2011 #

  181. Many thanks!! God bless u! :)

    Comment by Lucky — February 27, 2011 #

  182. THANKS SO MUCH! These instructions saved my life. I followed them exactly and now this computer is fine! THANK YOU!

    Comment by becky — February 27, 2011 #

  183. Patrik

    I ran Malwarebytes but System Tool hadn’t gone so I have done a scan using HijackThis (as per an earlier post by you dated 16 December 2010). The only line I can find that features the words ‘RunOnce’ is as follows:

    HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

    Am I safe to delete this (it’s not the same as the example you give)? Is there anything else I should be looking for?

    Thanks for your help.

    Comment by Mary Collyer — February 27, 2011 #

  184. brilliant!!

    Comment by daniel — February 27, 2011 #

  185. This was amazing. This really helped me and if my friends or somebody I know runs into a virus or problem, I will, without a doubt, direct them here.

    Comment by Bert — February 27, 2011 #

  186. YESSS SYSTEM TOOL IS DEAD :”D now i will remember too scan my computer regularly….. then mum won’t kill me.
    Thank Youuu!!!

    Comment by Katie Duffy — February 27, 2011 #

  187. How can I get onto the Internet in safe mode so that I can download the malware programs? I have an aircard for internet access, and that doesn’t work now.

    Comment by Heather — February 27, 2011 #

  188. Thank you so much Patrick!!! Your instructions were easy to follow as well as execute. The only challenge I am having is resetting the HOSTS. I had the same problem as Andrew above. I read the reply you posted on 1/8 to Andrew and tried to follow the instruction there. However I could not find the etc file once I got to Window–>System32–>drivers. How do I reset the HOSTS? I want to follow to completion and make sure that I can do as much as I can from preventing this from happening again. Your help is much appreciated.

    Comment by Kay — February 27, 2011 #

  189. you dont have to start it with safe networking just recover your computer and thanks for everything but make sure we spread these into messages and emails to save peoples computers and laptop

    Comment by eV x RAPIDZzz — February 28, 2011 #

  190. hi i have tried the malware but as i can not connect to internet had to down load on another computer did the update but when loading om infedted computer it says it still needs updating so its not finding system tools at all just going round and round in circles here plzzzzzzzzzz help me :O(
    oh also tried you hyjack this but cant make head or tails of that :O(

    Comment by angie — February 28, 2011 #

  191. Chelsie, try scan your computer with Kaspersky virus removal tool.

    Comment by Patrik (Myantispyware admin) — February 28, 2011 #

  192. T, try boot your computer in Last good configuration.

    Comment by Patrik (Myantispyware admin) — February 28, 2011 #

  193. Mary, looks like the line is ok. Start a new topic in our forum and post your HijackThis log into it. I will help you to check your PC.

    Comment by Patrik (Myantispyware admin) — February 28, 2011 #

  194. Thank you for this life-saver. I am a complete luddite but even I have followed your instructions no problem. Perhaps you could be a little clearer about the problems many of us have experienced running OTM, but apart from that fantastic!

    Comment by Nicky — February 28, 2011 #

  195. Hi Thanks so much for all your help! I opened in safe mode as per the advise. Then I got confused by all the instructions so I just logged onto the internet and used Microsofts instructions on performing a system restore. Its all sorted now thanks :)

    Comment by Kat — February 28, 2011 #

  196. Worked like a charm. Thank you!

    Comment by Hari — February 28, 2011 #

  197. I used malwarebytes after pressing F8 repeatedly whilst booting up the laptop. It wasn’t too difficult even for a technophobe like me. Worked a treat and the whole nightmare of being hit by a virus has got me to seriously look at my future security.

    Comment by Duxuk — March 1, 2011 #

  198. i got infected with the system tool rubbish and it wouldnt let me do anything at all then it turned off my laptop altogether and on startup i used safemode to load and it found no threats. now i have managed to get back online and dont seem to be getting the system tool popups but i know they will come back-how to i search for the infected files to remove them completely?? thanks !!

    Comment by sarah — March 1, 2011 #

  199. Thank you very much, worked perfectly!

    Comment by Jon — March 2, 2011 #

  200. omg. i don’t know how to thank you.
    :O :O :O
    i am so suprised it really works, that damned virus is just gone now 😀
    thank you x 1000!

    Comment by hanky — March 2, 2011 #

  201. i’ll do anything to support this website from now by the way, thankyouthankyouthankyou!

    Comment by hanky — March 2, 2011 #

  202. fantastic! worked like a charm!
    thank u malwarebytes’!

    btw- i wish someone could “return the favor” to the fellas’ over at system tool?

    Comment by Curt — March 2, 2011 #

  203. I didn’t have any luck with Spybot, but I downloaded Malware Bytes, ran a full scan, and I believe it works. I had to reboot after the scan as it told me to do, and my computer seems to be fine, that damned system tool didn’t show up, and my taskbar appears normal. Fingers crossed!!

    Comment by Don — March 3, 2011 #

  204. please watch my YouTube video to that I have made to remove system tool

    1) Unplug your PC
    2) Plug it back in and power it up
    3) You will be asked how you want to power your PC back up. Select “Safe Mode with Networking”.
    4) After your PC finishes booting (note that you don’t see the bad background anymore) open up a command prompt (running “cmd” in “Search Programs and Files” on the bottom of the menu that comes up when you select “Start” in Windows 7 works).
    5) Run “C:Windowssystem32
    6) Look for registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce
    and click on it.
    7) There will be two keys. One will be “default”. One won’t. Write the one that isn’t down. I had “C:ProgramData MdOtQz3816 MdOtQz3816.exe”, but it’s different for everyone.
    After you write that key down exactly, delete it and close the program.
    9) Back in the command prompt window do a “cd” to that path. Note that if you do a directory listing of the root directory (i.e., “cd ” and then “dir *.*”) you WON’T SEE ProgramData. Don’t worry – it’s a hidden directory. If you run “cd ProgramData” it’ll work.
    10) “cd” to the directory that was shown in the directory key.
    11) Delete it’s contents.
    12) Perform “cd ..”. That brings you back up into “C:ProgramData”. Remove the directory. In the example I’m using run “rmdir fMdOtQz3816″.
    13) Now bring up Internet Explorer (yes, even if you normally run some other browser).
    14) From the menu bar and the subsequent pop-up windows, select “Tools”, then “Internet Options”, then the tab “Connections”, then the button “LAN Settings”.
    15) You’ll see a check box for Proxy Settings. If it’s checked, uncheck it. Close that all up.
    16) Back in the command prompt window, go to “C:Windowssystem32driversetc”. There should be a hosts file. Edit it (“edit hosts”) and edit it so that there’s only one line and it says “ localhost”. You can separate “″ and “localhost” with either a space, a few spaces or a tab, it doesn’t matter.
    17) Close everything up and reboot your machine. If it asks when it comes back up, tell it to start Windows normally. You’re done

    Comment by haig — March 3, 2011 #

  205. Thank you my friend, may God bless you immensley for such detailed procedure. Works like a charm and that nusense is gone!!!! Thank you!!!!

    Comment by John — March 3, 2011 #

  206. Thank you. I ran malwarebytes and it seems to have corrected the problem. I am hesitant to re-set the HOSTS file as I don’t want to have to re-load printer drivers. How necessary is it do re-set the HOSTS file? Can I assume everything’s ok if I go a few days without further problem?

    Comment by Jim — March 4, 2011 #

  207. Heather, you need use “Safe mode with networking”.

    Comment by Patrik (Myantispyware admin) — March 4, 2011 #

  208. angie, try the instructions that i have posted above (answer to broigel and Jason,omment by Patrik — January 1, 2011).

    Comment by Patrik (Myantispyware admin) — March 4, 2011 #

  209. sarah, update your antivirus and perform a full scan.

    Comment by Patrik (Myantispyware admin) — March 4, 2011 #

  210. Jim, if computer works fine, no any redirects (google, yahoo, etc), then, I think, you HOSTS file is ok and you can skip last step.

    Comment by Patrik (Myantispyware admin) — March 4, 2011 #

  211. Wow! What a quick and easy fix! Had my laptop with the instructions from this site beside the infected desktop. Removed that nasty program without any trouble. Thanks a million!

    Comment by roland — March 4, 2011 #

  212. aDownload Malwarebytes.
    Sorry, I spelled malwarebytes wrong before… Day number 2, all seems fine!

    Comment by Don — March 4, 2011 #

  213. I have followed instructions and installed/run MBAM and OTM and initially when I log-in my regular desktop background is back for about 5 seconds, then switches back to the system tool….HELP!

    Comment by SB — March 4, 2011 #

  214. Tausend mal DANKE……………..!

    Comment by Werner — March 5, 2011 #

  215. Looks like it worked. Wasted $50 and all night on norton, didn’t fix it. Got makwarebytes, system tool is gone in 20 min. Thank you!!!

    Comment by JanH — March 5, 2011 #

  216. *malwarebytes

    Comment by JanH — March 5, 2011 #

  217. thanks, this process worked for me right away

    Comment by Anne — March 5, 2011 #

  218. Hello System tool showed up about a week ago, well maybe it was there earlier because my anti virus mysteriously shut off twice. Then it showed up screaming of infection. I ran my virus program and it showed nadda. A couple of days later my left click stopped working(may not be related) and the pc started shutting down on its own. Tonight it went bonkers, many many viruses and trojans reported by the “Rogue”. Phony desk top and anti virus would not open. THANKS Buddy! Hopefully it is OK time will tell with this bad little mutha.

    Comment by Mary — March 6, 2011 #

  219. My husband and I are not that computer savey, but when we got this malicious virus, we were determined to \win\. Thank you so very much for this website! We followed the directions (it took a couple of tries) and it worked perfectly!!! We have Vista ( which has been another awful mess) but all things are working smoothly! I agree with another comment above, someone needs to go after these bastards who think its ok to swindle people and cause major stress in their lives!!!

    Comment by Carla B. — March 6, 2011 #

  220. So everything went well I ran OTM and it worked, but my computer Host often crashes I get a window and a blue bar will pop up on it and quickly disapears then it will tell me my host has quit working then I wont be able to open any programs.. please help and redirects on the internet

    Comment by Angie — March 6, 2011 #

  221. Got this System Tool thing tonight and followed your instructions and I managed to get rid of it. Thanks so much! What I don’t understand is how come the anti-virus software I have (Sophos) didn’t stop it?

    Comment by Devi — March 7, 2011 #

  222. Help please – My son reported systems as above, and like a dutiful dad I’m trying to sort out for him, after taking the actions listed below I now get ‘Other user’ when booting up windows (Rather than the 2 users set up, myself and my son), and unable to logon.

    Running Vista Home Premium

    Actions taken: –
    – Start up in Safe Mode with networking
    – Run MalwareBytes following your instructions above, including running OTM to reset Hosts, run twice, found 3 rogue files and removed them
    – Tried to download and install McAfee, Internet explorer ‘reported a problem’ and shut down!
    – Run HijackThis, found 1 rogue file and removed
    – Run Security 360, found nothing
    – Run Advanced SystemCare, found nothing
    – Searched Registry for RunOnce, found a number although all pointing towards Microsoft and couple towards Google, so didn’t delete as not sure exactly what I was looking for!
    – Run MalwareBytes again and nothing reported now
    – Tried to run Windows update, appeared to download Vista SP1, got to 100% of install process then hung (twice)
    – Cannot turn on Windows Defender
    – Tried to install AVG (Free version), but crashed towards end of install

    Left machine running – Microsoft Security Essentials, found nothing, then as late I closed down laptop

    Booted up this morning in both normal & Safe mode and just get ‘Other user’ logon, any help would be greatly appreciated, as only thing I can think of now is re-install!!

    Thanks in advance

    Comment by Glenn — March 8, 2011 #

  223. Angie`, ask for help in our Spyware removal forum.

    Comment by Patrik (Myantispyware admin) — March 8, 2011 #

  224. My friend just got this problem of system tools on his windows 7. I’ve had a bit of experience in being infected and started the computer on safe mode with networking. Fortunately windows 7 had noticed the problem and a system restore window had popped out when the computer was restarted. I selected the option to restore the settings before anything bad had happened. It had restored the settings before any problems had started, and system tools was gone. It’s too soon to say if it really was gone, but i’m going to download the malaware and run it to make sure.

    Comment by Jack — March 8, 2011 #

  225. I have followed all the steps and it is still not removed.

    To haig, trying to follow your directions here but step #5) Run “C:Windowssystem32egedt32.3xe” it can’t find this. Is this spelled correctly?

    I’m not sure what else to do at this point.

    Comment by Jess — March 8, 2011 #

  226. Thank you so much for the invaluable instructions on here! If you can’t get the software to update, download the updated rules manually because it it caught something extra when I updated the rules.

    It took two runs of Malwarebytes to get this malicious software off (one with old rules, one with new rules) and things are running smoothly again. I’m going to have to be careful with which sites I visit from now on.

    All I can say, is this is the best set of instructions that I’ve ever read to help an accounting student solve a computer issue.

    Thank you thank you thank you!

    Comment by Kevin — March 9, 2011 #

  227. This was freaking awesome, I got rid of that freakingcrap virus and I can use my computer normally again thanks a lot!!!!!!

    Comment by juan c. — March 9, 2011 #

  228. Thank god I have you guys :) I got it and now its gone thanks a million! You are life savers :)

    Comment by Alex — March 10, 2011 #


    I got this shit yesterday and couldn’t connect internet. I was very angryyyy. I had found your site and fixed it. It’s great!!!!!!!!

    Comment by Pichamon — March 12, 2011 #

  230. Safe mode with networking then install Malwarebytes Anti-Malware, launch, then update, scan and remove fakeware. Easy. This is how you get rid of all scareware imo.

    Comment by BillC — March 12, 2011 #

  231. THHAAAAAANNKKK YOU SOOO SO SO MUCH!!!! Everything worked with me!!!! PERFECT. Thanks for the description. Even the OTM worked well!!

    Comment by barry — March 14, 2011 #

  232. Thank you for all your help.

    Comment by Tommy — March 14, 2011 #

  233. thanks it’s so cool…GL

    Comment by andy — March 15, 2011 #

  234. I did the process when I got it yesterday, it was gone and everything was running fast and functioning perfectly again, but today…..its back!! It came back while i was trying to open an attachment in my email, could it have possibly latched itself onto that? It came back even tho I have MC afee and malwarebytes running and scanning. Malwarebytes gets rid of it with stellar results but how do I KEEP IT AWAY FOREVER?!

    Comment by ry — March 15, 2011 #

  235. The program fooled me to buy the software which to find out it is a fake.
    I called to cancell my credit card right away.

    Comment by hank — March 15, 2011 #

  236. Thx a lot!!!!!

    When system tool appeared i was home alone so i almost bought it.

    fortunately i had the idea to search for a way to delete it and discovered it was fake,


    Comment by ALPHA — March 15, 2011 #

  237. sorry, but i just can’t stop thanking you.
    just 1 extra comment (:
    god bless you, thanks!!!
    i wonder how you feel making so much people relieved and happy without asking anything back, must be good !

    Comment by hanky — March 16, 2011 #

  238. Thank you so so much!!! Your instructions immediately remove the annoying spyware. You saved my laptop! I can’t thank enough 😀

    Comment by Linda — March 18, 2011 #

  239. thank you so much bro….

    Comment by coolcub — March 18, 2011 #

  240. WOW!!!! I am a computer DUMMY and I followed the instructions and am now virus-free! Please post instructions for how to start safe mode for other dummies like me – I had to look that up separately. But, once I did, I followed your instructions and it worked perfectly. Very easy!! Thank you!!!!!!!

    Comment by Jen E — March 18, 2011 #

  241. Oops, never mind my comment about safe mode! I forgot that YOUR site was where I found those instructions. Told you O was a dummy!

    Comment by Jen E — March 18, 2011 #

  242. I downloaded mbam to the desktop and then tried to run it and came back with…Users\Owner\Desktop\mbam-setup.exe is not a valid Win32 application.

    Sorry I don’t know much about computer. This is all a different lanugage to me.

    Comment by Leslie — March 18, 2011 #

  243. Thank you so much, your guide really save my day. Good job and keep continue to give joy to people by sharing your knowledge. Bravo!!!!!

    Comment by Lucky — March 19, 2011 #

  244. Hello, can you help solving a new problem?
    after removing system tool, installing Java uptade used otm and checked for the new string in register, i tried to open a browser and it won’t load a page…is there any connection?
    Thanks in advance

    Comment by manuel — March 20, 2011 #

  245. Everything worked great — THANKS SO MUCH!!! — but now I get the following error message when I try to launch/turn on System Restore.

    “System Restore has been turned off by group policy. To turn on System REstore, contact your domain Administrator.”

    I get this in Safe mode and reg mode in Admin & MyName logins. Can’t seem to turn on System Restore much less do a system restore. I think this is some legacy of the rogue.

    Can anybody help with this? (much gratitude)

    Comment by Namreh — March 21, 2011 #

  246. Thanks so much for this. I tried so many different things to remove this but nothing worked until now. Thanks for making the steps so easy to understand for computer dummies like me.

    Comment by Tabby — March 21, 2011 #

  247. thank you for the free down load. It took care of the System Tool spyware problem.


    Comment by Butch Fenn — March 22, 2011 #

  248. I was literally in tears. Thank you so much. I used the microsoft fixit to complete the last step because I couldn’t get that part to take, but the rest worked like a charm.

    Comment by Karen — March 22, 2011 #

  249. thank you very much. I hope that it doesnt happen again.

    Comment by Mike — March 23, 2011 #

  250. Thanks, I tried 2 fix dis 4 almost 12 hrs then I tried wats n ur site. Omg its gone! Tnx super u r a genius! God bles!

    Comment by MarCotanedo — March 23, 2011 #

  251. what happens if you do not do Step 3 (reseting the host)?

    Comment by Alex — March 23, 2011 #

  252. Can you please help me on how i can remove system tool on my computer. Its so frustrating.Please help!!!

    Comment by glory ncube — March 23, 2011 #

  253. Alex, the rogue may add few entries into the HOSTS file so that when you open Google, Yahoo or Bing, you will be redirected to various misleading websites. To fix it, you need to complete the step 3.

    Comment by Patrik (Myantispyware admin) — March 25, 2011 #

  254. glory ncube , if the instructions above does not help you, then ask for help in our Spyware removal forum.

    Comment by Patrik (Myantispyware admin) — March 25, 2011 #

  255. anyone that can help. I just followed the instructions above and it appeared to work. However when I restarted my computer the same System tool screens popped back up. I repeated the process and the same thing happens. Possibly it is reinstalling itself? Please help

    Comment by Dan — March 25, 2011 #

  256. this worked perfectly and was so easy to follow. .. thank you so much

    Comment by andrew — March 25, 2011 #

  257. Dan, looks like your computer is infected with a trojan that reinstalls the rogue. Try update Malwarebytes and perform a fresh scan, if it does not help, then ask for help in our Spyware removal forum.

    Comment by Patrik (Myantispyware admin) — March 28, 2011 #

  258. Thaaaank Youuuuuuuu, It works

    Comment by coxqz — March 30, 2011 #

  259. I am at a total loss. i have tried everything that has been shown on this link as well as others and this pice of **** program is still infecting my computer. I need help…please!!!

    Comment by davidp — March 31, 2011 #

  260. davidp, ask for help in our Spyware removal forum.

    Comment by Patrik (Myantispyware admin) — April 1, 2011 #

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>


My Anti Spyware - Free antispyware programs and Spyware Removal Instructions.