System Security also known as System Security 2009 is a rogue antispyware program The rogue (fake) antispyware application is fresh version of Winweb Security. System Security is distributed through the use fake online malware scanners that tells you that your computer infected with variety of trojans and spyware and that you must install the software to clean your computer. During installation, System Security configures itself to run automatically every time, when you start your PC. The rogue antispyware may drastically slow the performance of your computer.
Once running, System Security will scan your computer and list a large amount of infections. All of these infections are fake, so you can safely ignore them. Also one of these infections is c:\windows\system32\svchost.exe is actually legitimate Windows file. This file a very important system file, w/o that file, your computer would not work correctly.
System Security blocks the ability to run any programs, including Malwarebytes Anti-Malware. The following warning will be shown when you try to run any program:
WARNING!
Application cannot be executed. The file mbam.exe is
infected.
Please activate your antivirus software.
Also System Security changes desktop background to black with the message:
WARNING
YOUR`RE IN DANGER!
YOUR COMPUTER IS INFECTED WITH SPYWARE
While System Security is running your computer will show false security alerts and nag screens:
System Security Warning
Spyware.IEMonster activity detected. This is spyware that
attempts to steal passwords from Internet Explorer, Mozilla
Firefox, Outlook and other programs.
Click here to remove it immediately with System Security
System Security Warning
System Security has detected harmful software in your system.
We strongly recomended you to register System Security to
remove these threats immediately.
System Security
Harmful software detected
System Security has detected harmful software that can lead your PC crash.
Remove them Now by clicking Remove All button below.
System Security Warning
Intercepting program that may compromise your privacy and
harm your system have been detected on your PC.
Click here to remove them immediately with System Security
System Security
WARNING 38 infections found!!!
If you are clicking on the fake alert then System Security will start a web browser and open a web site asking you to purchase the fake program. Computer users are urged to avoid purchasing this bogus program! Please ignore all fake alerts and use the following System Security removal instructions below in order to remove this infection and any associated malware from your computer for free.
Symptoms in a HijackThis Log.
O4 – HKLM\..\Run: [16847964] C:\Documents and Settings\All Users\Application Data\16847964\16847964.exe
O4 – HKLM\..\Run: [96857956] C:\Documents and Settings\All Users\Application Data\96857956\96857956.exe
O4 – HKLM\..\Run: [66867959] C:\Documents and Settings\All Users\Application Data\66867959\66867959.exe
Note: System Security uses random names for hide itself.
Use the following instructions to remove System Security (Uninstall instructions).
Download HijackThis from here, but before saving HijackThis.exe, rename it first to explorer.exe and click Save button to save it to desktop.
Doubleclick on the explorer.exe icon on your desktop for run HijackThis. HijackThis main menu opens.
Click “Do a system scan only” button. Look for lines that looks like:
O4 – HKLM\..\Run: [16847964] C:\Documents and Settings\All Users\Application Data\16847964\16847964.exe
O4 – HKLM\..\Run: [96857956] C:\Documents and Settings\All Users\Application Data\96857956\96857956.exe
O4 – HKLM\..\Run: [66867959] C:\Documents and Settings\All Users\Application Data\66867959\66867959.exe
Place a checkmark against each of them. Once you have selected all entries, close all running programs then click once on the “fix checked” button.
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select “Perform Quick Scan”, then click Scan to start scanning your computer for System Security associated files and any other trojan infections. The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of System Security related items similar as shown below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected for start System Security removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
System Security creates the following files and folders
C:\Documents and Settings\All Users\Application Data\02042687
C:\Documents and Settings\All Users\Application Data\90436866
%UserProfile%\Pedro Adrian\Start Menu\Programs\System Security
C:\Documents and Settings\All Users\Application Data\02042687\02042687.exe
C:\Documents and Settings\All Users\Application Data\02042687\02042687.glu
C:\Documents and Settings\All Users\Application Data\02042687\pc02042687cnf
C:\Documents and Settings\All Users\Application Data\02042687\pc02042687ins
C:\Documents and Settings\All Users\Application Data\90436866\90436866.exe
%UserProfile%\Start Menu\Programs\System Security\System Security 2009 Support.lnk
%UserProfile%\Start Menu\Programs\System Security\System Security 2009.lnk
%UserProfile%\Desktop\System Security 2009.lnk
Thank you VERY much. I was able to delete System Security from my computer. What a pain it has been, but thanks to someone who shared how to get rid of it, you have MADE MY DAY!!!
If you have XP then i can help well it mite work for Vista but i had system security stuck on my comp. And what I did was go to the start menu, all programs, accessories, system tools, system restore. And from there you click the first one selected that says “restore computer to an earlier time” (before you go system security) then like it says select a bold date. then hit next and just follow it through. So at the end your comp. should go to shut down mode and it will restore then and restart and your comp should be fine! Well let me know if that helps any of you wahoo’s out there.
Just want to say thanks ThE aNti virUs.I have done what you suggested and was able to get rid of system security virus.Thanks for sharing your suggestion.
it didnt work..i did what the instructions said, but system security protect your pc is still popping…i dont know what to do..
eugene, please follow these steps.
i did what The anti virus said but it didn’t work. i hate that fucking virus. Can some1 help me plz…
David, please follow these steps. I will help you at our forum.
I WANT TO DELETE FOR DELETE 2008 System Protector
Mirsamir, if these instructions above, don`t help you, then ask help at our forum.
I did it but it deleted files needed for Windows to run properly. what do I do?
rob, what are system files ?
I have System Security on my computer and it is keeping me from opening the MBAM file. Please someone help me!!!!!!!!!!!!!
System Security is installed on my computer. I installed the MBAM program to it, but System Security claims that the file is infected and will not allow it to open or run. Someone please help me!!!!!!!!!!!!
Donna, click Start, then Run.
Type %ProgramFiles%\Malwarebytes’ Anti-Malware
Press Enter.
Malwarebytes home dir will be open.
Locate file mbam.exe or mbam and rename it to myapp.exe (if you have mbam.exe) or myapp.
Run it file.
Also you can ask help at our Spyware Removal forum.
Using Malwarebytes i war able to destroy System Security. In the beginning i could not run any .exe
Suddenly it was possible to run Malwarbytes setup.
No idea wy? But the virus is destroyed
Thanks Heinz
reverse situation 🙂 Probably mistake in the virus code.
My computer had System Security. It ran fine in safe mode, but no scan seemed to be able to delete SS. In normal mode, I couldn’t run any exe file–even after renaming mbam.exe to myapp.exe. I also couldn’t even open up websites to redownload and \
Jack, please follow these steps. I will help you at our forum.
Hi guys.You can download a perfect tool,which will delete your system security virus forever.Try this – siri.geekstogo.com/SmitfraudFix.php
Yes, SmitfraudFix is good free tool, read How to use smitfraudfix.
Its not letting me open mbam-setup a little bubble comes out saying warning and blah blah!
I need help 🙁
Cristina, ask help at our forum.
I have a customer who has the system security virus and I can’t download and open/run any of the suggestions. Can’t do sys restore; can’t do any of the normal things – don’t have original cd to wipe and reboot.
More suggestions?
I have tried everything please help remove system security
Donald, make a new topic at our Spyware removal forum. I will help you.
Linda,he can transfer files to infected computer using a CD or Flash disk.
Soooo I fixed it! xD i just had to know how to put it in safe mode and i learned how woot woot! aha! this thing was a ReALLY pain in the effin ass! xDDD
Ive tried everything on here and still cant get rid of it 🙁
Cant open any programs because system security isnt allowing it 🙁
Tiarnan, please follow these steps. I will help you at our forum.
I had the same problem with the computer not allowing run anything. When the computer first booted up I right clicked the task bar and opened task manager. I went to processes and there were two that were trying to open with numbers *(ie. 12825874 etc). I clicked on those and selected end process before they could load. This allowed me to run the malware program.