Best software to remove "System Security" pop-ups?

mikehende · Jun 25, 2009

Hello all, I am new here, been searching the net for help and decided to try this forum, on Saturday morning I have to go to a friend to try to help him fix the "System Security" pop-ups which recently started. I was wondering if there was any software I can purchase which will surely and very quickly get rid of this pop-up?

Searching the net I have come across 3 softwares which claim to be able to remove this particular "System Security" pop-up [Malwarebytes, PC Tools and Spyhunter] but reading up on many articles some are saying that the Malwarebytes software sometimes does not install properly. I need a software which will surely and very quickly get rid of the System Security pop-ups, is there a software which I can purchase which will do this? Also, is there a software I can do this with but use on another pc possibly in the future? Thanks.

dr.moriarty · Jun 25, 2009

mikehende said: ↑

I was wondering if there was any software I can purchase which will surely and very quickly get rid of this pop-up?...but reading up on many articles some are saying that the Malwarebytes software sometimes does not install properly. I need a software which will surely and very quickly get rid of the System Security pop-ups, is there a software which I can purchase which will do this? Also, is there a software I can do this with but use on another pc possibly in the future? Thanks.
Click to expand...

The freeware version of Malwarebytes does remove this rogue application. You could purchase volume licenses if you wish for multiple computers. * You should realize that often when pc's get infected, they are often hit with more than one infection... and recently rootkits { TDSSxxxx.sys /Senekaxxxx.sys/GAOPDXxxxx.sys/ UACxxxx.sys /ovfstxxxx.sys/kungsfxxxx.sys/SKYNETxxxx.sys - to name a few } will disable tools such as SUPERantispyware, MBAM, AVG, and other anti-spyware and anti-virus programs and applications.

So - to bottom line it then - you need to have more than one plan of action... like following our

READ & RUN ME FIRST. Malware Removal Guide

.. and getting some trained help.

dr.m

mikehende · Jun 25, 2009

what worries me is if I can't go on the net with his pc on Saturday to dowload all of the cleaning tools then what? I would like to be prepared so should I simply purchase and take with me the paid version of Malwarebytes?

dr.moriarty · Jun 25, 2009

* You had also asked about Paid tools that could be used on multiple pc's.

The freeware version of MBAM can remove it.
*Links are given in the R & R Me FIRST Guide for downloading and saving to CD the executables and the definition databases for the scanners --- so you wouldn't be dependent on his internet connection. A flashdrive could also be used - but remember - they are writable and could get infected when inserted.

For instance: I have a SDHC w/card reader & writer that I have all the tools /notes/ and scanners saved for easy transport. All I have to do is load any version updates and definitions --- and off I go!

mikehende · Jun 25, 2009

dr.moriarty said: ↑

* You had also asked about Paid tools that could be used on multiple pc's.

The freeware version of MBAM can remove it.
*Links are given in the R & R Me FIRST Guide for downloading and saving to CD the executables and the definition databases for the scanners --- so you wouldn't be dependent on his internet connection. !
Click to expand...

I never saw any link for saving to cd? I looked again at all the links from one to another but still can't see it? Also, reason why I was focusing on the "paid" version is becuase I thought that the paid version would be better than the free version, is this not correct please?

dr.moriarty · Jun 25, 2009

I'll add -

Activating the full version unlocks realtime protection, scheduled scanning, and scheduled updating... and - the freeware version can be installed on multiple pc's.

mikehende · Jun 25, 2009

So as far as the actual scanning and removal of the pop-up in question, there is no difference between the paid and free versions? Also, can you direct me to the link to save to the cd please? It's not like I am not trying, as a matter of fact, the opposite, I am just not seeing it?

dr.moriarty · Jun 25, 2009

No difference in its/their ablility to detect and remove.

For Malwarebytes:
http://malwarebytes.gt500.org/database.jsp

For SUPERAntiSpyware:
http://www.superantispyware.com/definitions.html

# Installation of the downloaded database(s) --- simply "dbl-click" the file after installing the main executable.

dr.m

mikehende · Jun 25, 2009

Last question please, so I should as per the instructions on the Read Me First page "Rename the downloaded mbam-setup.exe file to mb.exe"? Should I do this "before" saving it to cd?

dr.moriarty · Jun 25, 2009

The file re-name is only needed as you transfer the .exes to your friend's pc for installing.

mikehende · Jun 25, 2009

ok so I might as well rename it before burning to cd in case I should forget, appreciate the help, will print and go through all the steps in the Read Me First before running the Malwarebytes software, will report back here on Saturday to let you know what happened, thanks.

dr.moriarty · Jun 25, 2009

:major

You're welcome! Good Luck with the cleaning!

dr.m

mikehende · Jun 28, 2009

Here's the ordeal. Went to the friend's location, first I tried to see the system info, could not happen, next I tried to go into the ADD/REMOVE programs, would not happen then went to the net and found that when I type a url it would take me to some other site, it would take me a couple of tries to get to the correct site, when I did get to the MBAM site, I renamed and downloaded the setup on the desktop but it would not open, I then installed both MBAM and SAS from cd but they both would not open, I then downloaded HTLog but it too would not open.

Each time whenever I tried to open a program the System Security icon in the system tray would put up a small promt saying "Warning: Application cannot be executed. The file ccsvchst.exe is infected".

I'd like to know 2 things here please guys:

1] Since the System Security pop-ups only started immdiately after attempting the Panda online scan which failed halfway through, is it safe to say that the online scanning is what activated the System Security? If so that means that the System Security had to have been in the pc already, correct?

2] What else can I do now to get rig of the System Security?

dr.moriarty · Jun 28, 2009

Hello, mikehende

A dangerous problem is that "System Security" will list legitimate and necessary programs as infections.
i.e. Ccsvchst.exe is the executable file that belongs to Symantec Service Framework from Symantec Corporation and is added to your system when you install Norton products such as Symantec Security Technologies and Symantec Event Manager. The file originally resides in a subfolder within the C:\Program Files\Common Files folder.

Ans: 1 The "System Security pop ups" was already on the pc, (refer to your first post) and if System Security is installed, it will be set to start automatically when you login to the computer. I also suspect the presence of a rootkit infection known to interfere with the ability to run malware tools.

Ans: 2 Please follow these instructions -

Bootup into Safe Mode - delete any "System Security" folders found in the "documents and settings\all users\application data\" directory

Re-boot into Normal Startup Mode

Now try to run Malwarebytes - fixing what it finds

Continue on with the rest of our cleaning procedure

Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First. If TDSSserv is not found, just continue on with the READ & RUN ME.

TDSSserv Non-Plug & Play Driver Disable

READ & RUN ME FIRST. Malware Removal Guide

If something does not run, write down the info to explain to us later but keep on going.

Do not assume that because one step does not work that they all will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated, our system works the oldest threads FIRST.

Click to expand...

dr.m

mikehende · Jun 28, 2009

Sorry, i forgot to mention that I also tried many times to boot into safe mode by pressing f8 but it would not let me, whenever I press f8 it would go into setup instead?

dr.moriarty · Jun 28, 2009

Please try continuing with the rest of my instructions and let me know any problems you have doing them.

dr.m

mikehende · Jun 29, 2009

dr.moriarty said: ↑

Please try continuing with the rest of my instructions dr.m
Click to expand...

Sorry Doc, I must be missing something here? As far as I see it, all of the instructions above has to do with getting into safe mode which I can't?

dr.moriarty · Jun 30, 2009

Referring to the instructions in the READ & RUN ME FIRST. Malware Removal Guide

You need to attach (See: HOW TO: Attach Items To Your Post ) the below logs created by running the requested scans

SASlog.txt log from SuperAntiSpyware.

Malwarebytes Anti-Malware log

RRlog.txt from RootRepeal

ComboFix.txt (normally C:\ComboFix.txt)

MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.

Click to expand...

* If you can't run one tool - DON'T STOP...please continue on to the next, using Normal Startup Mode.

dr.m

Log in or Sign up

Best software to remove "System Security" pop-ups?

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member

mikehende Private E-2

dr.moriarty Malware Super Sleuth Staff Member