System Security 2009 Descriptions:
System Security, also known as System Security 2009 or System Security 4.52, is another deadly counterfeit antispyware application that developed to invade our Internet life. There’re so many variants of this malware out there now, but do not confuse System Security, which is fake softeware, to AE Software Technologies’ System Security 2009 which indeed a legit software. Presumably, System Security is a new verion of Winweb Security, with different name but same destruction. Just like most fake antispywares, System Security simulates the Windows system security alert interface, then issues misleading and exaggerated results to distract and scare the internet users.
System Security 2009 usually installed itself onto your PC without your permission, through Vundo Trojan, Virus or fake software. System Security will display fake system alerts or fake security alerts to trick user to buy the paid version of System Security, in order to remove the potential and reported problems. Not only does it cause your machine to slow down dramatically, it would also put your privacy and data in risk.
Download SpyHunter* Spyware Detection Utility.
Manual System Security Removal Instructions:
Stop System Security Processes:
(Learn how to do this)
SystemSecurity.exe
05643921.exe
install.exe
Unregister Personal Antivirus DLL Files:
(Learn how to do this)
msxmlm.dll
msxml71.dll
Find and Delete these System Security Files:
(Learn how to do this)
systemsecurity.exe
SystemSecurity.lnk
SystemSecurity on the Web.lnk
Uninstall SystemSecurity.lnk
%desktopdirectory%\system security.lnk
%desktopdirectory%\ws\config.udb
%desktopdirectory%\ws\init.udb
%desktopdirectory%\ws\languages\english.lng
%desktopdirectory%\ws\languages\german.lng
%desktopdirectory%\ws\languages\spanish.lng
%desktopdirectory%\ws\systemsecurity.exe
%programs%\system security\system security.lnk
%desktopdirectory%\ws\systemsecurity.exe
05643921.exe
install.exe
%desktopdirectory%\system security 2009.lnk
%programs%\system security\system security 2009 support.lnk
%programs%\system security\system security 2009.lnk
Remove System Security Registry Values:
(Learn how to do this)
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run systemsecurity
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009 displayicon
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009 displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009 shortcutpath
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\systemsecurity2009 uninstallstring
Download SpyHunter* Spyware Detection Utility.
whoever created this program should fucing burn in hell
There is a new problem after you rebooted the computer when system security is installed you wont be able to have access to anything such as:
Task manager
CMD
And all software
So any of those instructions you read above will not work at all.
System security has fuck my computer up and ATM i dont know how to get rid of it instead of formatting.
ALL – easiest way to do this!
Go to your C:\Documents and Settings\All Users\Application Data folder and find the subfolder labeled with an 8 digit number. Then just change the folder name. When you restart your computer, the virus is still there but it can’t find the file to boot up.
Then run any cleaner or any other antivirusprogramm who makes the rest of sheet away greetings skorpion
Greetings Stefan
do as svenny above says in safe mode and it gone
Ok, just when I didnt think things could get worse, this is the blue screen I get when trying to boot in safe mode
“A problem has been detected and windows has shut down to prevent damage.
If this is the first time you’ve seen this stop error screen restart your computer. If this screen appears again, follow these steps:
Check for viruses on your computer. Remove any newly installed hard drives or hard drive controllers. Check your hard drive to make sure it is properly configured and terminated. Run CHKDSK /F to check for hard drive corruption, and then restart your computer.
Technical information:
***STOP: 0x0000007B (0xF7B2C528, 0xC0000034, 0×00000000, 0×00000000) ”
Now what do I do? I can’t get ANYTHING to work. I was even going to reformat, but my disc doesnt run. I really need some help please!!
Mr_Party21@yahoo.com
Thank you
I just wanted to say thank you from the bottom of my heart your instructions worked perfectly. Once again thank you thank you thank you. smooches
Okay I had this virus…and it sucks!
I tried everything…but nothing worked because it disabled everything. The only thing that worked was Restarting my computer in safe mode (press F8 while starting up) and restoring my computer to a later date. It’s like it never even came! I’m so happy that it’s gone, and I love being able to use my computer again!
I had the same problem as RachelB. I got around it by going into Safe Mode. So, to get into safe mode:
1. Reboot the computer and watch carefully.
2. When the manufacture’s screen comes up hold down the F8 key (top row of keys on the keyboard) until the computer starts beeping.
3. Release the F8 key and wait for a screen that gives you SAFE MODE as a boot choice.
4. If SAFE MODE isn’t highlighted use your up and down arrow keys to highlight it, then press your Enter key.
5. You will then get a screen with your Windows Version(s). Choose if necessary and press your Enter key.
6. A dialog box will prompt you. Choose YES to continue in Safe Mode.
7. You will get a strange looking screen, but SAFE MODE doesn’t run the System Security files and you will be able to follow the steps Phyllon gave.
GOOD LUCK ALL!!!
hey poeple, im fuming about this stupid system security shit. Just cant get rid of it, can even open my task manager, i read almost everyone’s add and by the look phyllons advice was the most helpful, but i deleted the shortcut from my desktop. Can anyone help what to do now?? PLEAAAASE SOMEONE.
I seemed to be able to remove System Security 2009 by starting in Safe Mode and using Ad-Aware and my CA virus scan. But when I restarted the computer the screen goes to black right after the Windows XP intro screen and everything stops. It won’t start up in Safe Mode anymore either. The screen lists a bunch of files and then stops. Any ideas?
Thank you, Hunu. Briliant, simple solution that cleaned my machine from System Security.
Here is what Hunu recommended:
“By Hunu on Jul 11, 2009 | Reply
I ran into this virus/trojan today. What I did and it worked for me
- Right click on the system security icon
- Find its target folder. The folder may look like a random number.
- Inside the folder, you will see another system security icon and some other files.
- Attempt to delete will not work.
- But you can rename them. I rename them to xxxx, xxx, xx, x…and so on
- There may be other folders with different random numbers. Look under them and if they show system security icon, rename it.
- Reboot your computer
- The system security icon on desk top now loses its graphic and revert to the default windows exe type icon
- now you can remove the system security icon in desktop along with the folder(s) you had renamed the files described above.
- make sure you clean the waste folder
- Reboot the computer again.
All that did the trick for me. I can’t guarantee that it wil work for you. Seems like mileages do vary for different people here.
Good Luck.”
I have maanged to delete from search a few files and now system security 4.25 is romoved from my desktop start up but it is still on my backround screen when i search for it, it says its been recycled but its still warning me about virus?? any ideas?
Help…I accidently downloaded this, thinking it was from Microsoft IE. So, here I am, not computer savvy and seeing this rogue software taking over my system…I’m starting to panic! What do you folks recommend that’s simple? Should I try to save what I can of my files and reinstall the operating system? Or will my Micro Trend PCillin come to the rescue? Is there something I can buy to fix this? How to find a trustworthy pro?
Mike, OF 7/7/09, was a big help. His solution solved my problem and may of saved me about X days of hassles. I want to buy him a drink! THANK YOU.
Ok so i read everyone’s (pretty much) posts, I have managed to get rid of this annoying little program on a client’s computer after a whole day of mucking around,
It seems to shut down many programs just as they start when in “normal” mode. this includes
regedit, Task manager, various anti-spyware and anti-malware removers. the only way to do this is through SAFE MODE.
and so now i will give a full set of instructions for rebooting in SAFE MODE and then removing system security 2009 (VER. 4.52) on NT systems (2000, XP, and it should work on Vista as well)
1. REBOOT IN SAFE MODE.
(Hold or repetedly tap F8 During bootup/reboot BEFORE windows shows up (right after the quick wite stuff that shows up so fast you cant read it).. if it asks you what the computer should use to load files choose the default highlighted choice and start holding (or tapping) F8 again.
2. once windows boots up Go to Start > Control Panel > Add/Remove programs and uninstall System Security if you can find it… dont worry if you cant uninstall it..
3. Go to Start > Search in “My Computer” for “system security”… delete anything you find.
4. go to Start >run and type “regedit” and hit ok. then go to the following “folder”:
My Computer > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and look for a reference to an EXE file with a name made up of random numbers (mine was 14896874.exe)… write that number down and then delete that entry.
then click back at the top on “My Computer” and search for (CTRL+F or Edit > Find) that string of numbers (14896874) and delete what you find then continue search
(Find >Next or hit F3)
and delete the next one.. keep doing this until the whole registry is searched and all of that number is deleted. do this also with “system security” and “system.security” stuff you find.
5. Search in your computer (run> find files or folders) for that same set of numbers and delete anything you find.
6. delete the System Security shortcut on your dekstop if it’s still there.
7. reboot.
Jump for joy and let out a whoop!…. i find the classic gretzky “YESSS!!!!”, or the E-vil laughter MOOOUUUAHAHAHAHAHA works well for me.
i don’t think i forgot anything. Hopefully that should help you guys out.
have fun and dont drink and hard drive!
The only thing that worked for me, is to rename the virus. Restart, then delete the virus. Make sure to delete from recycle bin. Restart again. That took it off my computer. I got the virus on 7/20, and all the suggestions before didn’t work. This virus gets updated frequently I think.
Hey I had this pain in the ass virus too, but by following the instructions of Phyllon,Rhamax,Melissa,Razzell and Steve its now gone. I read their instructions moving my way down this Blog and finally beat that dam virus. I want to thank you all for your help. I didn’t think I could do it but after many hours of persistance and understanding my computer better the beast was destroyed. You guys that are helping others with this instruction are good souls. Don’t get discouraged people. Think of it as a puzzle and try all their different advice. You will not go wrong. Peace
Just run regedit, and delete its registry values. Once you have done this, you will be able to close it in process list. After it’s closed, you will be able to delete the files.
Add my msn if you still dont get it.
thnaks to all contributers. managed to get my neighbours pc disinfected (after reading this forum) by booting in safe mode and renaming the numbered .exe in the numbered folder within the APPLICATION DATA folder (all numbers seem to be random) you’ll know if you have the correct one because of the icon. after renaming start in normal mode and full control should be restored. remove the renamed file and its folder and remove the registry entry. clear the recycle bin and do a virus scan hopefully it will come up clean.
I know it won’t help but I always find myself wisihing all sorts of evils on virus compilers
I stopped the process in taskmanager and started looking for all the files and registry values but i could only find shortcuts and a folder named systemsecurity that was empty. Is this because i had stopped the process and it cleaned out most of the temporary files?
I thank “john” for this. He gave me the steps that I was actually able to do without the virus getting in the way. Thank you so much. You’re a life saver to me.
ok i cannot restore bc mine does not have a restore to an earlier time option and the file has itself blocked where i cannot simply delete it. have tried to download other helps but they require money and whenever i do download something the virus blocks me from using it. cant get task manager up and i cannot delete manually cause the virus says i do not have permission to delete it. please help. my computer is a dell with windows vista 2006 i beleive so please help me!!
f*** them mother F******** thay mess up my pc i kill them
rhamax where are you finding the run in save mode
I go to safe mode,I see start and click it but after that there’s no run to type anything. Im not too good at computer, so can you go back over this again very slow for us dummys like me
thanks.
My computer wont even go into safe mode i tried to press f8 and hold it but i cant get the safe mode screen up, any suggestions?
Scratch that! I GOT RID OF IT!!!his is how I got rid of it. I used Frances’ step of restarting my computer and getting the Task Manager open as it boots up. If you get Task Manager open, Click on the the Processes Tab and quickly find an “exe†program that’s all numbers…. ie 50147287.exe …stop this file form running immediately…. Once I stopped it from running I was able to completed a system restore. Start/All Programs/Accessories/System Tools/System Restore. Complete the restore back to a point time before your machine became infected. I determined this by right clicking on the System Security icon and I found a date and time that the progam was modified/installed. With that I set my restore date for just before that date and time. You will lose anything that has been saved since that point in time, but if you’re like me, I couldn’t do anything on my machine since that f*^@#ing program got on there anyway.
Once you get your machine back, go to your Start button and complete a Search for System Security. It did find two folders, no programs though. I deleted these two programs and then emptied the Rcycle Bin.
Hopefully this works for you
ok I did a search for everything under system security and I get a list of lies and folders. none of them are numbers though. i’ve already stopped the process, did a system restore and ran norton anitvirus so…are those files even associated with this stupid virus?
oh the files also says they were created back in feb so is it likely they’re not related?
I am assisting my friend with removing the virus from XP Pro. It disabled everything accept IE, including taskmgr.exe…
The easiest way to take care of the problem is to Reinstall the OS, or use a Factory Restore Disk.
If you are using the guide printed above, it is easiest to carry out the process in safe mode {Press F8 at the brand’s splash screen} you Will not have to kill the processes. you will be able to just start searching and deleting the files…
DO NOT START BY DELETING THE REGISTRY ENTRIES, UNLESS YOU ARE AN ADVANCE USER!!!
just go to the rightmost top option of the security centre …..i dont remember it clearly ,it was subscribe or something starting with S alphabet.scroll it down it gives the way to uninstall it.however if that doesnt work a link is given below that method of uninstalling.surf to that link and run the remover programme that appears automatically on your screen and CHEERS ,your security centre has been successfully removed.
my pc keeps restarting ever since i removed system security going nuts pleasee help
Still trying to get this stupid thing off my computer. Managed to degrade it so I at least don’t get the fake virus alerts and can open taskmanager, but it still has disabled my antivirus software and slowed the machine to the point of being useless. Pulled all the icons and executable folders into my recylce bin and tried to delete them, but it has the recycle bin locked up now so I can’t open it. This happens in safe mode as well. Any commands to clear the recycle bin lock up the machine. I’m convinced these guys are reading this blog and updating to defeat any techniques people come up with to remove it.
I am trying to remove this System Security 2009 program and there are so many instructions out there and none of them work. I can’t access the internet, or start in a safe mode. Can someone please send me simple instructions for how to remove this from my PC. I have above average computer knowledge but I am confused by all the different answers to this. I need my PC to look for jobs as I am un-employed and I can’t pay someone to fix it.
for a co-workers comp
windows media center edition
i too was unable to get any program to start, takmgr, msconfig, regedit, i couldnt even get command prompt… i tried a couple of times to go into safe mode… it would error at mup.sys i think and restart… it just wasnt happening… luckily i restarted and it kinda locked up, i continually press ctrl alt delete and eventually the taskmanager came up. the virus was not running… idk how… i do have avg running so… anyway…(now that i think about it, the wireless switch was off position, i turned to the on state and then that happened… hope that helps) i remembered seeing total security in the programs folder on the start menu… i was able to get a command prompt up… heres how… if you can get to the task manager as i did by pure luck i think… click file at the top then hold ctrl down and click new task(run) you will get a command prompt… now type at the command prompt: type C:\”Documents and Settings”\YOURUSERNAMEGOESHERE\”Start Menu”\Programs\”Total Security”\”Total Security 2009.lnk”
that should give you some code and a directory to where the executible is launching from. mine was in: C:\Documents and Settings\All Users\Application Data\19225934\
now type at the command prompt: rmdir “the directory you found in the code from the step above” /S /Q
that will remove the directory and the executable, i then typed at the command prompt: regedit and searched(edit Find) for Total as in Total Security i found one listing and right click on the folder and hit delete… it also brought me straight to SystemSecurity2009 Folder(why im here as they continually seem to be changing the name), i right clicked that guy and hit delete as it referenced the all users directory too to the horrible executable.
unknown critcal step(probably a good idea though)
then at the command prompt type: del c:\”Documents and settings”\”YOURUSERNAMEGOESHERE”\Start Meny\Programs\”TotalSecurity”
then type: c:\Windows\pchealth\helpctr\binaries\msconfig.exe
go to the startup tab i found 19225934 and unchecked it.
also found metefovu and unchecked that
and kupageli and 18675934
i will later search the registry and my directory for these filename above and try and remove if found in the same manner as we did with 19225934.exe i would suggest you do the same.
of course after i uncheck those above megefovu and kupageli were back as another instance… i wasnt getting the warning background nore the popups but the task tray is still locked… and it still restarted if i tried to boot into safe mode…
i then opened the command prompt as before and did a system restore to the earliest time possible…
PROBLEM SOVLED!!!
and them did all the system updates/antivirus updates that everyone seems to fail to do… duh…
guess it would help as to how i accessed the system restore from the command prompt…
type: cd c:\windows\system32\restore\ press enter
then type: rstrui.exe press enter…
voila…
After hours of work, my friend and I found a simple way to disable and remove System Security 2009. Our “strain” of the virus would not let us open Task Manager, Regedit, or Msconfig, which pretty much eliminates most instructions on the web, as they say “just go into Task Manager and end the process.”
That’s great, but what if you can’t open Task Manager. While you can in Safe Mode, the System Security isn’t running, of course, and we couldn’t track down the files.
Here’s what you do:
1) Get into Safe Mode (reboot and tap F8 until boot instructions come up, choose Safe Mode).
2) Click Start > Run > type “msconfig” > hit enter.
3) Choose the “Startup” tab
4) Disable (uncheck) all non-Windows Programs. 5) You can read up about this, but most are okay to uncheck. There’s sometimes an option to not display Windows necessary tasks, leaving the rest for unchecking. There should be a few suspicious looking ones with random letters or numbers (Especially ones that have HKEY in the beginning of their root path). If unsure, uncheck them all except for ones that look like legit Windows programs
6) This SHOULD stop System Security 2009 from running when you reboot to your regular user.
Phase 2:
1) Hit Start > Run > type “regedit” > ctrl-F to search > type “systemsecurity2009″ or “systemsecurity”
2) You should come up with a list of infected Registry Keys. Note where the FILES are kept, not the Keys (to the right of the column “command”
3) Navigate to these folders in Windows Explorer and delete the all important .exe files.
4) Continue to eradicate the files as you find them. Some will be random names/numbers.
Hope this helps someone!
Here is how to make the pop up go away, without clicking on “no, or yes, or x’ing out the box”, all of which activate this nasty thing.
Very simply, when the security systems warning box appears on your screen, quickly use the keyboard command to close all open windows.
This commmand is ALT + F4
If you do this quick enough, it will close out the first pop up window…the one that “warns you of a virus infection”.
If you continue to hit ALT/F4, (even if that window that looks like its scanning your computer pops up) your windows will begin to close, one by one.
If you have several tabs open, and you hit ALT/F4, and the box that says “do you want to close all tabs?” pops up, you must use your mouse to click on YES, and that series of tabs, and window will close.
Sometimes the yellow security bar will pop up, (depending on what webpage you happen to be on when this thing pops up on you) and again, you will have to use your mouse to close out the warning box, and then the yellow bar, and then use ALT/F4 to close that window.
AS LONG AS YOU DO NOT CLICK ON ANY PART OF THE SECURITY SYSTEMS POP UP WINDOW..NO, YES, OR X IN THE UPPER RIGHT HAND CORNER, WHILE YOU ARE CLOSING OUT YOUR WINDOWS, YOU WILL BE ABLE TO MAKE IT GO AWAY.
Use your common sense when any obstacles keep the windows from closing, as I described above, when you use your mouse to close all tabs, or close the yellow warning bar, etc.
Now, I want you to know, that I am unsure if we are infected with something that makes this Security Systems warning box pop up on us, or if it is just an attempt to infect us, while we are surfing the net, or are on certain websites.
In my case, this thing pops up about once a month, and it doesnt seem to matter what website I am on, or where I am surfing too.
My computer runs fine, it is very fast, all programs and functions on my computer work correctly and with speed, so I am inclined to think that I am not infected with this thing….only that it tries to get in from different locations on the web.
Using this method of closing out the window with alt/f4 keeps me from catching this nasty, funky thing.
That was not the case with a previous XP computer I had. I was on a webpage, the warning box popped up, It looked so much like a windows warning that I clicked on Yes, to run the scan, and I was infected. I even bought the offered software that claims to remove it, but of course, it does not, and not only did they get me for the 30 bucks, or whatever it was, for the fakie removal tool, that computer in a matter of days had all of the windows commands deleted, all the exe files snuffed out, and eventually wouldnt even turn on, and finally fried out.
It was then that I researched and found this little maneuever to close it out before it infects.
AND LET ME SAY THIS. NOTHING, AND I MEAN NO PROGRAM OUT THERE, AS OF YET, WILL PROTECT OR REMOVE THIS THING AFTER YOU ACTIVATED IT.
I DONT CARE IF YOU DOWNLOAD MALWARE, OR SPYWARE, OR NORTON, OR A HUNDRED OF THESE RECCOMENDED PROGRAMS THAT CLAIM, OR THEIR USERS CLAIM WILL REMOVE IT.
THEY DO NOT.
Norton, (I use norton) for a fee, will scan your system, locate the exe files for the security systems virus, and remove it. (The say..I have not had to use their services thank god, to remove it)
So, all I wanted to say here was, you have TO PREVENT IT.
And the only way to do that, is what I have described above.
I know that this does not help you good people who are already infected, and who are crying out for help. I was one of you, and I wish I could help you.
All I can do is tell you how to prevent it the next time the first, warning, “you have a virus” window pops up.
Razz
Help!!!!!!!!!!!!!!!!I emailed these people and actually got a reply. But, can’t seem to get it out of my “C” drive.
I am glad to have been able to help so many. I’m not a guru, or a computer god. I just worked at it until I figured it out. Many people figure things out all the time, but once their problem is over, it’s over. My difference is I came back and shared what I learned. That’s all.
Maybe I can help with other problems. If so you can try me at barriebuddy AT sympatico DOT ca.
Thanks,