John is absolutely correct. My brother got this a couple of weeks ago and asked me for help.I found it by going into task manager and looking at all the processes. I noticed one with a very long name and noted its location and it was exactly where John said it was found. So we shut it down and rebooted, and it was back again, but with a new name. Went to its location and this time deleted the folder with the 2 executables. Deleted the folder and that solved the problem. At least my brother hasn't called me back, and he rebooted his machine a number of times to make sure that we had cleansed his laptop. One question, has anyone found anything in the registry relating to this? My brother was satisfied that his laptop was clean, so we didn't look into the registry. Murray
_____ From: John Hornbuckle [mailto:john.hornbuc...@taylor.k12.fl.us] Sent: Wednesday, September 15, 2010 12:56 PM To: NT System Admin Issues Subject: RE: #*&$&% "Security Tools" Malware >From what I've seen in digging into "Security Tools," the .exe's aren't stored in the IT temp folder. I'm finding them elsewhere under the user's profile \application data\local settings. Some random folder name. From: Roger Wright [mailto:rhw...@gmail.com] Sent: Wednesday, September 15, 2010 12:30 PM To: NT System Admin Issues Subject: Re: #*&$&% "Security Tools" Malware An occasional one manages to slip past VIPRE but they're rare. We've also found that they tend to appear after a reboot even when the user is diligent and immediately kills iexplore.exe. We set a GP to automatically delete Temp Internet Files when IE is closed - this eliminates those 123456457.exe downloads that are called from registry entries. Since doing so we've have far fewer infections. Roger Wright ___ When it's GOOD there ain't nothin' like it, and when it's BAD there ain't nothin' like it! On Wed, Sep 15, 2010 at 12:20 PM, John Hornbuckle <john.hornbuc...@taylor.k12.fl.us> wrote: The "Security Tools" malware is about to drive me insane. My users keep managing to infect themselves with it, and we're having trouble stopping it. They don't run with admin rights, so there's no real damage done to their systems and we can clean it up in about two minutes. But the time adds up, and I'm tired of my technicians having to waste time on it. Our antimalware software is Microsoft's Forefront Client Security, and it's having a tough time catching this. Every time I get infected, I send the EXE to Microsoft and they update their definitions-but the EXE's used by the malware apparently change rapidly, and seem to constantly be a step ahead of FCS's definitions. I can think of a couple of options that I know would stop it, like blocking all EXE's at our web filter or using group policy to limit the running of EXE's-but this would also prevent users from doing things like installing safe plug-ins from websites, so it's not a first resort. Suggestions? John Hornbuckle MIS Department Taylor County School District www.taylor.k12.fl.us ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin NOTICE: Florida has a broad public records law. Most written communications to or from this entity are public records that will be disclosed to the public and the media upon request. E-mail communications may be subject to public disclosure. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin NOTICE: Florida has a broad public records law. Most written communications to or from this entity are public records that will be disclosed to the public and the media upon request. E-mail communications may be subject to public disclosure. No virus found in this incoming message. Checked by AVG - www.avg.com Version: 9.0.851 / Virus Database: 271.1.1/3136 - Release Date: 09/15/10 01:34:00 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
