Your computer is infected with malicious software? Do you have pop-ups on your PC?
If so, search this blog for removal instructions or browse computer threats by category.

Friday, November 4, 2011

How to Remove System Security 2012 (Uninstall Guide)

Tell your friends:
System Security 2012 is a phony anti-virus program, anyone following the internet security space has no doubt recognized this fraud. The tactic is common. Trojan masquerades as antivirus software, detects a bunch of critical infections, system vulnerabilities or zero-day attacks to scare you into believing that your computer has been infected with malicious code. Growing complaints from Windows users raised awareness of scareware, but unfortunately System Security 2012 and similar malware outbreak continues. Rogue antivirus products use social engineering to gain access to the system. For example, this rogue AV may masquerade as a custom flash player update package (we found it on a fake youtube web page). Web drive-by attacks are a subset of this attack vector when simply visiting an infected website is enough to trigger web browser vulnerabilities and as a result allow malicious code to be executed.

Vulnerabilities can be patched, but the problem is that users can be tricked into installing malware on their machines. It is always a good idea to to do some research on unknown software before you start the installation process. I bet you won't find a single positive review about System Security 2012. If you feel you were deceived when you installed a program you need to uninstall it as soon as you can. The best way to remove System Security 2012 is to scan your computer with at least one, and ideally a few, anti-malware products. We don't recommend uninstalling this fake antivirus manually, because very often it comes bundled with rootkits. Rootkit is a very sophisticated piece of malicious code that injects system files, blocks legitimate security products and downloads additional malware onto the infected computer. You can't remove rootkits manually. To remove System Security 2012 and associated malware from your computer, please follow the removal instructions below.

Last, but not least, System Security 2012 has been regarded and low system security threat. It can't delete your files, steal login credentials, credit card numbers, etc. It may however, slow down your computer a little. Just don't purchase this bogus security products. If you already did, please contact your credit card company and dispute the charges. Good luck and be safe online!

Here's what the rogue antivirus called System Security 2012 looks like.



A couple of fake security alerts you may see when this rogue antivirus is active.





By far the most easiest way to get rid of System Security 2012 is to use the debugged activation code 9992665263 and run anti-malware software.

http://deletemalware.blogspot.com


System Security 2012 removal instructions:

1. First of all, download and run ZeroAccess/Sirefef/MAX++ removal tool. (works on 32-bit systems only! If you have 64-bit system, proceed to the next step)

2. Then use TDSSKiller.

3. And finally, download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

If you can't download it, please reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Open Internet Explorer and download STOPzilla. Once finished, go back into Normal Mode and run it. That's It!

Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.


Manual System Security 2012 removal guide:

1. Right-click on System Security 2012 icon and select Properties. Then select Shortcut tab.

The location of the malware is in the Target box.

2. In our case the malicious file was located in C:\Windows\System32 folder. Select the malicious file, rename it and change a file name extension.

Original file: TcS22bF3nGaQWKf.exe



Renamed file: TcS22bF3nGaQWKf.vir



3. Restart your computer. After a reboot, download free anti-malware software from the list below and run a full system scan.

4. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

5. Remove the TDSS/ZeroAccess rootkit (if exists). Please follow this removal guide: http://deletemalware.blogspot.com/2010/03/tdss-alureon-tidserv-tdl3-removal.html


Manual activation and System Security 2012 removal:

1. Choose to remove threats and manually activate the rogue program. Enter one of the following codes to activate System Security 2012.

9992665263
1148762586
1171249582
1186796371
1196121858
1225242171
1354156739
1579859198
1789847197

2. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

3. Remove the TDSS/ZeroAccess rootkit (if exists). Please follow this removal guide: http://deletemalware.blogspot.com/2010/03/tdss-alureon-tidserv-tdl3-removal.html


Associated System Security 2012 files and registry values:

Files:
  • C:\WINDOWS\system32\[SET OF RANDOM CHARACTERS].exe
  • %AppData%\hkRdkTdkFrGrPhT\System Security 2012.ico
  • %AppData%\ldr.ini
  • %DesktopDir%\System Security 2012.lnk
  • %Programs%\System Security 2012\System Security 2012.lnk
  • %Programs%\System Security 2012
Registry values:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
Share this information with your friends:

19 comments:

BOB said...

very helpful! thanks!

Anonymous said...

Thanks. This one is sneaky >:o

Anonymous said...

quick question:
The system Security virus has blocked internet access even when I am in safe mode with networking. am I missing something?

Admin said...

Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab.
Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.

I hope this helps. Good luck!

Anonymous said...

HOW DO I DO THIS IF IT WONT LET ME OPEN FIREFOX AND DOWNLOAD THIS> (THIS IS A DIFFERENT COMPUTER) AND I CANT MOVE THE EXE TO A FLASH DRIVE

Anonymous said...

I'm rather curious how I even got this... haven't downloaded anything for a good month or two, just randomly showed up.

Anonymous said...

What if I have a 64 bit system and cannot run the first step: 1. First of all, download and run ZeroAccess/Sirefef/MAX++ removal tool. (works on 32-bit systems only!)

Anonymous said...

it wont let me change the exe at all. what can i do?

Admin said...

Go to step #2 and use TDSSKiller. The first step is optional. Both tools are designed to remove pretty much the same rootkits. So, if you have 64-bit system, just skip step #1.

Admin said...

Q: it wont let me change the exe at all. what can i do?

A: renaming .exe is an optional step. Just run recommended anti-malware software a couple of times if it doesn't start right away. It should stop the malicious process and start installation.

Anonymous said...

What a piece of crap this thing is! I just manually asked my McAfee to shred the file and it seems to have worked.. do you guys think it actually did?

Anonymous said...

It works! Many thanks for your help!

Anonymous said...

Why does McAfee want to block both downloads?

Anonymous said...

Help. I have this problem with my laptop. Good thing i have a desk top too. I went in safe mode and into dos (I do know dos commands). I do not have the file TcS22bF3nGaQWKf.exe at all. Is there possibly another file name????

Anonymous said...

I put in the debugged code 9992665263 and it just disappeared...now I'm running the an anti-malware full system scan and so far so good. No sign of the virus anymore! Thanks the code was the easiest by far =)

Anonymous said...

My laptop would not let me go past this virus so I used the debugged code & a my computer immediately started running correctly again! I was super stressed as I was in the middle of making a video for a memorial. Thank you so much!!

Anonymous said...

im not sure where i put in the debugg code

Anonymous said...

I THOUGHT I removed the virus with Avast in safemode....but my files and programs are STILL gone..?
System restore still does not work. How do I fix this ?

hilda dada said...

Good ideas! I like the way you express your idea and the topic you choose. KEep on your sharing! I appreciate it. colorado security systems