Menu Close

System Protection Tools- Fake rogue anti-spyware that mimics Microsoft Security Essentials

The following is copied from http://www.bleepingcomputer.com/virus-removal/remove-system-protection-tools 05-23-2012

System Protection Tools is a rogue anti-spyware program from the Rogue.FakeVimes family. This infection is promoted through web sites that show advertisements that pretend to be online anti-malware scanners. These scanners will then pretend to scan your computer, and when finished, will state that your computer is infected and that you need to download and install System Protection Tools to protect yourself. The truth is that these online scanners are all fake and are only an advertisement. They have no way of knowing what is running on your computer.

 

 

System Protection Tool screen shot
System Protection Tool screen shot
For more screen shots of this infection click on the image above.
There are a total of 4 images you can view.

 

 

Once System Protection Tools is installed on your computer it will be configured to start automatically. It will also create numerous files that will be detected by the program as malware. Some of the files that are created are:

%UserProfile%\Recent\ANTIGEN.exe
%UserProfile%\Recent\cid.exe
%UserProfile%\Recent\ddv.tmp
%UserProfile%\Recent\eb.drv
%UserProfile%\Recent\eb.exe
%UserProfile%\Recent\exec.sys
%UserProfile%\Recent\fan.tmp
%UserProfile%\Recent\fix.sys
%UserProfile%\Recent\hymt.drv
%UserProfile%\Recent\hymt.sys
%UserProfile%\Recent\kernel32.drv
%UserProfile%\Recent\kernel32.exe
%UserProfile%\Recent\kernel32.tmp
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\runddlkey.exe
%UserProfile%\Recent\SICKBOY.exe
%UserProfile%\Recent\SICKBOY.tmp
%UserProfile%\Recent\tempdoc.exe

When the program scans your computer it will detect the files it created and state that they are infections. It will then prompt you to remove the files, but will not allow you to do so until you first purchase the program. This is a scam as the files are all harmless and are created by the System Protection Tools program in the first place. Therefore, please ignore any of the scan results this program displays.

While System Protection Tools is running it will also display fake security warnings that are designed to make you think that your computer has a severe computer security problem. The text of some of the alerts you will see are:

System Alert
System Protection Tools has detected pontentially harmful software in your system. It is strongly recommended that you register System Protection Tools to remove all found threats immediately.

System Alert
malicious applications, which may contain Trojans, were found on your computer and are to be removed immediately. Click here to remove these potentially harmful items using System Protection Tools.

Warning! Virus detected
Threat Detected: Trojan-Spy.HTML.Bankfraud.IX

As all of these security alerts are false, they should be ignored.

As you can see, System Protection Tools was created to scare you into thinking your computer was severely infected so that you would then purchase it. It goes without saying that you should definitely not purchase this program, and if you already have, please contact your credit card company and dispute the charge.