Security System Virus Manual Removal

The System Security virus is a rogue anti-virus program derived from the Winweb malware program. The virus infects your computer primarily through the use of a fake online computer virus scanner that attempts to trick you into installing the malware after conducting an anti-virus scan of your computer. The scan displays a fake infection result to trick you into downloading the software. Once the virus infects your computer, it significantly slows the speed of your system, blocks your ability to run well-known anti-virus programs and displays a number of fake infection messages.

Stop the System Security Process

System Security is particularly nasty because the malware prevents you from stopping the computer virus's process and running anti-virus software to remove it. To manually remove System Security, you need to stop the virus program from running so you can delete it. To do this, download the Window's Process Explorer program (see Resources). After you download the program, right-click procexp.exe, the file you downloaded, and rename it to explorer.exe. Double-click the file icon and run the program. Find a process on the "Process Explorer" menu that starts with eight or more random numbers followed by the .exe file extension; you should see an icon of a shield beside this process. Select the process, click the red "X" button to kill the process and click the "Yes" button to confirm. This will stop the virus process from running on your computer.

Delete System Security Files

After you have stopped the System Security virus process from running on your computer, you will be able to delete the malware files. Open your computer's file explorer by pressing the Windows and E keys simultaneously. Open the following directory on your computer: %UserProfile%c:\Documents and Settings\All Users\Application Data\. Look for a folder comprised of six or more random numbers in the Application Data folder. Once you have found this folder, delete all files contained in the folder. In this folder, you should find an executable file that has six or more random numbers, which is the executable program for the virus. Note the numbers that comprise the executable file's name.

Delete System Security Registry Entries

The final procedure in removing the System Security virus from your computer manually is to delete the entries the virus made in your computer's registry. Open your computer's registry editor by selecting "Run" from the "Start" menu, type "command" (without the quotations) and press Enter. Input "regedit" (without the quotations) at the DOS prompt and press Enter. Select "Edit" followed by "Search" and input the random numbers that make up the executable file name of the virus. Select any registry entries returned and delete them. Restart your computer normally, and the virus will be removed.

References

• How Does SmitFraudFix Work
• Rogue Antivirus Programs, System Security
• How to Remove System Security

Resources

• Process Explorer Download Link
• SmitFraudFix Download Site
• MalwareBytes Antivirus Home Page