Home Malware Programs Rogue Anti-Spyware Programs Personal Pro System

Personal Pro System

Posted: August 9, 2011

Personal Pro System is a recent clone of rogue anti-virus programs from the System Tool family, which are easily-identified by their unusual pink interface and proclivity towards creating specific types of fake error messages. You will not find out most of the above from Personal Pro System, however, which tries to sell itself and steal your credit card information by pretending to be a real anti-virus program. Along with failing to provide genuine anti-virus features, Personal Pro System may attempt to block your real security programs or hijack your web browser to redirect it towards the Personal Pro System website. You should combat all of these attacks by removing Personal Pro System itself, which can easily be done with the right anti-malware product.

Personal Pro System's Not-So-Professional Means of Ingress into Your PC

Rogue anti-virus programs like Personal Pro System are distributed by various types of Trojans and browser exploits; SpywareRemove.com malware researchers have found that most such Trojans are variants of Zlob or Fake Microsoft Security Essentials Alert. These Trojans may install Personal Pro System without permission or use fake infection warnings to persuade you to install Personal Pro System of your own free will. Both Zlob and Fake Microsoft Security Essentials Alert Trojans have been known to pretend to be fake codec updates, browser patches and other forms of software updates.
 
Some similar rogue anti-virus programs from the System Tool family that may be installed in the same fashion as Personal Pro System include Security Tool, System Security, System Tool 2.20, System Tool 2011, Personal Shield Pro, and MS Removal Tool.
 
In addition to using Trojans, Personal Pro System may be installed by browser exploits that are hosted via fraudulent websites or malicious advertisements. To protect yourself from such typical Personal Pro System installation attacks, SpywareRemove.com malware experts recommend avoiding the use of any suspicious or unusual online scanners, as well as disabling Flash and JavaScript for websites where they're not required.

Why Personal Pro System is the Cause of Your Malware Troubles Instead of the Solution?

The only anti-virus features that Personal Pro System can provide are fake warnings and false positives, including inaccurate system scans, bad pop-up alerts and a changed desktop that are all used to make you think that your PC is heavily-infected. However, combing over Personal Pro System hasn't led SpywareRemove.com malware researchers to believe that Personal Pro System has even the slightest hint of real virus-detection or removal features.
 
Displayed here are some of Personal Pro System's most prominent error messages, which appear without regard to your computer's actual state of infection or lack thereof:
 
Your PC is infected with dangerous viruses. Activate antivirus protection to prevent data loss and avoid the theft of your credit card details.
Click here to activate protection.

 
Intercepting programs that may compromise your private and harm your system have been detected on your PC.
Click here to remove them immediately with System Tool.

 
Warning!
Application cannot be executed. The file [random file] is infected.
Please activate your antivirus software.

 
Warning: Your computer is infected
Windows has detected spyware infection!
Click this message to install the last update of Windows security software...

 
Personal Pro System may also try to block your real anti-malware programs or hijack your browser to prevent the display of anti-malware websites. Both of these problems can be avoided by sidestepping Personal Pro System's Registry startup routine, which can be done with Safe Mode or, at worst, by booting from a portable hard drive.
 
Removing Personal Pro System with a suitable security program will undo all attendant problems, although deleting Personal Pro System files manually isn't recommended, since your Registry and other system components will remain infected. In no case should you waste money on purchasing Personal Pro System, since this creates a strong possibility of excessive and multiple fraudulent charges by the criminals who are responsible for Personal Pro System's existence.

Aliases

PersonalProSystem

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



Uninstall Personal Pro System.lnk File name: Uninstall Personal Pro System.lnk
File type: Shortcut
Mime Type: unknown/lnk
Personal Pro System.lnk File name: Personal Pro System.lnk
File type: Shortcut
Mime Type: unknown/lnk

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%Documents and Settings%\[CurrentUser]\Local Settings\Application Data\[RANDOM CHARACTERS].exe" -a "%Program Files%\Internet Explorer\iexplore.exe"'HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation "TLDUpdates" = '1'HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = '"%Documents and Settings%\[CurrentUser]\Local Settings\Application Data\[RANDOM CHARACTERS].exe" -a "%1" %*'HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%Documents and Settings%\[CurrentUser]\Local Settings\Application Data\[RANDOM CHARACTERS].exe" -a "%1" %*'HKEY_CURRENT_USER\Software\[random]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = '1?'HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"C:\Documents and Settings\[CurrentUser]\Local Settings\Application Data\[RANDOM CHARACTERS].exe" -a "%1" %*'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = '1'HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%LocalAppData%\kdn.exe" -a "%Program Files%\Mozilla Firefox\firefox.exe" -safe-mode'

One Comment

  • e1k6232.sys bsod says:

    I hope you can help me. We use Spybot alot, but we just recently got something called Security Tool Warning and we cannot run spybot on it. It has over taken. Can you help

Loading...