A client of mine called me in a panic yesterday because a laptop he uses for work got infected with the Personal Security virus. Personal Security is a nasty virus, also sometimes called antispyware or malware, that takes over your computer and attempts to get you to purchase the software. The virus actually makes the end user think that it is legit software and they are only doing you a favor by protecting your computer however this is not the case. Below I describe things that the virus will do to blend in to Windows as well as a method I have discovered as one of the easier ways to remove it.

Personal Security Virus: How It Infects Windows Computers

So there are many things that Personal Security will do not only to make it seem like legit software but also things it will do to block users from removing it. I list some of these below however I am sure there are many others ways that it infects peoples computers so if you know of other ways that this has infected your computer other than the ones I list below please leave those in the comments section of this post. The more information we can share to users about this virus the better so more people can learn what to watch out for.

• Service Taskbar Display: One thing that Personal Security does is it will display a taskbar icon to make you think that it is something that should be running. The image below shows what the icon looks like along with what is displayed when you hover the icon in the taskbar.

  

• Program Display: Personal Security will display in Windows Control Panel “Add/Remove Programs” as a program that has been installed as displayed below.

  

  However if you attempt to remove the application from via the Add/Remove Programs configuration window it only will display an activation window as displayed below. Again this is an attempt to get users to not only by the application but also to steal their identities.

  

• Display Fake Virus Scan Results: The Personal Security virus is clever in the way that it displays fake virus scan results as displayed below so Windows users think their computers are infected with other viruses, trojans, spyware, or malware. While users may have other viruses or spyware the real issue at hand is the Personal Security virus.

  

• Blocks Applications: When Personal Security has infected your computer and is active you will more than likely not be allowed to launch other applications.
• Blocks Windows Task Manager: The Personal Security virus will also block many Windows functions such as Windows Task Manager. If you attempt to launch Task manager nothing will happen.
• Displays Blank Desktop: Personal Security will also display a different Desktop which is another attempt at blocking access to other applications. Don’t worry when the Personal Security virus is removed all of your desktop shortcuts and files will be returned to normal.

Removing Personal Security can be a real pain if you don’t already have some form of Virus, Antispyware, or AntiMalware software installed. The easiest way I have found to remove the software is with Windows Defender however you have to stop the Personal Security process before you can actually launch Windows Defender so follow the directions below to stop the Personal Security process, download Windows Defender, and then scan your computer using Windows Defender.

Stop The Personal Security Virus Process & Remove The Personal Security Virus:

1. Reboot Computer: First you will want to reboot your computer but before you do so make sure to read the rest of this step. When your computer reboots you are going to have quickly launch Windows Task Manager and manually kill the personal security process. I explain each step of what needs to happen after you reboot below but make sure to launch Windows Task Manager as quickly as possible or Personal Security will block access to it.
2. Launch Windows Task Manager: Right when you have access to your desktop launch Windows Task Manager by clicking the Start button in the lower left hand corner of your screen. Type “taskmgr” into the Run box and click enter which should launch the Windows Task Manager display window.
3. Stop Personal Security Process: Once Task Manager is displaying click the Processes tab and then click Image Name in the column title bar. This will organize the processes in alphabetical order. Scroll through the list and look for “psecurity.exe” which is the Personal Security process. An example of what the process will look like in Windows Task Manager is below.

   

   Once you have located psecurity.exe highlight the process by clicking on it and then click the “End Process” button located in the lower right hand corner. This will stop Personal Security from running on your computer.

4. Install Windows Defender: Now visit this Microsoft site to download Windows Defender. First download Windows Defender, then double click on the downloaded file, and follow the instructions to install Windows Defender.
5. Launch & Scan With Windows Defender: If Windows Defender does not launch automatically after install go ahead and launch it now using the Windows Start Menu. First update the definitions file and then run a scan oon your computer.
6. Remove Personal Security Virus: Wait until the Windows Defender scan is completed before taking any action. Once the scan is completed it will have found at least the Personal Security virus which typically shows up as two different viruses named Trojan:Win32/FakeXPA and Trojan:Win32/Yektel.A both of which are displayed in the Windows Defender image below. To remove these viruses click the Windows Defender “Remove All” button located to the right of the scan results. Be patient because it can take quite awhile to completely remove both trojans.

   

   If you want more details relating to the Personal Security trojans that were found click the “Review Items Detected By Scanning” below the Remove All button as displayed below.

   

7. Reboot Computer: Once Windows Defender is done removing the Personal Security trojans reboot your computer to make sure it is gone.

Hopefully you don’t run into the Personal Security virus again but if you do it shouldn’t be to bad to remove now that Windows Defender is running. I suggest keeping Windows Defender active at all times which would have saved you from getting the Personal Security virus at all.

Windows 7

William R. Stanek. O’Reilly Media 2009, Paperback, 992 pages, $33.65

Malware Forensics

Cameron H. Malin. Syngress 2008, Paperback, 592 pages, $53.99

This entry was posted on Friday, January 15th, 2010 at 4:40 PM and is filed under Insights. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.