What is Antivirus2009?
Antivirus2009 (Antivirus 2009) is a fake anti-spyware program, an exact copy of AntiVirus 2008, and family of System Antivirus 2008, Vista Antivirus 2008 and XP Antivirus 2008 (to mention a few).
You might have been infected by Antivirus2009 through a fake video codec download bundled with Trojan Zlob. Once Antivirus2009 leaps into your computer system, it will bombard you with popups and fake system alerts that inform you about supposed spyware infections. These alerts are prompted by Antivirus2009 itself to trick you into buying a fake spyware remover software. Antivirus2009's messages may read:
"Virus Protection
Windows Security Center reports that 'Antivirus 2009' is unable. Antivirus software helps to protect your computer against viruses and other security threats. Click Recommendations for the suggested actions. Your system might be at a risk now.
Note: Windows detect unregistered version of 'Antivirus 2009'
Click here to get Antivirus 2009 License"
If you decide to click on this message to buy the supposed "licensed" version of Antivirus2009, you'll be immediately redirected to Antivirus2009's website to spend your money on a product that doesn't "clean" your computer, but instead, steal your money. Antivirus2009 is a scam and it's messages are all fake.
Antivirus2009 is also known to additionally install a Browser Helper Object (BHO), which generates more fake messages while using your Internet Explorer. Antivirus2009 has managed to add a message on Google's homepage stating that it has detected your system to be infected! Antivirus2009 has won our standing ovation among the latest fake programs on the market.
100% FREE spyware scan andtested removal of Antivirus2009*
thanks
Oh great I got this downloading windows updates for s service pack three (SP3)..is this a real service pack
or a scam that spreads this ???
After 3 hours of trying to remove av2009 I finally was able to do it by using task master. First close all running programs and shut down your computer.
Restart it as usual. Then hold down your Ctr,l ALt and Del keys together,,,the task master box will open up. Click on the tab at the top labeled Processing. Only the Antivirus program AV2009 should by running and should show up.
Highlight it and Click on the END process. This worked for me and even removed the icon.
Restarting my computer, AV2009 showed up in my program files again,,,but I was able to remove it by clicking on it and hitting delete. This didn't work before,,,,said it was protected.
UPDATE: AV2009 is very tricky. I thought I had deleted it but today it was back. The original files are hidden but still operating on my computer. It shuts down my computer after repeatedly trying to get me to purchase the AV2009 program.
It shows a google message to buy AV2009,,not real,,,even Google is not safe.
I did a free scan,,,now I know the files and some of the locations,,but when I tried to delete them,,,they magically reappeared.
If I can't figure it out soon, I'm going to purchase SpyHunter,,,any other suggestions would be appreciated.
thankx for this very helpfull knowledge
thank you very much
I've got this crap but my system is so bad I cannot download anything to get rid of it because I can only bring my computer up in safemode. Any ideas?? Anybody??? If I bring the system up in regular mode it functions for about 3-4 minutes and crashes. Am on Vista.
AntiVirus 2009 is proving to be very annoying and law inforcement agencies are dealing with the author of this \'scam\'. If you have this installed on your computer, it s very very hard, if not impossible to remove if you do not know exactly what your doing. The only true way of knowing that this has been fully removed from your system is to do a complete fresh install of Windows.
Bring your computer up in safemode with networking and then you can either remove this manually or use the removal tool. Dave
Thanks PARICIA!....but now when i go into add/remove programs and try to uninstall all it says is "You already have antipro 2009 installed!" yes i know that lol im trying to delete it:@! driving me crazy!
This antivirus is a bunch of bulllllllllll! I just got my computor and its already infected with it. Someone told me that i would have to wipe my hard drive reinstall windows and use a program called zone alarm does anyone know if this is true. I would like to handle this without wipping my hard drive please let me know.
ok it seems form my research that the programs modifies the svchost files or some other files that deppends on it
It also changes some or one of the DNS cach files so that trendmicro.com points to the local maching
If i can figure out this DNS file and something to do with the DNS resolver then maybe i can stab it in the neck.
Deleting Temp IE files in hidden Local settings helps free you up
k it seems form my research that the programs modifies the svchost files or some other files that deppends on it
It also changes some or one of the DNS cach files so that trendmicro.com points to the local maching
If i can figure out this DNS file and something to do with the DNS resolver then maybe i can stab it in the neck.
Deleting Temp IE files in hidden Local settings helps free you up
A friend downloaded Antivirus 360 on my computer.i have many bugs now & im unable to uninstall it/How to get rid of this???I have CyberDenfender ,which is doign fine.Janet
Wow, what a job to get rid of MSantispyware2009! I got this malware program doing research for a presentation I have coming up. The web site tricked me into loading it by telling me I needed to download a program to watch a video I wanted some information from. I started getting pop ups that looked like official Microsoft data and my explorer tryed to take me to the MS antispyware 2009 website constantly.
The 1st thing I did was find some htm files and some exe files in my hidden temporary internet files that matched some of the names of the popup's I was getting and delete them, then I went into msconfig and unchecked any suspicious looking items in my start menu, I restarted my cpu and this got rid of about 80% of the popup's. Next I went into add and remove programs and found 2 programs from crucialsoft and uninstalled them, MSas 2009, and 1stprice?, not sure of the name, but it had a bogus phone number 555-555-1234 under contact info and the url listed for support took me to the antispyware 2009 web site.
Next I downloaded and ran an updated version of my antivirus program and ran it, this got rid of some of the infected files,next I downloaded an upgraded version of my antispyware program and ran it, this got rid of a few more infected files, then I downloaded an antimalware program and ran it, this found about 50 more infected files and deleted them. Now I was down to one popup every 20 minutes or so, an alert message that my computer was still infected and when I hit cancel it tryed to take me to the antispyware 2009 web site. After a call to my IT. friend, he directed me to a website that had a free program called combofix, this program shows you all the programs running on your cpu and deletes some of them but allows you to see and find anything else suspicious and shows you where to find and delete them. I have been popup free since 5:00 PM Yesterday! Found another clever trick this jerk used, In windows Task manager he had 48 tasks scheduled to run abut 15 minutes apart to run a program called C:\WINDOWS\system32\TPuPyhMu.exe.a_a
this is the program that launched the web browser and directed it to his website.
All of the files listed at the top of the page were found and deleted along with the folowing files and folders. This process took me 2 full days to do, if you want to do it youself, I hope these will help. Good Luck!
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Cognac (Rogue.Multiple)
HKEY_CURRENT_USER\SOFTWARE\CrucialSoft Ltd
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ms antispyware 2009 5.7
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0)
Folders Infected:
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\BASE
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\DELETED
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\SAVED
Files Infected:
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\3MZ7GQXG\216[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\UM1TIS9N\216[1].jpg
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090222122213003.log
C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090222140942078.log
C:\WINDOWS\system32\TPuPyhMu.exe.a_a
MSConfigStartUp-MS AntiSpyware 2009 - c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe
MSConfigStartUp-Cognac - c:\docume~1\ADMINI~1\LOCALS~1\Temp\2019.exe
But we need mobile security also that will be very useful for thousands of customers...
Antivirus pro installed itself on my computer. It does not allow me to connect to the web ti run antispyware programs or run the programs installed on my hard drive. Cannot locate the files with task manager. It has total contraol of my pC. Where do I start?