Anti-Virus 2009

[JohnS.]

Please guys do not download this. It is a really nasty virus that is going around and TONS of people are getting it. I am a PC tech at a local shop and this freakin virus is everywhere.

Antivirus 2009/8/7, is a new rogue anti-spyware program from the same family as Antivirus 2008 and Doctor Antivirus . Antivirus 2009 is installed and advertised through the use of misleading web sites that attempt to make you think your computer is infected with a variety of malware. Once installed, Antivirus 2009 will scan your computer and list a variety of fake infections that can't be removed unless you first purchase the software. These infections are fake, though, and only being shown to scare you into purchasing the software.

When Antivirus 2009 is installed, a Internet Explorer browser helper object is also installed that displays fake messages when using Internet Explorer. These messages range from a line at the top of the browser stating an infection was found to adding a box to the Google homepage stating Google detected that your computer was infected. These tactics are just two more methods where Antivirus 2009 uses false information to scare you into purchasing their software.

Associated Antivirus 2009 Files:

    Note: Some of these entries are random named.

    %UserProfile%\Desktop\Antivirus 2009.lnk
    %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
    %UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll
    %UserProfile%\Start Menu\Antivirus 2009
    %UserProfile%\Start Menu\Antivirus 2009\Antivirus 2009.lnk
    %UserProfile%\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk
    c:\Program Files\Antivirus 2009
    c:\Program Files\Antivirus 2009\av2009.exe
    c:\WINDOWS\system32\ieupdates.exe
    c:\WINDOWS\system32\scui.cpl
    c:\WINDOWS\system32\winsrc.dll

Associated Antivirus 2009 Windows Registry Information:

    Note: Some of these entries are random named.

    HKEY_CURRENT_USER\Software\75319611769193918898704537500611
    HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "75319611769193918898704537500611"
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ieupdate"

Guys if you come across this whatever you do, do not pay for any of the services it offers. These types of rogue spyware are being written in areas of the world where there are no laws against this type of thing. They will empy your bank accounts and you will be left with nothing if you don't notify your bank in time.

If you do find that you're infected with this virus, use MalwareBytes Anti-Malware software. It is free and is the best tool to get rid of this, and all other rogue-type spyware and malware. Feel free to contact me if any of you have any trouble.

[chunkylover]

And seriously guys.

Firefox and a few addons can pretty much get rid of any malicious or misleading popups whatsoever.

So you never encounter this problem

and therefore never get the spyware.

Another real bitch that I've seen lately are adware and malware, that use MSN messenger to spread, I'll printscreen some examples later, I know a few people with it.

[Judge]

Best thing you can do is never run any files from any one.  And don't use default IM clients.

Or stop running windows.

[Excaligore]

Simple enough actual research into the antivirus software you install rather than just clicking on shit you get from pop ups.

Simple logic.

[The Murph]

To stop the MSN issue you need to change your password. I had it happen before uninstalled and reinstalled twice and it never worked. Changed my password and haven't had an issue since. Make sure you advise people of this who are sending you the messages. Unless their slow as fuck, then just block and delete. I had a friend who I told 6 times how to do it. He never did. So block and delete. I'm not waking up to 4 messages of random web addys.

[chunkylover]

okay, i'll tell everyone who's got it

There are other ones which offer you random downloads, they're easy to get rid off, you just get rid off everything in your received files.

[JohnS.]

Best thing you can do is never run any files from any one.  And don't use default IM clients.

Or stop running windows.

Quoted for truth! These days Linux is no longer a difficult operating system to learn. It's all dumbed down and GUI'd up now.

Oh yeah, and then there are MACs 

[Dave Johnson]

AHHH FUCK!!

I have this Antivirus 2009 piece of shit, thank you very freaking much for telling me this! This bitch is getting deleted, once again thanks for letting me know, I've only had it for 2 days, so thanks!!

[JohnS.]

No problem man. Hit me up on AIM or drop a PM if you need help removing it.

[MitchMMA]

Thank you so much for posting this because it just popped up on my computer and scared the shit out of me. I was like freaking out, then I remembered reading something like this on these forums and I looked back here and read it lol.

I clicked run, but I didn't subscribe to anything, so am I safe or do I still need to delete it or something, I have no idea lol.

[JohnS.]

http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe

First download that. It is a program called Malware Bytes' Anti-Malware, and it is awesome at removing rogue spyware.

Right click 'My Computer' and select 'Properties.' Go to the System Restore tab and disable System Restore. This will delete all previous system restore points, and also rid the system restore of all virus traces.

Install, update, and scan. It will locate the spyware/virus activity ony our PC. After the scan it will move the items to quarantine and generate a log. Go to the Quarantine section and remove the files all together.  After that you can move to the next step.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Download this program, it is called ComboFix. Make sure you download it to the DESKTOP, and run it from the DESKTOP.  It will take approx. 10 minutes to run, during that tiem just walk away from your PC (not really just don't click anything, it could cause the program to stall). It will reboot and also generate a log. Please post the log in this thread after you have run ComboFix. From there I can see if there is anythign else that needs to be removed.

[Dave Johnson]

You are the best, my mum wold have killed me.