[CallyWood]

Alright, one of my clients has what seems like a phoney anti-virus program on her computer that just appeared.

It's called "Antivirus 2009" and has no company logos, no identifiers other than that name. My diagnosis is that the program is a virus. When I went to uninstall the program, it does not show up in the 'add or remove programs' list.

I found the program in the program files, but when I try to do anything to it, it says something like 'the disc is write protected'

now that's as far as my ability goes. I know there are other ways to attack this such as deleting from the registry.. I think.


She is currently using avast for her antivirus software, and I recommended that she start using firewalls, programs like noscript on firefox, and stop letting her grandson search porn on her machine (in not so many words).

In the meantime, avast isn't identifying the program as a virus, and I'm going to try installing ccleaner next time I go see her providing you don't have a better solution.


Any help would be great!

[weaponx71]

First thing I found in Google.

Removal

[Iron Monkey]

Let me save you time. Back up all data, use KILLDISK, reinstall Windows. The older versions of this fraudware were removable...this will never go away. Elements are entrenched in random points in the registry and in a hidden folder you cannot reach (short of booting with Linux, and even then...).

Trust me, you'll save yourself hours of grief and hair-pulling by wiping.

[CallyWood]

well now I feel silly for not doing the simplest thing, thanks weapon!

I suggested a wipe and reinstall to her because she has very little data she wants to save. Unfortunately, she doesn't have a windows boot disk and doesn't want to spend money on one. I'll try the uninstall and warn her not to do anything like banking or tyipng any personal information on there.

[weaponx71]

I'd bet one of us could come up with an extra disk. Unless mailing her one is a problem.

I didn't read anything about it, all I was going with was what was found in Google, if Monkey is right, it sounds like a right nasty install.

[Iron Monkey]

Yeah, whose the vendor? If it's Dell, I'm swimming in Dell XP restore CDs. I also have a few Compaq/HP business XP restore discs too, though they don't work as well on home models, tho'.

...wait a second...if this IS a home/retail 'puter, or even the newer HP business machines, they have a system retore partition. I just ran into this with an HP Presario business rig....made the restore CDs instead of using the partition, and it was the same damned thing. Do note, with HP you get ONE CHANCE to make the system restore CDs. Recommend if you go this path to login as Administrator to create such...her profile could be screwed.

[CallyWood]

no no, this is an old lady's computer. my job is to promote technology to seniors. I don't want to go so far as to have to boot the system. honestly I don't know the make of the system. she got it second hand and it looks something that might have been beaten around a school or something. considdering she could buy a new system with a nice lcd for about 2-300 bux, she doesn't want the hassle. it's her grandson who uses it. Anyways, I sent the link to a friend of mine and she will go and try the uninstaller from that site. I probably won't hear back from her before Jan 5, so I'll let you know what happens

[WIDOWMAKER99]

http://www.2-spyware...virus-2009.html


Antivirus 2009 is a new rogue anti-spyware program. It is also a clone of Antivirus 2008 - also a rogue, and one that's produced more clones than any other recently. The list of these clones is long: System Antivirus 2008, Ultimate Antivirus 2008, Vista Antivirus 2008, XP Antivirus 2008 etc.

Like any other of it's predecessors, Antivirus2009 uses trojans, such as Zlob or Vundo, to spread. These trojans lurk in porn/warez websites disguised as video codecs, and, upon entering the system, floods the user with popups and fake system notifications, supposedly to inform him of an infection. While the system at hand may indeed be infected, Antivirus 2009 will inform the user of this regardless of whether it's true or not. The point of this disinformation is to convince the user he is infected and therefore needs an antispyware program to dispose of the threat. The user might click on one of the popups or notifications, all of which claim they will take him to a legitimate security tool, but try to make him purchase Antivirus2009's "licensed version" instead. Antivirus2009 may redirect web browser to antivirus-premium-scan.com, webscannertools.com, googlescanners-360.com, livesecurityinfo.com, antivirusonlivescan.com, bestantivirusscan.com, antivirus-best.com, internetquarantinesite.com, premiumlivescan.com and secureclick1.com websites that sell the malware. Some of these website are not only fraudulent, but they are also malicious. they are capable of installing additional malwares.

Antivirus 2009 is a scam and should be treated as such: do NOT download or buy it and block it's websites using your HOSTS file.


also


http://www.windowsvi...spyware-removal


Antivirus 2009 Descriptions:

Here we go again! Antivirus2009, also known as Antivirus 2009, is one of the latest counterfeit antispyware that devastates the Internet community. Antivirus 2009 is a clone of the infamous Antivirus 2008 that previously reported by us. Antivirus 2009 usually come up after you installed a video codec that come with Trojan, malware and virus. Antivirus 2009 normally generates fake and misleading system popup error messages so end-users will be tricked into purchase Antivirus 2009.

It is very important to remove all the components of of the Antivirus 2009 and all the malware and trojans that it might have come bundle with (such as zlob.trojan, trojan.vundo and Trojan.Downloader). To effectively remove Antivirus 2009, we have created a manual removal instructions which is easy to understand.

Manual Antivirus 2009 Removal Instructions:

Unregister Antivirus 2009 DLL Files:
(Learn how to do this)
shlwapi.dll
wininet.dll

Stop Antivirus 2009 Processes:
(Learn how to do this)
av2009.exe
Antivirus 2009.lnk
Uninstall Antivirus.lnk
Antivirus2009.exe

Find and Delete these Antivirus 2009:
(Learn how to do this)
av2009.exe
Antivirus2009.exe
shlwapi.dll
wininet.dll
Antivirus 2009.lnk
Uninstall Antivirus 2009.lnk

Remove Antivirus 2009 Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\Software\Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ ”Antivirus” = “%ProgramFiles%\Antivirus 2009\Antvrs.exe”

You can try this article xpantivirus-2009-removal-guide/othersoftware this one remove-antivirus-2009/othersoftware

You can also download Kaspersky antivirus, Kaspersky Anti-Virus Products

You can also download the free version of Avira Antivir to remove the spyware (update)

and see this also ...

http://www.xp-vista....al-instructions

bottom line tho... it would be easier to just format and reinstall

[CallyWood]

wow thanks wid!

I'm on holidays right now *w00t* so i'll let you know next week the prognosis. That's great!

[WIDOWMAKER99]

well i have a computer here NOW ..as a matter of FACT

with some shit called MS ANTISPYWARE 2009 ... and guess what i had to do to it ?


first run system restore (from windows safe mode ) ...call the customer ..find out all the files i needed to back up

ie they only wanted pics backed up

run system restore .. all the way back to the last restore point .. theirs was 8/25/08 (the day they installed XP SP 3 )

there is no way to totally remove this spyware tho as the system is still after running system restore ..as well as the above method ... other then doing what monkey said .. yes i'm low leveling the hard disk

this peice o shit spyware is labeled in many sites now and is a new variant and writes to many levels of the operating system itself (via registry) ..mostly screws up win system 32 files (which are un -removable..even in administrator as well as safe mode ) .. especially if the user has installed XP SP3

which cancels out any XP system repair via the original CD XP sp 2 for most systems (unless you left system restore on ...and the drive and can acess it and ... you have a saved point for the original SP 3 install)

OTHER THEN THAT

find out the drive make inside (ie maxtor ..Western digital ..segate) .. find the software for it ...low level format (write zeros to drive) ..........and reinstall ..takes hours tho (took 9 hours to low level a maxtor 80 gig yesterday .. 4 hrs for a 40 gig WD drive today)

is this a bad spyware thing?????

.. ummm yea it locks up the system i'm working on as winblows logs on .. and gets slower and slower till the system locks up as the MS antispyware 2009 loads ..and .. tells me .. without even being plugged into any network connection ....that i am being attacked ..from a remote connection??

i am not connected to anything..no modem ..no cable no network ... is even plugged in !



after talking to the customer she told me she loaded a page .. it advised her she was attacked .. clik next to download MS antispyware 2009

again she is not computer savy

but i do think ..you will need to LOW LEVEL format and reinstall if you want to be rid of this crappy ...well made .. trojan

and yes this same shit is attacking alot of folks .. seems that NORTON does not detect it at all ...as that was her only protection at the time of infection

[WIDOWMAKER99]

and get a cd copy from monkey .. some of those HP/compaq cd's work on any system

the dell ones do too ...you just need a cd key off some one else's system (if it's not a dell sytem)

remember you can activate windows XP every 120 days

MONKEY SEND ME AN ORIGINAL HP /COMPAQ CD !

as long as your not plugged into the internet some of those HP cds never ask for activation! .. ..dells? .. well ya have to have a dell bios ..

the HP cd's worked on several asus motherdboards .. the dell cd's ..well like i said you'd need a dell motherboard and bios

but they also do not require any activation for any version of windows on a dell system (as long as it is not connected to the internet during install)

[CallyWood]

I didn't realize the extent of the removal process.

for now she wants the 10 minute fix, but should she require it, I guess I'll actually have to borrow the machine for a day.

My helper doesn't have much experience in troubleshooting computers, but happens to live next door.

Mind you, most of my computer knowledge has come from trial and error over the last 18 years.

[Iron Monkey]

Somewhere I/Hell posted our Services list...what we run/disable. That would be a help after the fact.

Nuke System Restore. It's a point from which a lot of hacks get in. I've never seen it as any useful tool, except for the Black Hats.

Wid: I've used KILLDISK on every make of drive from multiple vendors (Dell, HP, homebrew) without issue. It's free, does the same job as the manufacturer's disk, though only 1 pass (I've never had a reason to do more than one pass, 'cept for a single government job, which requires 3 passes).

Quick note, get either LT's Drive Image Pro or Ghost. Wipe the system, build it up to the point of having to connect to get updates (make sure you download the latest drivers, definitions 'n such, separately). STOP. Make an image of the current setup, store it somewhere else. Now connect and update/blah.

[WIDOWMAKER99]

MONKEY

yes i tried your KILLDISK program

and it worked fine it did what it said .. KILLED THE DISK DRIVE

and every time i used it .....the drive i used it on never worked again

i stick with what the manufacturer recommends as sometimes you may be formatting a WD / or seagate / maxtor

that may still have a wee little time left on the warranty ..so if the drive does totally fail as long as you use the program from the maker .. your warranty is not void ..and you can send it back and get a full replacement

that was my point ....

KILLDICK .eer i mean KILLDISK destroyed for me

1.one IBM 40 gig deskstar

2.one NEW western digital 15 gig ..was able to resurrect and return running WD tools ..but failed a week later

WD determined the drive was improperly lo level formatted and voided my warranty they did send a new drive ..but only gave me a 30 day warranty on it after numerous calls

3.two maxtor 40 gig drives ..still dead no ide controller will see the drive at all on any motherboard
4.one fitjusu 30 gig ide laptop drive
5. numerous 4 - 8 gig drives

if that program works for you please send me your version ..as every time i downloaded it .. it did not work properly

[Iron Monkey]

Damn...that's damned peculiar. I've used just about every version (occasionally I forget my disc and download whatever the free version on the website). I've used it for 7 years going, on everything...ancient IDE drives to modern SATA drives. Weird weird weird. Controller maybe?

[WIDOWMAKER99]

cant be controller ...i used it on different boards

i had version 1.4 non licensed..one pass only

and made a floppy of it ...dunno

maybe i should have made a iso cd? or is yours on floppy too ?

[Iron Monkey]

Had one copy (floppy) I used, then with a friend's help created a CD of that floppy (need to re-create now...it's dying of old-age and scratches). But yeah, I've used the freeware ISO download (it's a 4Mb download) for the most part. Maybe a flakey disc? I shy away from floppies of the last few years...or anything magnetic if I can help it. Just too unrealiable.

Tell you what...'soon as I get the version I have off of the old CD (it's a boot image, so I have to boot it to get it), I'll send it to you.

[WIDOWMAKER99]

naa i'll go get the new version and make a cd iso if thats what you used

you can send me an HP disk tho of win xp pro if you still have an extra .. ?

those are like gold tho so if ya cant spare it i totally understand ...(hint they work on any pc with an asus motherboard..no activation required ..see the other thred bout it where we discuss it )

maybe thats how i fuxed up ..using the floppy version? .. i thought thats what i needed ..since you say you used the bootable iso cd

and yes they have a download for the ISO version .. but like an idiot maybe i goofed and used the floppy ver on drives that needed a faster connection type ..or the drives that died on me were on their way out anyway ..

but all i wanted to know is what version of the program you had ..and have successfully used

was it 1.4 or was it older ..they have 5.0 out now i think

is this the right site to get the program ?

http://www.killdisk.com/

how the hell did it get to 5.0 from the 1.4 version i have i have no freaking clue if it is the same program we are talking about ..but again me and you have had this debate for quite a few years now

but is this the same killdisk ? i will have to try the new version i suppose .. dammit ya defeat me again

as now they have an iso to download ! rather then just a floppy version

MONKEY WINS !

and so do i as i'm going to get it now and try it on this 40 gig IBM drive !

[WIDOWMAKER99]

on a side note i think ya sent me to the wrong site before .. as i had a much older version of this program

[WIDOWMAKER99]

also as a note i have had to deal with 4 more systems with the MS and us and whatever the real name is ...antispyware bug in the past two days .. this bug is in the WILD and spreading

got two more systems coming tomorrow or monday and they have the same goddamned thing on it

so far the variants i have seen are either named MSANTISPYWARE 2009


or US ANTISPYWARE 2009 and antispyware 2009
all write to the win system 32 folder and create a start up group (thus writeing to the registry )

you can get past it by running system restore if it is active by useing safe mode just to back up data

if system restore is not active your BONED ..the spyware does look for and does seek out other network systems to infect ..
definetly a trojan ,undetectable under mcafee as well as norton

avast hates it ..at least with the latest updates .. and goes nuts on this infection and will lock it down (wont remove it tho ) .. have not tried AVG ..it is also detectable with windows defender as long as it is updated .. but it may not see it or remove it (you have to do thorough scan which takes hours..and have current updates installed )

my advise

if possible use system restore . go back several months

boot .. back up any files you need to save

format ..reinstall win xp and all files you need as well as update all windows files useing MS update
get and use AVAST 4 home free anti virus as well as windows defender .. and get adaware 2008 or another free antispyware remove program (legit one of course ..i like spybot and also spysweeper


but also by useing system restore you may be able to turn this shit off

once you have restored the system to a useable state ... turn off system restore ..thus deleteing the original infection ?

system may run slow tho untill you go in the registry and eliminate the items noted in the above post ..and even then you'd still be better off with a low level format and reinstall

[Iron Monkey]

Nope, there isn't an AV out there that can completely tackle this thing yet. I've tried 'm all.

Frankly, after you do all those system restores, you may as well wipe the thing and be sure. Make sure you ghost the basic setup...saves tons of a rebuild time.

I'm using v1.8, regularly, but I just tossed a disc with v5.0 on it (one of those, "Damn, forgot the disc, gotta download") bits. The 1.8 I have is a licensed copy, meaning you can do more than one pass and even go as far as create an automation disc (bootable, auto-wipe disc).

[WIDOWMAKER99]

another machine showed up here today with that same antispyware 2009 shit on it

just got done a reinstall and installing the windows updates and service pak now

[WIDOWMAKER99]

as a note to others that may run across this spyware variant ..

it is impossible in alot of cases to do a dammed thing as far as back up the data off the system after infection .. the shit just will not boot properly into windows to allow you to do this even under safe mode to edit registry settings or anything

as to system restore i agree with monkey this is problematic to leave on as alot of times it will restore the original infection state ..on my machines i turn it the fuck off ..thus saveing hard disk space and system resources

but it did save my butt on one system allowing me to back up a few files from the my documents folder via thumb drive


if the system infected is a dell there is some good news

you can fix it in about 20 min .. but the customer will lose any data they loaded into the system since purchase

this also applies to some HP systems as well as lenovo and ibm's

on several systems they hid a restore partition on the harddrive ...

BEFORE YOU WIPE THE DRIVE check to see if this is the case ..wipeing the entire drive will wipe out this easy fix software ..and in most cases you paid for it to be installed

check the manufacturers site

i have found out alot of Dell systems (laptops and desktops) have a hidden restore partition

to acess it you have to hit cntrl and f11 at boot

i did this a few months ago too to an IBM think pad laptop ..but i forget what keys i had to hit on that system ..(found the info at manufacturers site )

if it is present (symantec restore) it will restore the system to the exact shipping state of the system .. usually in less then 20 mins

and thats alot quicker then doing a low level format (especially if the drive is huge )

and alot quicker then a normal xp install would take

i like monkeys and jeeps idea .. make a ghost image of your drive for back up

and remember to tell folks who get this shitty spyware .. it's not your fault they didn't have any data backed up

everyone should keep decent backups of all important data on cd .. or other stable media type


hell last time we had a hacker posting the forums with porn links ....me like a dumb fuck cliked em verified he was posting bullshit links to infection sites and i infected this system i'm on now

i had backups for everything i needed .. just took time for me to reinstall all my shit

but your best bet is always have back up ready

and learn how to and understand how to reinstall your operating system ..as in most cases these days .. your gonna get fucked up on the net ..sad but true ..there is alot of malicious software out there

[WIDOWMAKER99]

Iron Monkey, on Jan 5 2009, 09:52 AM, said:

Nope, there isn't an AV out there that can completely tackle this thing yet. I've tried 'm all.

Frankly, after you do all those system restores, you may as well wipe the thing and be sure. Make sure you ghost the basic setup...saves tons of a rebuild time.

I'm using v1.8, regularly, but I just tossed a disc with v5.0 on it (one of those, "Damn, forgot the disc, gotta download") bits. The 1.8 I have is a licensed copy, meaning you can do more than one pass and even go as far as create an automation disc (bootable, auto-wipe disc).

yea see you have the older version .. that may be what fucked up the drives i tried it on .. i do not have the 1.8 version

nor did i pay for it .. thats why i still use whatever version the particular hard drive requires from the manufacturer

and even kill disk has to take alot of time on a 250 gig drive /single pass ?

right ?

[Iron Monkey]

WIDOWMAKER99, on Jan 8 2009, 05:10 PM, said:

Iron Monkey, on Jan 5 2009, 09:52 AM, said:

Nope, there isn't an AV out there that can completely tackle this thing yet. I've tried 'm all.

Frankly, after you do all those system restores, you may as well wipe the thing and be sure. Make sure you ghost the basic setup...saves tons of a rebuild time.

I'm using v1.8, regularly, but I just tossed a disc with v5.0 on it (one of those, "Damn, forgot the disc, gotta download") bits. The 1.8 I have is a licensed copy, meaning you can do more than one pass and even go as far as create an automation disc (bootable, auto-wipe disc).

yea see you have the older version .. that may be what fucked up the drives i tried it on .. i do not have the 1.8 version

nor did i pay for it .. thats why i still use whatever version the particular hard drive requires from the manufacturer

and even kill disk has to take alot of time on a 250 gig drive /single pass ?

right ?

Honestly, it depends on the system (controller, system board, etc) moreso than the drive. I have 40Gb drives that take almost an hour to wipe, whereas a 250Gb SATA2 wiped in 10 minutes.

Still odd about the problems. Very odd. I've several other people who use various, unregistered versions without issue. Odd odd odd.