This is probably one of the sneakiest Trojans I’ve seen; it masks itself as an anti-virus and then infects your PC, absolutely brilliant!
Antivirus 2009 Technical Details
- Full name: Antivirus 2009, Antivirus2009
- Version: 1.0
- Type: Rogue anti-spyware
- Origin: Russian Federation, Ukraine \ http://antivirus-2009.com, http://antivirus2009-scanner.com, http://antivirus-database.com, http://antivirus2009professional.com
I’ve seen people’s PCs infected with this Trojan since the second half of 2008 (when it was still called Antivirus 2008) and later in December when it was called Antivirus 2009, another horde of infections took place that I know of. It always amazes me how gullible some people are, I mean installing a piece of software that calls itself Antivirus 2009 while it’s still 2008.
The typical place you’ll pick up this Trojan is on “adult” sites (which will prompt you to install a codec before you can see videos of naked scammers), on sites promoting piracy through making cracks available online as well as through third-party advertisers (on reputable sites) who will advertise this Trojan as a genuine anti-virus. Also on fake youtube sites or a couple of scammers on facebook are also promoting it (mostly users pretending to be females between the ages of 20 and 25 dressed in skimpy clothes who will then add you and send you a link to their webcam which will then contain a popup or something similar trying to sell you this crap).
I wonder if stats are available as to what the ratio of infections are between male and female computer users?
First it will tell you that your PC is infected, click for a free scan, then it will install a trial-version which will install other spyware on your PC and then it will blackmail you (with frequent popups ) into paying them $50 for the full version in order to remove the “detected” spyware.
Microsoft claimed that it removed nearly 400 000 such infections in December 2008 over a period of 9 days. Such has been the success of these scams that several of the fake programs have become infamous. WinAntiSpyware, Antivirus 2008 (recently updated to 2009), Antispyware Pro XP and AntiVirus Lab 2009 are all suspect, and no doubt others will soon emulate them.
If your browser redirects you to an online security scanner by Antivirus 2009 without a prior visit to one of its websites, it’s a good sign that your browser is hijacked by the Antivirus 2009 hijacker. If you can run an Antivirus 2009 system check, you’re also infected, best to kill it before it infects your PC any further and makes it any slower.
Remove Antivirus 2009 files and dll’s
av2009.exe
Antivirus2009.exe
shlwapi.dll
wininet.dll
Unregister Antivirus 2009 registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
“Antivirus” = “%ProgramFiles%\Antivirus 2009\Antvrs.exe”
HKEY_CURRENT_USER\Software\Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus
When you’re done burning down the Trojan horse, install a proper anti-spyware and anti-virus to take care of the remaining rubbish installed by Antivirus 2009, a good anti-virus I’d recommend is Avast Antivirus Home Edition (it’s free, all you have to do is register it online) and get yourself a copy of Spybot Search and Destroy (also free with an optional donation if you want to donate to their organisation) or get Linux :p
Avast is the shit. In a good way. Had it for 2 years now, and I haven’t had a single infection. Even when my flashdrive was doing the promiscuity rounds in our student house in ‘07. I even managed to clean 2 laptops and 3 iPods with it.
Of course, the first line of defense is always: Don’t be an idiot. People that download suspicious software from suspicious sites shouldn’t be allowed to use computers, imho.
Hear hear, I feel sorry for the people who make a living out of the IT industry, working with the same problems everyday having to tell people the same thing everytime they fix a PC, sheesh, guess the next one we’ll be seeing is Antivirus 2010, lol
LOL! AV 2010, special Soccer Ball edition. All the trojans it detects will be named after football teams ;)
… with every pun popup referring to the SA stadiums not being done yet