Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Hoborobo234]

Ok i know this has nothing to do with DF but I need someone to help me. I have recently accidentaly installed Ativirus 2009. I need advice on how do uninstall it. Has any one else encountered this and can any one help me. This is about the only site I can access online and I have fear that there is only a certain amount of time before it robs me of al access to any on my computer please help.

[Mirefrost00]

Spybot:  Search & Destroy.   Update, run the scan, fix selected problems.  You may need to set it to run again at startup to catch anything that runs at boot.

[Yanlin]

And this has WHAT to do with DF adventure mode or even DF at all?

And what? Anti virus 2009? Well if you're dumb enough to fall for that...

[Hoborobo234]

Read my post. It was an Accident and this is about the only site I can access. Sorry to be rude but please.

[Roundabout Lout]

this belongs in various nonsense.

[Nethras]

Boot from a CD, run real anti-virus scan?  If you have access to a second computer, in the extreme case you could always take out the HD and put in in the other computer as a second drive, and clean/reformat it that way...

[Yanlin]

From what I can tell, this guy is begging for help.

You fell for it, now suffer. The only thing left to do based on what I know from this post is to format.

[IndonesiaWarMinister]

Spoiler (click to show/hide)

What this programs does:

Antivirus 2009 is a new rogue anti-spyware program from the same family as Antivirus 2008 and Doctor Antivirus . Antivirus 2009 is installed and advertised through the use of misleading web sites that attempt to make you think your computer is infected with a variety of malware. Once installed, Antivirus 2009 will scan your computer and list a variety of fake infections that can't be removed unless you first purchase the software. These infections are fake, though, and only being shown to scare you into purchasing the software.

When Antivirus 2009 is installed, a Internet Explorer browser helper object is also installed that displays fake messages when using Internet Explorer. These messages range from a line at the top of the browser stating an infection was found to adding a box to the Google homepage stating Google detected that your computer was infected. These tactics are just two more methods where Antivirus 2009 uses false information to scare you into purchasing their software. A more detailed writeup on how the Google home page is hijacked can be found here.

 

Screen shot of Antivirus 2009
Screen shot of Antivirus 2009
For more screen shots of this infection click on the image above.
There are a total of 4 images you can view.

 

This guide will walk you through removing the Antivirus 2009 program and its associated malware for free.

 

Threat Classification:

    * Information on Rogue Programs

 

Advanced information:

    View Antivirus 2009 files.
    View Antivirus 2009 Registry Information.

 

Tools Needed for this fix:

    * Malwarebytes' Anti-Malware

 

Symptoms that may be in a HijackThis Log:

    Note: Some of these entries are random named.

    O2 - BHO: &Research - {037C7B8A-151A-49E6-BAED-CC05FCB50328} - C:\WINDOWS\system32\winsrc.dll
    O4 - HKCU\..\Run: [75319611769193918898704537500611] C:\Program Files\Antivirus 2009\av2009.exe
    O4 - HKCU\..\Run: [ieupdate] "C:\WINDOWS\system32\ieupdates.exe"

 

Guide Updates:

    06/28/08 - Initial guide creation.

 

Automated Removal Instructions for Antivirus 2009 using Malwarebytes' Anti-Malware:

 

   1. Print out these instructions as we will need to close every window that is open later in the fix.

   2. Download Malwarebytes' Anti-Malware, or MBAM, from the following location and save it to your desktop:

      Malwarebytes' Anti-Malware Download Link


   3. Once downloaded, close all programs and Windows on your computer, including this one.

   4. Double-click on the icon on your desktop named Download_mbam-setup.exe. This will start the installation of MBAM onto your computer.

   5. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware checked. Then click on the Finish button.

   6. MBAM will now automatically start and you will see a message stating that you should update the program before performing a scan. As MBAM will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main program as shown below.


      MalwareBytes Anti-Malware Screen

   7. On the Scanner tab, make sure the the Perform quick scan option is selected and then click on the Scan button to start scanning your computer for Antivirus 2009 related files.

   8. MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.


      MalwareBytes Anti-Malware Scanning Screen

   9. When the scan is finished a message box will appear as shown in the image below.


      MalwareBytes Anti-Malware Scan Finished Screen

      You should click on the OK button to close the message box and continue with the Antivirus 2009 removal process.

  10. You will now be back at the main Scanner screen. At this point you should click on the Show Results button.

  11. A screen displaying all the malware that the program found will be shown as seen in the image below.


      MalwareBytes Scan Results


      You should now click on the Remove Selected button to remove all the listed malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine.

  12. When MBAM has finished removing the malware, it will open the scan log and display it in Notepad. Review the log as desired, and then close the Notepad window.

  13. You can now exit the MBAM program.

Your computer should now be free of the Antivirus 2009 program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Posting A Hijackthis Log

 

 

Associated Antivirus 2009 Files:

    Note: Some of these entries are random named.

    %UserProfile%\Desktop\Antivirus 2009.lnk
    %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
    %UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll
    %UserProfile%\Start Menu\Antivirus 2009
    %UserProfile%\Start Menu\Antivirus 2009\Antivirus 2009.lnk
    %UserProfile%\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk
    c:\Program Files\Antivirus 2009
    c:\Program Files\Antivirus 2009\av2009.exe
    c:\WINDOWS\system32\ieupdates.exe
    c:\WINDOWS\system32\scui.cpl
    c:\WINDOWS\system32\winsrc.dll

 

Associated Antivirus 2009 Windows Registry Information:

    Note: Some of these entries are random named.

    HKEY_CURRENT_USER\Software\75319611769193918898704537500611
    HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "75319611769193918898704537500611"
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ieupdate"

 

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can post a HijackThis log in our HijackThis Logs and Analysis forum.

If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you.

This is it.

[Lord Dullard]

I'd just reformat.

Usually once you've got something like this on your computer there's no point in trying to remove it. Even if you get rid of the original threat, by the time you do it's usually managed to infest your computer with a plethora of other nasty things.

Stuff your personal/essential files on a flash disk or CD, reformat, and then virus-scan the files BEFORE you put them back on your computer.

[Eatnobles4breakfast]

so, does anyone want to try to make this relevant to DF or are we just gonna write it off as a waste of cyberspace?
i say we do something about e-littering! yay!!! wooooh!

so, has anyone ever managed to kill every living think in a town and turn it into a ruin?

[i2amroy]

My brother has, it is basically all that he does in his adventure mode games. He goes into a town and asks them if they have any quests. If they say yes, he completes the quests up until they say no. And then... he butchers the entire town or dies trying.

[Neoskel]

I have. It's way easier as a bronze colossus of course. 

[Tubi2b]

My first vote is you use a system restore to pre-install.
Start-> All Programs->Accessories->System Tools->System Restore

I use Ad-Aware 2007 and CCleaner. I love CCleaner.. it fixes reg errors and everything.

Also: Spacemonger is good for finding out what is taking up so much space.