[SweetSunshine]

I recieved this in an email from a good friend of mine. Please pass it on to all you know!!

Okay, I'm giving a head's up on a virus, as we've got this right now and I was told by our computer guy to pass this along to people so they don't get it too. It's called "Antivirus 2009". A box will come up, saying your system has been compromised, or something to that effect. Now, normally, you would just click on the "X" to get out of it, right? DON'T...this virus will start IMMEDIATELY after you click on the "X" to get out of that box. What you should do is either hit "CTRL ALT DEL" and then "End Task", or just go to your START button and shut down immediately. I was told we are in no danger of any of our personal information being passed on, that this is more of an "annoyance" virus, but still, believe me, it is an annoyance. It CAN'T be removed even with McAfee (which we have) or other virus programs.

We need to take our tower in to our computer guy and they will work on cleaning it up. But remember, if you get anything that says "Antivirus 2009", don't click on the "X"...shut down immediately or CTRL ALT DEL! This will save you ALOT of headaches. Our Computer Guy said they have been bombarded with people getting this, so I wanted to let you all know!

[seeker1950]

Sweet! I got this one on my computer. I posted about it last week.
I actually let it go thru with the installation of what was supposed to be a virus protection, as it appeared to be a Windows program. The popups continued to the point that I couldn't use the computer. I did Adaware scans, which wouldn't remove it. Finally I did a "system restore" which seemed to erase it for now. My computer is workng find so far. Have you tried system restore?
As I recall now with horror, the program wanted $49.99 to install the virus protection, which I paid with the credit card. I'm going to the credit card now to see if I can stop payment.
Patty

[cantstopcrying]

I can't even do a system restore, shut mine totally down and won't restart.

[seeker1950]

This program called itself "Antivirus 2009," and wouldn't let me in because of the popups. Adaware did no good removing it.
As I said, I even PAID for the service on my credit card! I just went to my online credit card statement, and sure enough, there were two charges totalling $49.99 from Moscow. My credit card company has stopped payment till it is investigated, but I plan to call them tomorrow and get a new card number.
I know it sounds stupid that I paid for this, but it looked identical to Windows with the logos and everything. I knew Windows had not charged for antivirus in the past, but thought it must be something new that I needed, DUH!
Patty

[seeker1950]

Feeling worried, I just called my credit card to have a new number and card issued to me. Clearly, I do not want a virus program having access to my credit card...from Moscow, no less! All pending charges have been "blocked," and I have filed a dispute as well. Hopefully, I will not have to pay for this mistake.
Patty

[psych16m]

yeah, i already knew about this. there is a real antivirus that can remove it. called "avast." and it is free as long as you use it for home use only, if your a business, you can still get it, it will just cost you.

here is the main website http://www.avast.com/

if yuo want a free home edition, here's the link:
http://www.avast.com/eng/download-avast-home.html

compared to other antivirus systems, this is very lightweight (not as hhd [harddrive] demanding like norton and others) and amazingly great at protecting your computer. here are some of the included providers:
-web sheild
-network sheild
-instant messaging
-internet mail
-script blocking
-p2p shield
-standard shield

also, what i like about this, is that it will tell you about frequently attacked sites, and if you do start downloading a virus (or other) then a message will pop up and you can abort the download.

hope you enjoy, and tell other ppl about antivirus 2009, everyone needs to know the danger :P
byez

[SeptemberMorn]

Is this a pop-up? Will it override your pop-up blocker?

[kimmydawn]

I just spent the night getting a friend's computer even somewhat functional from this thing.

It's horrible. Antivirus removed 30 trojans it implanted into the system. I couldn't use spyboat (kept freezing), and when I went to download spy doctor, it froze and keeps freezing. This program knows that spy removal programs can get it and interferes with them even, it seems!

It's UGLY...bad UGLY.

I went into the tast manager and removed the only process I could find related to it. Things were just a bit better. I then was able to do a search for files (couldn't before...too too slow) and found three and removed them. That stopped the popups for now.

I plan to do another virus scan and will check out the avast (thanks for that).

There aren't any popups, but it's still running pretty slow. I'm going to check it tomorrow for her (number one...the spy doctor continually tries to load and doesn't so I need to get that off of there. Also, I just disabled a file from it in the startup menu as well).

I'm afraid I'll have to do a system restore for her, but I have no idea when it was put on there...none. I'd say three months would be safe.

Another residual problem that I'm having trouble with is that it turned off the automatic updates in the security center, and no matter how many times I try to turn them back on, it doesn't work.

Tomorrow, if I get the spy doctor off there, run a clean virus scan and spybot, and it's still slow, I'll have to do a system restore.

Made some progress and that was after about 8 hours of work because it was just creeping to even do a single function.

This one is BAD, guys. I wanted to share the progress I've seen so far with it and tell you what I'd done at this point to see if it might hellp any of you.

Good luck!

KD

[sabby]

Yep, ugly is too nice of a word for this one *sigh*

Here is a link to a program I used last night to help fix my daughter's computer - http://www.bleepingcomputer.com/malw...antivirus-2009

Also, if you do a search on "microsoft antivirus 2009" you will come up with some discussions as to how best to rid your computer of it as well. The above "bleepingcomputer" site was suggested at the microsoft discussion board and so far, has seemed to do the trick.

Good luck everyone!


sabby

[kimmydawn]

Thanks, Jean.

I saw that, but wasn't sure if it was free or not. I want to make sure that I got the remaining remnants of this ugly thing.

It was free?

KD

[sabby]

Yep, it's free or you can buy it...either way.

Also....if you use some of the removal directions listed at the microsoft discussion board, there is a report that you can post to another forum asking for help with the registry key entries....you do have to join the boards (just like here) but that's free as well.


sabby

Well, my computer has been infected with this virus a couple of times years ago, or trojans like this. Except, sometimes the ones that are similar just pop up one day and aren't really voluntary. These days if a pop-up like that happen I just hold the power button down so my computer shuts off without "saving my settings" and then just for good measure use the non-destructive system recovery (I don't have a lot of things that I'd hve to re-intall so I'm okay with that) just incase because you never no the minute I start up after turning my computer off it might turn up again. Though one thing I would recomend if your computer is seriously infected (Windows XP) would to try the "destructive system recovery" because it litteraly tosses out all files and programs except the ones it came from when you first got it.

[Shangrala]

Wow! What a nightmare!! An updated version of the one I encountered just a couple months ago. Mine was called Antivirus 2008.

It initially presents itself as a Windows-related virus removal tool. It appears in the center of your screen and allows you only ONE (visual) option to get rid of it, which is the option of clicking on the little red "x" in the upper right corner of the window.
And for most unsuspecting users, that is the "click of system doom". One clicked, the virus then begins its devistating, mind-numbing, stress-leveling effects.

This is a Trojan virus. The location of where it is contracted is unknown.
Once your system becomes infected with this virus, the effects are programmed to remain dormant for a short time between the initial infection (virtual attack) and the progressive results. The purpose for this is to evade tracing of its original location, leaving the user (victim) totally unaware of "how or when this could have happened".

The virus cleverly infects by posing as an initial operating system file. It immediately positions itself in silence, and once opened it spreads itself to the second phase of attack, spreading even deeper by overriding files extensions.
With each system start-up it spreads wider, sending itself further into your system.
Because it is programmed to gain control quickly, it immediately recognizes any and all anti-virus programs. It isn’t that your anti-virus program is bogus, it is because this Trojan is designed to recognize,confuse and fool what existing protection you have. In the process of bypassing your anti-virus program, it is programmed to also alter it from its original function as well. And because this is all done without your awareness, it leaves your system even more vulnerable for other possible attacks.

It also alters many other programs and system operations, thus eventually preventing you from accessing your own system. Before you know it, you no longer have administrative rights. Your desktop is all white with only that nagging Anti-virus 2009 window smirking at you. You cannot access your program manager, system files, smooth start-up becomes futile, and eventually the possible system surrender to a crash.

System restore may help IF you have it set up in your system to automatically set a saving system restore point. If you do not, then any restore point is also disabled.
Unless you know how to override window's start-up and get into your DOS program for troubleshooting and hopeful salvage, you may be forced to do a complete Windows reinstall, resulting in the loss of everything you had on your hard drive. That's about when its time to break out the box of tissues, or the baseball bat.

I eventually rebuilt my own system from scratch. I do not favor pre-fab systems as they have far too many restrictions due to warranty, and you never REALLY know what is inside your system.
And pre-fab systems all come as Vista-Challenged! No thank you!…lol

Good luck to the resurrection of all infected systems.

I’m only sorry there are so many victims to this mindless misdeed. Makes you wonder why anyone with the intelligence, such as the individual who designed this virus, would go to the extent of first designing the virus, then distributing it to the public. What is the reward? The mere thought that his act has reached countless victims? I fail to understand how making someone else miserable has any possible pleasure.

Also~ The Antivirus program I use, and found to beat all others hands-down is AVG by Grisoft. VERY easy, user-friendly. I love it. Free. Though they offer other security protection programs for system as well.
www.grisoft.com

Keepin em crossed.
Shangrala

[SeptemberMorn]

Originally Posted by psych16m

yeah, i already knew about this. there is a real antivirus that can remove it. called "avast." and it is free as long as you use it for home use only, if your a business, you can still get it, it will just cost you.

here is the main website http://www.avast.com/

if yuo want a free home edition, here's the link:
http://www.avast.com/eng/download-avast-home.html

compared to other antivirus systems, this is very lightweight (not as hhd [harddrive] demanding like norton and others) and amazingly great at protecting your computer. here are some of the included providers:
-web sheild
-network sheild
-instant messaging
-internet mail
-script blocking
-p2p shield
-standard shield

also, what i like about this, is that it will tell you about frequently attacked sites, and if you do start downloading a virus (or other) then a message will pop up and you can abort the download.

hope you enjoy, and tell other ppl about antivirus 2009, everyone needs to know the danger :P
byez

Psych, thank you so much for providing the link! I installed it last night and so far it has notified me three times of having stopped something unwanted!

THANKS again!

[seeker1950]

Yes, it is Antivirus 2009, and looks like a Windows virus protection program. I followed the advice here and downloaded Avast, and my computer is working fine. Avast is free. Prior to that, I did a system restore which also got my computer working normally. I AM still, however, trying to get the $49 charge I allowed to go thru with the installation of this program, when I thought it actually was Windows. My credit card company had better remove that charge, or I'll be cancelling my service with them also. The charge says it comes from Moscow, Russia.
Patty

I would like to note that there is another very similar bug that usually tries to attack my computer is known as Black Web that tries to give me their "security" and "disinfecting" services for my computer. The instillation of the virus works the same way as Antivirus 2009, and it's effects are just as nasty.

[kim_johnson]

(((((macs))))))

[kimmydawn]

The program sabby referred is GREAT.

As I said, I'd gotten it under control by stopping the process and deleting some of the bigger/easily attainable files, but this appeared to get rid of the rest as everything is moving good and fast.

Thanks everyone!

KD

[Capp]

Avast has been protecting my computer for years...
The abort warning has helped me several times.

Bleeping computers has been a favorite place for me to learn things--I'm not especially computer savvy!
The people on the forums are volunteers and experts in their own rights. Their responses assume you don't know much about computers, but it's a time saver. If your replies let them know you more knowledgeable then they "upgrade" their responses.

As an aside, I also added a plug in from FF which prevents my from being redirected to a different site than the one I wanted...I have to allow it if I know it's a trusted site.

Cap

[seeker1950]

I did more research today, fearing my computer is still infected by this Antivirus 2009, especially since I actually PAID for the service, not knowing it was a virus scam. (I'm still wrangling with my credit card company.)
CNet and other reliable sources recommended using Malwarebytes' Anti-Malware scanning as this is one of the few sites which is up to date on the current viruses. I still have Avast working away, but I did the Malware scan this evening and 249 infected sites came up to be removed.

I also had a Weather program which had come up on my computer for several months when I turned on my system. I tried to remove it, but no luck, could not be removed. Malware detected it as an "infected" virus and it is now gone.

Do some research on Malware removal system, and see if you think it is worthwhile for you also.
Patty

[therealme]

stupid me just opened a file from a friend, and got stung by a virus ...grrrrrrr

[pegasus]

Thank you everyone for the information.

[Capp]

((therealme))
it's a common thing for this to happen...we trust the people who send us things but this is how we get stung...
I'll have to look up the virus also making the rounds that affect some youtube videos/playlists
Do you have software that can remove it?

Quoting from another group I belong to:
the other one is Actns/Swif.t
Don't get the idea that Actns/Swif.t was a hoax though. It is not, it just isn't in EVERY embedded video. AFAIK it was confirmed in one video but may be in others. Both it and Antivirus2009 are serious problems. If you want a way to scan embedded video links there's a (alpha) tool, Wepawet at the following page to do that. If you want to avoid the problem altogether get no script or flashblock and leave it on to block flash video altogether

wepawet.cs.ucsb.edu/

Cap