AntiVirus 2009 Removal
This Guide covers the removal of the following threats, Antivirus 2008, Antivirus 2009 and the like. Chances are it will work for past threats like antivurs 2006 and antivirus 2005.
Warning: While this guide is 100% free we can not be held accountable for any of the free software recommended on this site. We did not make it and do not support it. This guide is more for the computer savvy so if you are a novice you may find it a little hard to follow.
Please take a second to boomark this page. You will be rebooting several times through out this guid and may loose your place. Other wise feel free and download our Antivirus 2008 removal Guide in pdf format (coming Soon)
The time it will take for you to fully remove Antivirus 2008 will depend on several factors, speed of your computer, how infected your computer is, whether you have real protection already or have none.
We urge you to consider purchasing real software to help remove Antivirus 2009. All free clients out there do not do a propper job of protecting your computer. We recommend Spyware Doctor with Antivirus which can be found by going to http://www.pctools.com/spyware-doctor-antivirus/purchase/ USE COUPON CODE: pctools10 when checking out for 10% off.
If you are not a computer repair expert and fear damaging your computer then we suggest you call a pro to remove this virus for you or at least backup your files first. We can not be held liable for any actions you take. If you are not computer savvy then consider http://www.onlinecomputerrepair.org to remove this threat for you. This is the best online computer repair company out there and they guarantee their work.
How to Remove Antivirus 2009
The first thing you should do is a system restore. Use the system restore that is built into Vista and XP. Select a date from the restore pionts when the computer was not infected. We recommend going back at least 2 weeks prior to the infection date. If the first restore piont does not work then try it again using a different date or by booting into safe mode and trying the system restore function there.
To start system restore go to START > ALL PROGRAMS > ACCESSORIES > SYSTEM TOOLS > SYSTEM RESTORE. If you have no restore pionts just skip this step an move on. This is not the end all be all but can make the antivirus 2008 removal process that much faster.
Next we are going to download several tools that will help remove virtumonde and all other spywarae on your computer. All these tools are free and fully functional except Spywarae Doctor with antivirus. We need the free trial to stop other threats from re-installing while we are removing them. Keep in mind the free version does scan and detect threats but does not remove them. You still will need to install it and can remove it later.
Download the following and save to your Desktop: Spyware Doctor with Antivirus | Smitfraudfix.exe | Spybot Search and Destory . Once downloaded install Spyware Doctor with Antivirus first. Once installed you may be asked to re-boot. If so just cancell. The scan may auto start. If it does close the scanner down. Now install Spybot Search and Destroy. When installing you will be asked if you want to create a registry backup. Select YES and then continue. You will also be asked if you want to update the program. Say yes to the update. Once updated click the exit button. Installation should be complete. PLEASE REBOOT INTO SAFE MODE NOW.
To boot into safe mode start pressing the F8 key on boot up every other second. From there select Safe Mode. You may be asked to loggin. If so loggin in. You will then see a box that will pop-up asking you if you would like to boot into safe mode or do a system restore. Select yes to boot into safe mode.
Once booted up double slick on the Smitfraudfix icon on your desktop. Select option 2 and hit enter. This program will now clean the system. Once done you will see the windows Disc Cleanup tool start. Just cancel out of this as it does not really matter. You will then be asked if you want to clean the system registry. Select YES. Once done exit the program. for a more detailed guide on this tool visit the makers site at http://siri.geekstogo.com/SmitfraudFix.php
Now it's time to run Spybot Search and Destroy. You will notice a new icon on your dekstop saying Spybot. Double click it and hit the start scan button. Let the scan run. This may take 20 minutes to an hour. Once the scan is done hit the remove button on everything malisious this tool has found. If this tool could not remove everything you will be able to see what it could not remove by the red X next to it's name. If asked to re-run the tool on startup select yes.
For any threat this tool found that it could not remove it will of at least tried to re-name it so it's not active anymore. You can use this tool ( Kill Processes ). You can run this tool and stop any running process then you can delete the process.
Once you are done you will have to re-boot normal like. If Spybot was selected to run on start-up it will run again. If not it will still execute the removal of several traces it found during the first scan. Once that is done you should be almost done. You will notice that your desktop backgorund changed to a default picture (Blue background). This is because of the Smitfraudfix tool doing it's thing. Open up your web browser. You may still need to change your home page back to what ever you had before. Try and surf the web and see if you get any pop-ups. Most likely your issue is now resolved.
Be sure to update Spyware Doctor with Antivirus now and run a full scan. This will tell you whether or not you found all traces of Virtumonde. If you still find yourself infected you could just purchase this program and be done or move on to the next step.
Another tool that works great to help remove antivirus 2008 and antivirus 2009 is combofix.exe. This free tool does have it's downside. While it works most of the time just fine it can mess up your OS. Use will extreme caution. In fact be sure to backup your data before use as it has been none to wreak Windows. Still that is only 3% of the time so if you are still infected and don't want to fork over money for a good antispyware aplication then it's worth a go. You can download Combofix here or visit http://www.bleepingcomputer.com/combofix/how-to-use-combofix . They have a full guide on how to use this tool.
Antoher tool that can help out is called Highjackthis.exe. You can download Highjackthis here or visit http://www.majorgeeks.com/download3155.html to learn more about this tool. This is for advanced PC users only and should not be used by a novice.
If after all this you are not antivirus 2008 free then I don't know what to tell you. This has worked for me 100% of the time and I remove many threats using this exact process. Of course most the time I have no use for these other tools because I get my clients to purchase Spyware Doctor with Antivirus.
A little More Help to Remove Antivrius 2009
For those that are hands on and already know how to stop processes to remove files here is a known list of files that are related to antivirus 2009
%UserProfile%\Desktop\Antivirus 2009.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll
%UserProfile%\Start Menu\Antivirus 2009
%UserProfile%\Start Menu\Antivirus 2009\Antivirus 2009.lnk
%UserProfile%\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk
c:\Program Files\Antivirus 2009
c:\Program Files\Antivirus 2009\av2009.exe
c:\WINDOWS\system32\ieupdates.exe
c:\WINDOWS\system32\scui.cpl
c:\WINDOWS\system32\winsrc.dll
Registry Entries for antivrus 2009
HKEY_CURRENT_USER\Software\75319611769193918898704537500611
HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "75319611769193918898704537500611"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ieupdate" |
