Removing Antivirus 2009 - Round 3

July 5, 2008

This entry is part 3 of 6 in the series Removing Antivirus 2009
Removing Antivirus 2009

Despite my best efforts in XP Antivirus 2008 and Antivirus 2009 are evil! and XP Antivirus 2008 and Antivirus 2009 - Round 2 it appears that there might still be some residual infection on my Dad’s computer:

Last evening preparatory to shut down, that blue screen we saw last week-end popped up with the standard msg about having to shut down.  But this time, instead of going through the motion of shutting down and restarting, the system froze.  Finally pulled the plug and brought the system up in the admin account and started SpyBot.  It produced zero hits.

My latest round of advice is to try the following:

  1. Update your virus scanner and both Ad-Aware and Spybot definitions.
  2. Reboot your computer. Press the F8 Key right as windows is starting. Choose to boot into "Safe Mode."
  3. In "Safe Mode", run a full scan with your virus scanner and both Ad-Aware and Spybot. Delete any malicious files that they find.
  4. Reboot the computer normally.

Safe Mode only loads the minimum programs your computer needs to run. That should keep the malware programs from running in the background and reinstalling themselves while you remove them. If that still doesn’t work, you will have to search online for a way to get rid of that specific malware program. You could also try some of the other programs listed below.

That advice is from Magoo’s Guide to Eliminating Spyware (specifically the Tricky Malware section). It is a little dated (from 2005) but a lot of the principles about getting rid of spyware and securing your computer are still valid. In our case, while we had gone into Safe Mode in the past, it was only to delete the directory called out in another set of directions. But if you think about it, running your virus scanner and spyware scanners in Safe Mode is probably a good idea.

At the time I didn’t realize that we were on the cutting edge about writing about Antivirus 2009 but it seems like it was just taking off last weekend. A quick Google search for ‘antivirus 2009‘ is coming up with a lot more legitimate resources about this particular issue than there were last weekend (such as CA’s Antivirus 2009 entry) as well as a lot of other informal posts like mine.

How is everyone else doing? If anyone else has any other advice, let us know. I know there are references to some other spyware apps that will solve the problem but I guess my mindset is that Spybot and Ad-Aware will get the new definitions shortly (if they haven’t already) to address this specific threat.

Series Navigation«XP Antivirus 2008 and Antivirus 2009 - Round 2What is the difference between a computer virus and spyware?»

Popularity: 44% [?]

Share This

Posted by Matt Smith | Filed Under General 

Comments

9 Responses to “Removing Antivirus 2009 - Round 3”

  1. Debbie Hayes on July 23rd, 2008 8:03 am

    You guys are terrific! I was not familiar with Antivirus 2009 - I wasn’t sure if it was a virus, or if it was protecting the computer from a virus. Every click of the mouse led back to, “Antivirus 2009”. The laptop had all the symptoms that everyone else did, computer freezing, looping, etc., except I couldn’t go online or do anything! I did consider buying the program (big mistake!). Instead, I used my other computer to Google the problem, and ended up at your site. Spybot did not work for me, so I deleted it and downloaded another free program - AVG Free antivirus and antispyware software for Windows. It worked like a charm. The steps I took were:

    1. I started the computer in safe mode.
    2. I went to c:\program files on the computer (I did this by clicking the, “Start” button, then selecting “My Computer”, double-clicking on “Local Disk (C:)”, and clicking on, “Program Files”. Matt’s way is probably easier).
    3. I found Antivirus 2009 right away, as it was one of the first files listed, and deleted it.
    5. I restarted the computer in normal mode, and at first it was alright, but then the pop-up windows began again. I rebooted the computer in safe mode again and by searching all the computer folders, found another copy of Antivirus 2009 in my Start Menu. I deleted that one too.
    3. I re-booted the computer in normal mode and immediately installed AVG. ( I downloaded AVG (free.avg.com) on another computer, and loaded it on the infected computer with a flashdrive). AVG found the virus in my recycle bin and deleted it.

    This was yesterday, and I have not had a problem since. I was able to surf the web, open files, and just use the laptop without incident.
    I could not have done it without you guys. Thanks so much!

  2. Renita on August 6th, 2008 12:10 am

    Ok, I have yet to try this….getting ready to now after I post this. However, I’m so glad that I came across this. It’s driving us nuts over here….YES a very annoying situation.

    Outside of that….I have to say….you have one hell of a sense of humor. As annoying and serious as this problem is, we were laughing through it with the jokes. Total crack up! Will let you know how it went after we are through doing all this.

    Thanks, Ren and Jeff

  3. The REAL ja37 on August 6th, 2008 2:10 pm

    I am The Real JA37, If you read and follow these details, your pc will be clean, run clean, and stay clean. The only thing is that you may need to use safe mode if your infections are seeded deeply, and you are unable to download, update or otherwise get the tools I list here, or get them to fully run to the completion point, and the steps to safe mode are very easy, just tap the F-8 key every second untill you see the option, and select the TOP option SAFE MODE, NOT safe mode with networking support, or command prompt, you should do fine from that point.

    Hey Matt. if you dump the TOOLbars for 1, you might be thought of as somewhat intelligent. You have done a fairly good show of what the problem is.

    Although this article of yours on this subject is very late for 2.

    Number 3, NEVER BUY ANYTHING ONLINE, NEVER BUY SECURITY SOFTWARE…. USE IT — LEARN IT — then if IT IS what YOU understand, and FITS YOUR NEEDS step up to the pro versions which will have MORE options to confuse the weak users. All these companies DO NOT want you crying to them about their products messing up your computer, when after all it was you who messed it up, BUT they DO want you SAFE and CLEAN, SO they give you a SIMPLE AND FUNCTIONING VERSION FREE (not scanner that wont clean until you pay) to help you learn it before BUYING THE FULL POWER HOT RODS…..

    =====

    The DO NOT LIST;

    DO NOT ACCEPT ANY TOOL BAR DURING INSTALLATION OF ANY PROGRAM!!! REMOVE THEM ALL! UNCHECK THE BOXES! LOOK CLOSE AT EACH SCREEN!!!!!!

    Your browsers, and Operating systems all have much easier methods to do the things TOOL-BARS do, if you take 5 seconds to learnn them!

    =====

    The “A-1″ LIST;

    SpyBot S&D 1.60

    Ad-Aware (some systems wont run newer than version SE 1.06, but try for 2008 first)

    SpyWareBlaster 4.1

    Rogue Remover

    RUBotted

    aVast 4Home

    Ewido_micro

    FixVundo

    Zone Alarm Basic Firewall (older systems wont run versions above 6.0)

    All are developed by REPUTABLE groups….

    ALL MUST BE UPDATED !!! Check at a minumum of 2 times a week !!!

    ======

    FIRE FOX IS HIGH RISK SOFTWARE!!!!

    Learn about how easy it is to exploit anything java based browsers and internet access apps, and you will understand why I say this! Know the diference between lan (local area network) access programs and wan (world area network) access programs.

    ======

    Mozilla JERKS have developed a BAD EXPLOIT to make it so easy any 7 year old hacker wannabe can INFECT you with ANYTHING!!!

    It is called

    BROWSER PREFETCH

    YOU MUST DISABLE IT NOW!!!!

    Open Firefox, type in the URL box (address box) the following text exactly—

    about:config

    Then hit “ENTER”

    Now that the list has loaded, scroll down until you find—

    network.prefetch-next

    LEFT CLICK ONCE.

    The entire line will be selected.

    You will see under —STAUS—TYPE—VALUE— the following words—

    default boolean true

    You will need to change it by—

    RIGHT CLICKING ONCE

    On that SELECTED line to open the menu, then—

    CLICK ON “TOGGLE” ONCE.

    Now it should read—

    user set boolean false

    If so, your done, and now back to about 85% safe again from less intelligent hackers.

    ======

    @#!@$@#!$ YOU Mozilla lame tards for letting some teeny bopper wannabe give you that lame tard idea!!!

    ======

    Any hacker can install any virus or worm or spyware or script of their choice WITHOUT YOUR APPROVAL on YOUR PRIVATE PROPERTY, thats YOUR COMPUTER,,,, I CALL IT TRESSPASSING!@!@!@!@!@

    ======

    If you have IE 7 and installed the plug in called IE7Pro you need to go into IE7Pro Settings and DIS-able

    FASTER IE

    that is the MOZILLA BROWSER PREFETCH SCRIPT with a different name.,.,.,

    =======

    aVast 4 Home is far better than any other Anti-Virus for not so fluent computer users.

    It is fully free in 14 month periods, with program and signature file updates with in an hour of a discovery!!!!

    No other is anywhere as fast to get a patch out to their users…

    After installing, MERG the little blue balls in the SYSTEM TRAY, then in the settings DIS-able SKINS.

    SKINS ARE FOR PUNKS,,,,

    PUNKS ARE DUMB….

    Now remember to SCHEDUAL A BOOT TIME SCAN with aVast every couple weeks to do a totaly clean and deep scan of all system files, and use the options to select MOVE TO CHEST, never delete, you may find later it was an important file that got infected and if you delete it you wont be able to find the details very easyly unless you are computer savy.

    SpyBot S&D also has a way to do a BOOT time scan, but you must go into the advanced mode, or if after scaning it can’t remove something and suggests to let it run on the next start to finish removing you best accept that, and reboot right way….

    Rogue Remover will get rid of that damn rip off crap known as XP Antivirus and its variations in just seconds….

    RUBotted will help keep you from spreading that crap around by spamming everyone in your dumb address books you should NOT have…

    SPYWAREBLASTER will help keep your system from getting dupped into the pages know to assult less knowledgeable users and less watchfull users.

    FixVundo from Symantec is a simple stand-alone application to fix the effects of the malware trojan called Vundo, or Virtumonde, which is very persistant and hard to remove otherwise.
    This should be run in conjuction with Ad-Aware, Spybot S&D, and RogueRemover to be sure your system is cleaned.

    ZoneAlarm is a very good firewall and I recomend it for most users, for the way it alerts you, it will help you learn what is going on and make you aware of what needs to be done, and increase your knowledge of what to trust and not to trust. It to is free for home user.

    KEEP THESE UP TO DATE !!!

    I can’t stress the need to UPDATE BY-WEEKLY enough.

    I can’t stress the need to RUN ALL THESE BY-WEEKLY enough.

    Stay safe and verify by MORE THAN ONE SOURCE!!!

    CHECK OUT WHAT I SAY TOO ABOUT THESE PROGRAMS,,,
    (AVG, Symantec, and Trend Micro also develope AntiVirus programs but I recomend aVast by experience in helping the knowledgeable users)!

    TREND MICRO - RUBotted
    aVast Antivirus - aVast4Home
    MalwareBytes - RogueRemover
    Zone Labs - Zone Alarm Basic Firewall
    JavaCool - SpywareBlaster
    GriSoft (AVG) - Ewido_micro
    Safer Networking - SpyBot S&D
    Symantec -
    PLEASE NOTE:

    I have tested all Antivus programs with KNOWN viruses, and all will miss an occasional virus but the programs listed above all installed on one system give by far the best protection. ALSO, you should NEVER have 2 ANTI-VIRUS programs installed, it is far to easy to get false reads if you do.

    There are a few other good anti-spyware programs but they dont want you, only your money every month or every year…..

    FINALY

    Many of you have WINDOWS DEFENDER installed, and I have tested it for several months….. TOTAL THUMBS DOWN!!! It does not find any spyware, maleware, trojans, viruses, or adware UNLESS it is ANTI MICROSOFT….

    It does however seem to BLOCK all security software from REMOVING all spyware, maleware, trojans, viruses, or adwares.

    ==============

    Try useing the forums 0f wilderssecurity.com, Tom’s Harware, Major Geeks, and compare them first, then check out the ACTUAL authors of a given program not some fly by night jerk @#$ download page flooding you with ADWARE….

    =====

    Pay attention too, EXACT NAMES ARE IMPORTANT……

    [Adware] is a FAKE

    [Ad-Aware 2008] is the real deal…

    ======

    Stay Safe, Stay Clean, STAY ON TOP OF IT ALL!!!

    SO YOU DONT INFECT OTHERS!!!

  4. IT Tech Girl on August 13th, 2008 11:44 am

    I just thought I would post a little bit of assistance. We ran into this at one of our clients - needless to say this Antivirus2008/2009 install is one persistant piece of s^$%. We were on the verge of just blowing the system away and rebuilding - we did the scans with all the above programs mentioned in previous posts, but one reboot later … BOOM! back again. Until we found this great application. Malwarebytes (you can get it on downloads.com) installed that - updated it and ran a FULL scan - about an hour later, it found all occurances, removed them restarted it and going on 3 weeks now - no issues! Good luck

  5. Candice on August 14th, 2008 12:26 pm

    Where do I download the rogue remover to get rid of the antiviurs 2009?

  6. Wanda on August 26th, 2008 3:47 am

    Help! Every since I removed the antivirus 2009 my internet keeps shutting down. Only on it for a few minutes or less it shuts down. This only starting to happen after I removed the antivirus 2009. Has anyone else had this problem? I don’t know what to do and I am not very computer literate.

    Thanks in advance for any help!!

  7. Candice on September 10th, 2008 1:08 pm

    To Wanda: Maybe you should reformat your hard drive. You can do so by re-installing window if you have a copy of window. If you have the recovery disc that came with the computer, you can also use that.

  8. Jason on November 21st, 2008 12:26 am

    Just because you uninstall the AV 2009 application does not mean the spybot is gone, which is why you are more than likely still experiencing problems. Check out this URL: http://www.precisesecurity.com/files-process/2008/10/14/brastk-exe/#comment-3571

    Scroll down to comment #9 (by Jsie), his/her methods worked well for many, including myself. Just pay close attention and do exactly what it says.

    Basically there are 3 main files that are the source of the problem: brastk.exe, karna.dat, and beep.sys

    Once you follow his steps, reboot, and immediately run your preferred spyware scanner (malwarebytes, spybot, or ad-aware pro) to clean out the rest of the crap that AV 2009 dumped onto your system.

  9. Jason on November 21st, 2008 12:29 am

    Oh, one additional comment, the antivirus programs listed above are great, and I’ve always sworn by Avast because it’s great and it’s free, but recently I came across an application called Avira Antivirus which is also free and has defeated Avast as the virus net king: http://www.virusbtn.com/news/2008/09_02

Got something to say?





MyHomePoint

Having trouble keeping track of everything going on at home? Is the refrigerator organizer not cutting it anymore? We feel the same way...
Check out MyHomePoint »

Latest Blog Posts

Close
E-mail It