Antivirus 2009 Spyware Scam

Recently more are the rumors of computers getting infected with the annoying spyware called Antivirus 2009. basically this is a scam of software that install itself on your computer and then bombard you with pop-ups and alerts like the image below:

in the worst case scenario, this spyware will disable the registry, task manager, and any system configuration tool, making your efforts of removing the spyware very hard, sometimes unsuccessful.

If you haven’t got the spyware yet, I recommend running a software like spywareblaster. spywareblaster blocks websites that are infected with spyware or any other malicious code, so they don’t get installed on your computer.

setting up spywareblaster is very simple, just download it from the link provided above, install it, and run it. once it comes up click on the updates button, and check for updates. click on the protection status and on the links below click on Enable all Protection. that’s it.

now, if your computer has gotten infected with the spyware follow this instructions.

1. Disable System Restore this will prevent windows from backing-up any infected files to system restore. after you disable the system restore go to the registry by typing regedit on the RUN command. if the regedit is disable, ( you get a warning saying the registry access has been disable by the administrator) download and install this tool from symantec that will enable the registry again: Enable Registy ( right click on the link and save the file to your desktop) right-click it again and click on install.

now you should be able to open the registry, Navigate to and delete the following registry entry:

HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Run\”[32 RANDOM NUMBERS]” = “C:\Program Files\Antivirus 2009\av2009.exe”

1. Navigate to and delete the following registry subkey:
   HKEY_CURRENT_USERS\Software\[32 RANDOM NUMBERS]

exit the registry and reboot your computer.

after the computer is rebooted do a complete scan for spyware on your computer using Malwarebytes. download and install the software from here http://www.malwarebytes.org/mbam.php make sure you update the software:

after the software is updated, perform a full scan. after the scan is done, remove whatever spyware the software finds. reboot the computer if necessary. that should take care of antivirus 2009 scam.