The Emsi Software malware research team has discoverd a new outbreak of the Antivirus PC 2009 adware. a-squared Anti-Malware detects this malware as Adware.Win32.AntivirusPC2009.

Antivirus PC 2009 is a rogue scanner program. Once installed, this application will be immediately perform scan action without prior notice. This fake scanner application tries to trick you by displaying misleading scan results report, which says that your computer is infected with viruses or trojan, but you will not be able to delete them before you buy this fraud application. Be careful with this program, because it not going to protect your computer but will only spend your money.

Create new files and directories:

• %ProgramFiles%\Antivirus PC 2009\2.vbs
• %ProgramFiles%\Antivirus PC 2009\avpc2009.exe
• %ProgramFiles%\Antivirus PC 2009\avpc2009s.exe
• %ProgramFiles%\Antivirus PC 2009\bzip2.dll
• %ProgramFiles%\Antivirus PC 2009\libltdl3.dll
• %ProgramFiles%\Antivirus PC 2009\pthreadVC2.dll
• %ProgramFiles%\Antivirus PC 2009\Uninstaller.exe
• %ProgramFiles%\Antivirus PC 2009\data\daily.cvd
• %ProgramFiles%\Antivirus PC 2009\data\self.hdb
• %ProgramFiles%\Antivirus PC 2009\data\
• %ProgramFiles%\Antivirus PC 2009\quarantine\
• %UserProfile%\Desktop\Antivirus PC 2009.lnk
• %UserProfile%\Start Menu\Programs\Antivirus PC 2009.lnk

Create new registry entries:

• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Uninstall\Antivirus PC 2009
• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Run, “Antivirus PC 2009″
• HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run, “Antivirus PC 2009″

Screenshots:

How to remove the infection of Antivirus PC 2009 (Adware.Win32.AntivirusPC2009)?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

Tags: Antivirus PC 2009, Rogue

This entry was posted on Tuesday, December 29th, 2009 at 19:16 and is filed under Malware Alerts, Removal Help. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.