Antivirus 2009 is new security threat that produces clones using Trojans, such as Zlob or Vundo, and displays either fake results or exaggerated results when the program scans your computer. It can also install itself directly on your computer using a malware.

Antivirus 20009 is a new security threat in the league of rogue programs and scareware. It hails from the same family as Antivirus 2008 and Doctor Antivirus and produces more clones than any other virus. When an Antivirus 2009 infects a system, it promotes and advertises itself through fake websites as a virus removal program.

How does it spread?

Antivirus is a clone of Antivirus 2008 and produces more clones than other rouge programs. Similar to its precursors, it uses Trojans, such as Zlob or Vundo to multiply or clone itself, which prowl in porn or illicit warez websites. Once Antivirus 2009 enters the user’s system, it floods his computer with pop-ups and fake security notifications. This makes the user think that his desktop or laptop is infected with some malware, virus or spyware. Once the user clicks on the pop-up or notification, it scans the entire system and lists a number of fake virus, malware or spyware, leaving the user worried about his system’s security. These fake pop-ups and notifications lead the user to go for legitimate security tool or program. And if the user follows the notifications provided, he is bound to purchase Antivirus2009’s “licensed version”.

Here are some of the Associated Antivirus 2009 Files:

    * %UserProfile%\Desktop\Antivirus 2009.lnk
    * %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
    * %UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll
    * %UserProfile%\Start Menu\Antivirus 2009
    * %UserProfile%\Start Menu\Antivirus 2009\Antivirus 2009.lnk
    * %UserProfile%\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk
    * c:\Program Files\Antivirus 2009
    * c:\Program Files\Antivirus 2009\av2009.exe
    * c:\WINDOWS\system32\ieupdates.exe
    * c:\WINDOWS\system32\scui.cpl
    * c:\WINDOWS\system32\winsrc.dll

Antivirus 2009 in a user’s computer redirects the web-browsers to:

    * antivirus-premium-scan.com
    * webscannertools.com
    * googlescanners-360.com
    * livesecurityinfo.com
    * antivirusonlivescan.com
    * bestantivirusscan.com
    * antivirus-best.com
    * internetquarantinesite.com
    * premiumlivescan.com
    * secureclick1.com

All these websites sell the malware. These websites are not only fraudulent, but malicious as well and can add additional malwares.
Methods to prevent it:

The best way to prevent it is not to download an unidentified file or click on some pop-up. One can also block its website using hosts file: webscannertools.com.

However, the user can always go for automated or manual removal. Mentioned herewith are the steps to remove this rouge scareware from a computer:

STEP 1: Press “Ctrl + Alt + Del” keys simultaneously to open the Vista’s Task Manager.
STEP 2: Click on the “Processes” tab. Scroll down the Processes tab and click on “av2009.exe.”
STEP 3: Click on “End Process.” Repeat the same procedure for Antivirus 2009.lnk, Uninstall Antivirus.lnk, and Antivirus2009.exe.
STEP 4: Click on “Start -> Search.” Type regedit and press “Enter” key. It will open a registry window.
STEP 5: Press “F3” to open a search window. Search and delete the given entries:

    * HKEY_CURRENT_USER\Software\Antivirus
    * HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus
    * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”Antivirus” = “%ProgramFiles%\Antivirus 2009\Antvrs.exe”.

Exit the registry

STEP 6: Go to C:\ and delete the entire folder containing Antivirus 2009. It will be typically named as Antivirus 2009 or AV 2009 or AV09.
Go for RPC’s unlimited Antivirus 2009 removal program and get automated removal of this rouge program!