Windows Forum

Ask something
Question Locked

you have security problem at system tray

0 helpful
46 replies

by ranjankumarsgh

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have vista PC. I m getting "you have security problem" at my system tray in every few seconds.
As well after few second it automaticall open a web page of Antivirus 2009.
Pls give right sloution to get rid of permanent.
Or how to remove it manually .or from registry.

46 replies

by thumbsup2

You have a virus and it's a very nasty one too. You may end up loosing all of your documents and having to wipe the hard drive and reinstall Windows.

Please research how to remove the virus named Antivirus 2009. There are no easy solutions. Many steps are required to attempt to rid your computer of this virus, if it's even possible at all.

by ---tk---

I would recommend backing up the data, and reinstalling Vista....

by thumbsup2

I recently attempted to get that nasty thing out of my Son's computer to no avail. Maybe I was too impatient, but it had done so much damage that I just gave up and wiped/reinstalled. That'll teach him! ;)

by dwalser

I agree that it is a nasty virus, but you do not have to wipe your hard drive and reformat. Several of the antivirus programs will now delete this virus. One of the software programs that will accomplish this is Norton Internet Security 2009. I cleaned it off my drive by using a combination of free downloads from Malwarebyte's Anti-Malware, ThreatFire, and Spybot - Search & Destroy. I found the answer by cruising several of the techie web sites. It took several of the freeware downloads (through CNet Downloads) along with rebooting, and eventually repairing my OS (Windows XP Home w/SP2).

by ken dwight

I agree with the other posts, this is a nasty infection and difficult to remove. It ends up in multiple places in the Registry, and many files involved.

But every instance I've seen of all these variations is cleaned up beautifully by the new VIPRE program from Sunbelt Software. You can download a fully functional version, good for 15 days, at no charge.

This is not a commercial, so I won't provide a download link. But it's easy enough to find. Good luck!

P. S. I agree too with the post that strongly discourages wiping the drive and reinstalling everything. While that approach may sometimes be best for other reasons, it can also be catastrophic in many cases.

by jenn.powell

My suggestion would be to find a Linux boot CD that allows you to boot to a Linux OS on top of your current OS so you can access your documents and copy them onto USB Jump Drive. Then I suggest that you re-install Vista, this way you know for sure you have eliminated the problem. Good luck.

by miller.carl

I had to kill that virus on multiple client's computers over the last month or so and yes, it's very nasty and can be a challenge. There are several variants of the virus and it's main purpose is to sit there and act as though it's an anti virus program itself, it may even pop up with a fake virus scan and it requires you to pay whatever for the program so that it can remove the virus, when In fact you are removing nothing. I've seen them where they get you in on the first payment, then require you to pay for an additional add on to remove that specific security threat.

Make no mistake, this is a completely bogus program. Do not pay anything. The virus usually finds its way onto your computer through other installations of spyware, and sometimes if you go to an infected website, it will ask you to install the program, if you click ok OR cancel, it will install, the trick is to always use the 'X' button to kill the window when you get a popup as such that is not the direct result of your own selections.

I have read that there is a Ukrainian hacker group that is responsible for this program as well as several others like it.

The best course of action is to use autoruns to determine where it's running, which will also give you the directories to delete. The rest is a matter of deleting files as well as removing registry entries (which shouldn't be done if you don't know what you are doing). Here is a good webpage that I used to kill a variation of the program called antivirus trigger.

http://www.2-spyware.com/remove-antivirustrigger.html

hope this information helps you remove the virus and understand how to prevent it in the future.

by rtfarrell

I had a similar problem, although not on Vista, but I hope this helps. It ultimately took me removing the hard-drive from the system, attaching an IDE-to-USB adapter and scanning with a clean machine. My customer had a lot more viruses than this one on it, but afterward the patient made a full recovery and I was actually able to install an anti-virus package on the computer. Damn-dest thing: I couldn't install any antivirus package which ultimately forced me to use the adapter and another computer.

Good luck.

by thumbsup2

I was using Google one day to search for something. When I clicked on one of the results, the site tried to infect me with the usual Antivirus 2009 popup. Mousing over the entire window showed that even the X was not what it appeared to be. Clicking it would have done the same thing as clicking OK or CANCEL. The safest way to get rid of the window is to use Task Manager to close all windows of the browser. When I did that, McAfee actually hollered a bit about finding the file in the browser temp folder (browser set to empty cache upon exit). Note: McAfee had not said anything about it until then. So, if you're not emptying the cache on a regular basis, you've still got the file on your hard drive.

by hughva

This virus was reported on a friend's computer recently, and I have successfully removed it in the past.
This time, however, nothing worked. Malabyte wouldn't run at all, nor would Spybot, even after I renamed them. It was difficult to get into Safe Mode.
After an hour, I elected to reinstall, as time constraints prevented me from investigating further.

by ---tk---

I would love to find out this question...

by rob miners

wouldn't have had a chance to be copied to the Root directory. I know that I have problems trying to save anything in there with UAC enabled.

2009 Virus:
I was researching for a possible answer to an unrelated question when this site popped up with possible suggestions so I clicked on the link. I was immediately presented with a Dialogue box offering to install AntiVirus2009 and I wasn't impressed that Avira didn't pick up on the two .cmd files that were inserted. I was a bit quick and didn't get the Registry command but I can imagine that it had something to do with the Run command.

spiritmythos@.org/blog/2/?t=7260667 I have deliberately modified this link so that no-one will inadvertantly copy it and run it. I stress again only run it in a test environment if you have to!

I was on my Vista PC with UAC disabled so I logged out and logged back in and ran MalWareBytes and these files were detected after clicking on the link. Avast didn't pick up on them.

Files Infected:

C:\clean.cmd (Trojan.Agent) -> Quarantined and deleted successfully.

C:\CHis.cmd (Trojan.Agent) -> Quarantined and deleted successfully.

Information on Trojan.Agent http://www.2-spyware.com/remove-trojan-agent.html

That is the hook connecting to the sinker. So I got a bright idea, I would setup a test PC with no Antivirus to see how MalWareBytes performed. It was installed and updated. I then copied the link into IE7 and clicked search without putting in www. and I then had to coax the Virus to install. It wouldn't let me save the file that it wanted to download as it would corrupt and leave off the extension .exe. It was happy enough to let me install by clicking on Run. Just to make sure that it felt as though it was home I did a restart of the PC and sure enough it was loaded in the TaskBar. I even tried a Scan and it magically found a few Viruses and then the NAGS began. Surprisingly though I was able to close them out.

I then ran MalWareBytes and it detected and removed this:

12/2/2008 3:56:10 PM
mbam-log-2008-12-02 (15-56-10).txt

Scan type: Quick Scan
Objects scanned: 43065
Time elapsed: 2 minute(s), 41 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 9

Memory Processes Infected:
C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Unloaded process successfully.
C:\WINDOWS\system32\explorer32.exe (Backdoor.PoisonIvy) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO.H) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40637362271170978229292181976443 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IEUpdate (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Antivirus 2009 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Start Menu\Antivirus 2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\winsrc.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\scui.cpl (Rogue.XPantivirus) -> Quarantined and deleted successfully.
C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Start Menu\Antivirus 2009\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\explorer32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ieupdates.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Desktop\Antivirus 2009.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.

I tried to run BitDefender but maybe I have ran it too many times as it wouldn't load for me. It couldn't update the Scan Engine. So I decided to give TREND micro a go and it has found SPYWARE_KEYL_ACTIVEKEY which can also be interpreted as Type: Spyware

Aliases: PAK:PEData (BitDefendr); Active Key Logger 3.0 (PestPatrol) I couldn't get any sense out of TREND micro's scan so I left them to it. It obviously found BitDefender which adds itself to the Registry.

I am now running KASPERSKY to see what it will find. It didn't find anything so I decided to install Avast Antivirus and let it install. It went along quite happily and Updated itself. It did a Scan but didn't find anything. So I did another trip to the infected site and ran the setup again but Avast seemed to block it afer it was supposedly installed. But on a rescan with Avast I have found another Virus. Fake Alert which was deleted. I then tried to shutdown the PC but until I did a Crtl+Alt+Del and checked for anything unfamiliar which didn't appear to be there it wouldn't shut down. I did a restart and turned the PC off. To be continued...............

Ran MalWareBytes and Avast again and it came up clean. Obviously MalWareBytes does a good job but it needs a bit of help.

by tech

im seeing these all the time and is actually easy to get rid of. End task Av2009 as it will hijack your browser while its running. Once closed go to www.malwarebytes.org and download / install / run. This will clean it off.

I highly recommend it and its free.

Ideally, if you have a 2nd pc to hand, download the install files and copy across to the infected pc.

by paul_soares

Malwarebytes Antimalware (MBAM) is a fantastic tool and is great at removing many trojans, including Antivirus 2009.

However, there is an "advanced" version of this trojan that prevents the installation of MBAM as well as other popular removal tools like Combofix, Smitfraudfix, and even Hijackthis. It also shuts these down immediately if you've already got them installed and prevents updating the db's.

There is a solution to this...at least for now! Which is:

1) open Device Manager (Control Panel, System)
2) Click the View menu and click "Show hidden devices"
3) Under the Non-plug and Play Drivers, look for TDSServ.sys (or something similar) and disable it.
4) Reboot the PC to Safe Mode.
5) Install and run CCleaner
6) Install/run MBAM and Superantispyware and you should be good to go.

by kschmidt

This nasty thing would not even allow me to install any king of clean-up programs, tried to go to Microsoft?s window updates and I would get a redirect. Finally removed the hard drive from the laptop and hung it off a pc as a slave (you need a piece of hardware to convert the laptop hard drive to an IDE connection) and was able to clean it with Malwarebytes!

by gthomas

What worked for me was to "trick" it by renaming the Malawarebytes executables (i.e. "mbam-setup.exe" to "getlost.exe") then they would run. Since this bit of nastyware hijacks your browser, you have to download the latest MalwareBytes database on a clean computer then rename that EXE and run on the infected computer.

Naturally, I used expletives for the renamed executables.

by bradshawtech

Thanks for the tip on malwarebytes.org, I will give it a try.
I have seem more than a dozen of these in the last month, they are much nastier that the ones in years past, but REMOVAL is much easier and less time involved that re-install. Some of those that I remember were: MALWARE ALARM,SPY SHERRIFF, ANTI VIRUS PRO2009, ASSENTIVE PERFORMANCE CENTER, SPYWARE STRIKER PRO, AntiSpywareXP2009 to name a few. They look professional and are well embedded, BUT REMOVABLE.

The easy way is to set up the drive as a SLAVE and then simultaneously run 2 or 3 antivirus programs (saves a lot of time). After that is finished, do the same with 2 or 3 AntiMalware programs. A few minutes removing left over folders and a quick clean of the registry and all is like new. This can all be done with a lot less user time involvement (the computer may run all night) that reinstalling windows, installing all the programs, etc. Of course, you back up the data first, but you have to remember to run full scans on that later. After every thing is clean, it is usually easier to make a NEW backup and destroy the old one.

by thumbsup2

Yes, you can get rid of it, eventually. But, it's going to take lots of time and technical expertise to do it. Removing it isn't for the faint of heart. And, you're still left with a system you need to 'repair'. Even then, are you absolutely sure you've found all of the damage it caused? Only time will tell. Personally, I would trust that it's completely fixed. I would back up my documents and format the drive. But, that's just me. My time is more presious than my customized settings that I can rebuild. :D

by jbhurwitz

This one comes in Antivirus 2005, 2006, 2007, 2008 & 2009 and each one has its own variants. It's the nastiest thing I have seen in sometime. I have seen this virus try to get into my computer from ad servers from web sites like weather.com and the like. It starts with You have a virus or somthing like that and you are then supposed to click on something. Clicking on anything once you get this screen (including the X) will almost certainly download the virus to your computer. We've found that it's actually safer to pull the RJ45 or Plug on your computer before you do anything else when you get one of these messages. Once this thing is on your machine it embeds itself all over the place. It's not fun to track down. :(

You can research this on the web. Some of the solutions work some of the time, none of them work all of the time. So unless you have a lifetime or weeks on end to play with this computer, the best thing to do is get your data off the machine - that is if you don't already have a backup and do a factory restore.

If you don't have a backup of your data, and the computer is really acting badly the easiest way to get the data off is to pull the hard drive and put it on another machine as a slave. Then go through the drive and pull your data off that way. BTW, I have sometimes been able to find and disable the virus with the drive as a slave as well. In Vista, your data should be in the user folder in the root of the drive. I would still look around the drive for any out of the ordinary data if you are using any programs that are out of the ordinary.

Once you know that you have your data off, then put the hard drive back in your machine and do a MFG's factory restore. Your user manual should tell you how to do that for your machine. Do the complete restore do not save anything or you will not be sure that the blasted thing is gone.

Your time is definately worth more than the time it will take to get this thing off your machine.

by swhitlow.public

I currently encounter this virus probably 5 or 6 times a week on various client systems. I have had a lot of success completely removing the virus using only Malwarebytes. I install the program, install the updates, run a Quick Scan in Safe Mode, and then a full scan after rebooting into normal mode. Even with a heavily infected system this process takes no more than two hours. How many of us can back up all of our data, wipe and reload windows, and restore our data (after a virus scan on the backup to ensure we're not just re-infecting the system) in two hours? And then there is the time required to reinstall all of your applications and redo all of your customizations.

Following this procedure I have not had a single system become reinfected that wasn't caused by the users doing the same thing they did to get the virus in the first place.

The only time I ever go to a full reload is when the system has been so completely damaged by the virus that it will no longer even boot to the desktop. I have only come across that three times in the last couple months.

Reloading Windows isn't a bad thing on occasion, and is sometimes a requirement when things get really bad. Too often, though, I see techs that are too quick to choose a reload for the wrong reasons.

by trohland

Hi there,

I work for Panda antivirus in South africa. I deal with this on a daily basis. Please run an active scan for me - www.activescan.com , clean all malware that it picks up. Please check your startup options > start > run > msconfig > start up tab. Disable anything that looks unhealthy. Please look in the registry HKLM_software_Ms_windows_currentversion_run Delete the dodgy keys and find the executables in windows/system32.

by laban m

I got that on several user PC's at work. The best thing I found to remove it was a program called "Malware Bytes" it completely removes all the files that are spread through out the o/s. It works very nicely!

http://www.malwarebytes.org/

by keb

download Ad-Aware, from Lavasoft.com, and/or Spybot SD and update def files.
then you Must boot into safe mode and run one or both of these. they will find it and remove it. you must be in safe mode or it will replicate itself as soon as it is removed.
I have tried this several times and always worked for me.

by thumbsup2

... It shows that a full arsenal of tools can, in fact, disable the virus. As you noted though, those tools didn't prevent it from getting there in the first place. If you read more about the virus, you'll see what system files actually get replaced too. And the anti-virus tools, even MalWareBytes, doesn't replace those files. The 'critter' is technically still on the system even though it can't run. Definitely a nasty little bug and, in most cases, not worth the man-hours it takes to get it out. :(

by rob miners

but if I need to remove Data and lets be serious nobody Backs UP, there is always something that will need to be retrieved. Even though the System appears to be clean I would take the opportunity to Backup important Data and do a complete wipe of the Hard Drive with Dariks Boot & Nuke. This would be impossible on a Notebook though. A Factory Recovery would have to suffice.

I wont remove Client Data from an infected PC until I think that the Virus is under control. There is a good chance that the AV will let an infection slip through and I could end up in all sorts of strife.

I really don't trust AV software as I have seen far too many infections on PC's with the AV currently up to date. I was dissapointed that Avast missed those two. I suppose that some protection is better than none at all.
< add a bit >

by ---tk---

nice to see you were able to beat it... however, I really don't like to say it but wouldn't using a Linux boot-able CD work to remove the users data? Then the virus technically wouldn't work, since its native home is Windows...?

by rob miners

you moving that maybe infected. Even MP3's can be infected these days. Another problem is the fact that most users fill up their Hard Drives and with the Larger Hard Drives you need access to storage to accommodate their files. I can forsee a lot of problems for users with these larger drives. If the Drive is Partitioned you have a better chance as you can just blow away the Primary Partition and reinstall without effecting their data but most of these Drives are only on a single Partition. It's a catch 22. When I first started building PC's with XP I used a 10GB Primary Partition, that was then increased to 20GB and now I use 30GB as the sofware gets bigger. From what I have seen most proprietory PC's only have a single Partition.

by megamanx

My friend had the virus too. I just used A-squared free, and installed Avira free version. They both did the trick. So when in doubt also check online scanners for free scans, now I don't want to throw all my tricks out there, just don't act like there isn't any hope.

by the dobc

You are virus infected.
Stay off the porn sites and do a google search on "remove antivirus 2009" or "smitfraud".

by harobroys

I had picked this up also. I finally formatted the C: drive after running wipe.com twice.

I always have 2 hard drives on all my computers (i build them) Using safe mode and booting from the XP disk I was able to manually back up to my D: hard drive anything i hadn't previously backed. so i didn't lose any data.

Partition your C: drive into two and after you reinstall XP then change drive letters on the CD/DVD (move it up a couple letters)and next install a second hard drive.

Install a non booting copy of XP to the second C: partition (probably named D: drive now)you should be able to select and use the second copy of XP to run your computer if you have a problem.
Put your good data and back ups on the second hard drive named E: and burn a
disc a couple times a year.
now if i could just figure out how to slip stream an image

i would thank all who replied to you it is very good info

by hughva

I'm quite good at this sort of thing, but I've had to reformat the last two PCs I've seen with this malware.
In the past, I've had success with Mbam, but newer versions just laugh at me. In both cases this was an economic decision based on the time it took, and the amount the user was able to pay.

by paul_soares

Did you remove the naughty device driver before running MBAM? With the device driver gone, it's a snap to remove Antivirus 2009 and its variants.

by harobroys

the clickable link has a trojan script under it don't click it

by rob miners

information and removal instructions has infected your PC or that your AV has flagged it.

http://www.2-spyware.com/remove-trojan-agent.html

There is no way that I would post a link to an infected site so that an ID10T would be deliberately infected.

Are there any other Peers that have clicked on this link and have an infection or has had their AV flag it.

I have just tested 3 indepent PC's by clicking on that link. Avast on 2 and AVG on another. No AV has flagged anything suspicious or detected anything on a Full Scan. MalwareBytes was run on all PC's and it came up clean as well.

What have you got to offer.

by harobroys

It set off my macafee AV.
I just installed tho and am not that familiar - so it is probably my bad. That av 2008/9 is a real pain , popped up on another pc at home after clicking a goog search item. Fortunately i didn't click on it and cleaned up ok.
If you say you checked it. i can delete the post
thanks rob

by rob miners

was for the advanced users to be able to to see how to manually manipulate the infection. I like to know what Registry Keys may be effected as well as files that have been modified. I can't help it I'm a geek.

by gruntingdwarf

I got manually rid of that virus months ago from an XP. Just some surgery would do it. Didn't even bother to run any antispyware.

I fully adhere to "trohland," the guy from SouthAfrica. He pointed out the usual key places where to look and clean.

I don't have at hand the actual steps I took back then, but seem to recall, on top of the usual points enumerated, DISABLING A WEIRD-LOOKING COMPLEMENT on the INTERNET EXPLORER, which would be the launcher of the pop-up message. This stopped the pop-up, and then I searched over the Registry for its name and deleted the keys related to it as well as the files those keys would point at.

BackupWipeoutReinstallRestoreRecustomize is last and desperate resource - files must be corrupted at such a large extent.
JMO.

This discussion is closed to new replies.