AntiMalware 2009 Description

AntiMalware 2009 or AntiMalware2009, is a rogue anti-spyware program. AntiMalware 2009 is usually installed in the user’s computer system with the help of Trojan Zlob or the user may have downloaded it from a malicious website. Once installed, the user may receive annoying popup notifications of imaginary spyware infections. These fake notifications redirect the user to fraudulent websites, such as AntiMalware2009.com, that sell AntiMalware 2009 as a legitimate software. AntiMalware 2009 is not able to detect nor remove any spyware infections. AntiMalware 2009 is an infection itself.

In addition, AntiMalware 2009 is able to emulate a computer system scan and trick users into believing their computer systems are flooded with spyware. The result of this scan is entirely bogus and is only meant to push users into purchasing the “full” version of a rogue software. AntiMalware 2009 may also hijack the user’s Internet browser and display a fake popup notification stating that the browser has been blocked due to the presence of malware.

AntiMalware 2009 may cause system errors and freezes. AntiMalware 2009 is a clone of eAntivirusPro and XP Protector 2009.

Type: Rogue AntiSpyware Programs

Automatic Detection of AntiMalware 2009

AntiMalware 2009 Technical Report

As new AntiMalware 2009 details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following AntiMalware 2009 files with its MD5s were created in the system:

AntiMalware 2009 has typically the following processes in memory:

• c:\Program Files\thcrkrj0etfg\msvcp71.dll
• c:\Program Files\thcrkrj0etfg\MFC71ENU.DLL
• c:\Program Files\thcrkrj0etfg\uninstall.exe
• c:\Program Files\thcrkrj0etfg\MFC71.dll
• antimalware2009.exe
• c:\Program Files\thcrkrj0etfg\thcrkrj0etfg.exe
• c:\Program Files\thcrkrj0etfg\msvcr71.dll
• c:\WINDOWS\system32\pphcjkrj0etfg.exe

AntiMalware 2009 created the following directories, files, paths:

• %AllUsersProfile%\Start Menu\Programs\AntiMalware2009
• %AppData%\AntiMalware2009
• %ProgramFiles%\AntiMalware2009

AntiMalware 2009 creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “SMthcrkrj0etfg”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\thcrkrj0etfg
• SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\AntiMalware2009
• HKEY_LOCAL_MACHINE\SOFTWARE\thcrkrj0etfg
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform “AntiMalware2009″

Important Article Disclaimer