PC Security 2009 is a rogue antispyware program that distributed by malware and designed to trick you into buying the fake software by using scare tactics (fake security alerts and false positives). During installation, PC Security 2009 is set to start automatically when your computer starts and creates a few files. These files during the scan will determine as infections.
Immediately after launch, the program starts scanning the computer and found a lot of trojans and spyware that cannot be removed unless you first purchase the software. All of these infections are fake, so you can safely ignore them.
While the PC Security 2009 is running, your computer will display fake alerts, an example:
Trojan detected!
A piece of malicious code was found on your system which can
replicate itself if no action is taken. Click here to have your
system cleaned by PC Security 2009.
Also the program will show a fake Windows Security Center that will recommend you register PC Security 2009. Instead of doing so, use these PC Security 2009 removal instructions below in order to remove this infection and any associated malware from your computer.
Symptoms in a HijackThis Log
O4 – HKLM\..\Run: [PC Security 2009] “C:\Program Files\PC_Security2009\PC_Security2009.exe” /hide
Use the following instructions to remove PC Security 2009 (Uninstall instructions)
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select Perform Quick Scan, then click Scan, it will start scanning your computer for PC Security 2009 infection. This procedure can take some time, so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected for start PC Security 2009 removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
PC Security 2009 creates the following files and folders
%UserProfile%\Start Menu\Programs\PC_Security2009
c:\Program Files\PC_Security2009
c:\program files\pc_security2009\data
c:\program files\pc_security2009\Microsoft.VC80.CRT
c:\Program Files\PC_Security2009\PC_Security2009.exe
%UserProfile%\start menu\Programs\pc_security2009\PC_Security2009.lnk
%UserProfile%\start menu\Programs\pc_security2009\Uninstall.lnk
c:\program files\pc_security2009\AVEngn.dll
c:\program files\pc_security2009\htmlayout.dll
c:\program files\pc_security2009\PC_Security2009.cfg
c:\program files\pc_security2009\pthreadVC2.dll
c:\program files\pc_security2009\Uninstall.exe
c:\program files\pc_security2009\wscui.cpl
c:\program files\pc_security2009\data\daily.cvd
c:\program files\pc_security2009\microsoft.vc80.crt\Microsoft.VC80.CRT.manifest
c:\program files\pc_security2009\microsoft.vc80.crt\msvcm80.dll
c:\program files\pc_security2009\microsoft.vc80.crt\msvcp80.dll
c:\program files\pc_security2009\microsoft.vc80.crt\msvcr80.dll
c:\WINDOWS\system32\_scui.cpl
%UserProfile%\Desktop\PC_Security2009.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\PC_Security2009.lnk
PC Security 2009 creates the following registry keys and values
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pc_security2009
HKEY_LOCAL_MACHINE\SOFTWARE\PC_Security2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pc security 2009
HKEY_CURRENT_USER\Control Panel\don’t load\scui.cpl
HKEY_CURRENT_USER\Control Panel\don’t load\wscui.cpl
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel
HijackThis really works. It removed the message.
Thanks,
Good tutorial on removing this particular software product. I will be referring several friends to this site.