Ultra Antivirus 2009 pretends to be a “Anti-Spyware” program, often tricking users into thinking its a legitimate program. The main goal of Ultra Antivirus 2009 is to trick users into purchasing the software, often by providing fake scan results and informing the user that the software detected threats on the computer.

But alas that is not true, and when reality kicks in; your computer is in fact fine. Ultra Antivirus 2009′s main goal is to get you to Purchase Their Product!

For gods sake DON’T DO IT!

Screenshots

Analysis Stage

Ultra Antivirus 2009 installs itself into the following folder.
c:\program files\UltraAv <- Delete this folder!

Through some analysis, I uncovered that Ultra Antivirus 2009 connects to the following server in order to retrieve new information regarding payment details.
Internet Protocol, Src: 91.208.0.223 (91.208.0.223)
Not Good ..

Removing from Startup
To remove this program from starting up when your computer starts, following these instructions

1) Click the start menu, then run
2) Type "msconfig" and hit enter
3) Click the startup Tab
4) Untick "UltraAV"
5) Reboot

The Solution

Whilst you can manually remove Spyware protector by simply deleting registry keys and files as per the Analysis stage featured above, its much easier to remove Ultra Antivirus 2009 simply by using PCTools Spyware Doctor.

%productBox%

No related posts.

All of the above are symptoms of spyware, which may have been introduced to your machine via various methods – which include activeX downloads and software you installed on your PC (such as Kazaa and other p2p programs).

You did not authorize these applications to install onto your PC – so why are they there?

For a bit of fun and games, I decided to be the test dummy. After firing up VirtualBox running a clean install of Windows XP, I proceeded to install various ‘known’ applications that included spyware. These included Kazaa, Performance Optimizer, Bonzi Buddy and XP Antivirus 2008.

After I had installed these applications, I was infected with spyware – there was no doubt about it. Here’s a few screenshots of my system;

XP Antivirus 2008 informing me that I have a ton of viruses .. *cough* fake!

Who likes my new wallpaper?

Internet Explorer Hijacked!

Some funky looking Windows processes

Removing them all

If you performed a Google search for “Anti-Spyware”, you will be bombarded with hundreds of applications which promote “Greatest protection”, “Instant spyware removal” and “Free scan now”. I decided to give two programs a whirl and there were;

NoAdware and AdwareAlert

NoAdware

NoAdware is a lightweight antispyware application designed to dig deep within your system to find traces or spyware, dialers and adware. It also has a number of PC Shields, designed to lock down certain parts of your system so that spyware cannot perform any modifications. This includes locking down your IE homepage, IE favorites and your windows hosts file.

While NoAdware managed to remove the majority of spyware found on my dummy PC, it wasn’t able to fully remove AntiVirus 2008 – which as I mentioned before is a NASTY spyware application designed to try and sell you products, whilst providing FAKE virus results.

Download NoAdware

AdwareAlert

The thing that impressed me the most about AdwareAlert is that it actually detected XP Anti-Virus in its scan results, where as NoAdware didn’t. The software promotes its “3 way protection” system, whereby AdwareAlert Scans, deletes and protects your system – pretty straightforward really. AdwareAlert also has an inbuilt quarantine system and the ability to add programs to an ignore or white list.

Overall AdwareAlert was able to clean the system and restore my dummy system to its former state.

Download AdwareAlert

No related posts.