Data0.Net Security Blog

The WinDefender2009 infection starts any of three ways. You can go to a corrupt porn web page, a corrupt website that promotes gambling, or you can open an attachment in a spam email. Any of those three ways will get you infected with WinDefender2009. On the porn and gambling related sites, WinDefender2009 will pretend to be a video codec or an ActiveX control.

WinDefender2009 is new on the wild web. It is almost a funny thought that a fake antivirus has upgraded itself, but that is the alarming reality. Once WinDefender2009 has its hooks into your computer you start getting alarming pop-ups tell you that your computer is infected. These pop-ups make the claim that only WinDefender2009 will remove your infection. We have seen WinDefender2009 before. WinDefender2009 is a clone. The names WinDefender2009 has been known as in the past are TotalSecure2009, TotalSecure 2009 and Total Secure 2009.

Once you click on the pop-ups your computer goes to a website with a fake scan. This fake scan will tell you files, which are really part of your operating system, are your infection. Sometimes the scan can name hundreds of files. This can be alarming for the uninformed computer user. We all want our computer to be healthy and work properly. So when faced with the possibility of such a large infection, the uninformed computer user can fall for the scam and purchase the full version of the software when suggested after the scan.


When WinDefender2009 is “purchased” you have traded your credit card information in exchange for a bundle of spyware, malware and adware. So you have paid for an infection. No just an infection though--you have paid for an infection that is difficult to remove. The spyware will monitor your behavior for personal information, log ins and passwords, which it will send to the original programmers. The adware will monitor your browsing behavior and present you with pop-up ads for products and services it deems relative to your interests and browsing habits. Your pop-up blocker will be useless against these pop-ups. In addition, the malware will run in the background and affect your computer’s performance, making it slow to start up or shut down. Your system tray icons, background and screensaver will be changed. Legitimate system files, registry keys, and DLL files will go missing, causing you to get the “Blue Screen of Death.”

WinDefender2009 is difficult to remove manually. If you miss any file, WinDefender2009 will reinstall itself on system startup. To deal with WinDefender2009 you need an antispyware program, not an antivirus. If you already have one, but you still have WinDefender2009, you should contact the makers of your program. In most cases the software companies will make a fix for any new threats their users have found. If your program claims to have removed WinDefender2009, yet it fails to do so, look for an antispyware program with a 100% removal guarantee. With new threats it can take months for all antispyware companies to come up with effective removal tools.