Virus Response Lab 2009 (Virus Response 2009) Removal Instructions

By J.J. on Sep 16, 2008 | Reply

C’mon! Virus Response Lab 2009? How nice?! I have Norton Antivirus with the latest def and it couldn’t catch the nasty b*tch.

By VirusHater on Sep 16, 2008 | Reply

i deleted virusresponselab2009.exe, but couldn’t delete AVLWarning.dll. It’s said being “in use”. Please help.

By Dennis on Sep 16, 2008 | Reply

Nothing is worse than this VirusResponse Lab 2009. I am completely lost and I need the computer to do my hw. I might have got this from an email. I don’t know. I need to fix it as soon as possible and any helps would be greatly appreciated.

By Matt on Oct 4, 2008 | Reply

I finally removed Virus Response Lab after combating for two hours. Kudos to you guys. Thanks.

By Reginald on Oct 5, 2008 | Reply

Thank you guys for the info. Finally able to remove Virus Response Lab 2009 after 2 days.Very much appreciated.

By Nat on Oct 6, 2008 | Reply

Ok ok. Tell me what I did wrong. I reboot the computer into safe mode by pressing F8. I did a search on Virus Response Lab 2008. Nothing came up. Please help. Thanks so much.

By Rod on Oct 7, 2008 | Reply

How can I remove Virus Response Lab 2009 without damaging my data? I cannot afford to lose any photos since I do not have an up-to-date backup. Thank you.

By Alex on Oct 7, 2008 | Reply

help me please, can some body or anybody give me step by step directions to get this little fucker off my cpu.

im desperate , i mean i am usually good with computers.

im lost when it comes to this.

help please…

By Scott on Oct 8, 2008 | Reply

Anybody else not finding AVLwarning.dll or VirusResponseLab.exe? I have VirusRL2009.exe under program files. Friend tried to uninstall the program from add/remove programs so not sure if it changed names or morphed.

By TheFighterX on Oct 8, 2008 | Reply

Scottie, I couldn’t find those files neither. But when I search “Antivirus 2009″ in the registry and explorer, guess what. I found a lot of files. Move them to the desktop, renamed, reboot. Now all gone!! I found this tips in one of the comments. Good luck to you.

By Nyla Vollmer on Oct 9, 2008 | Reply

I purchased this coverage on 10-7-08. I was given a code to use for Virus REsponse Lab 2009 and the cost was $52.90
I am not able to get past the sign in to utilixe this and my code is not being recognized. I would like to either cancel this order or have it fixed so my numbers work please.
Nyla Vollmer
My work e-mail where I can get responses is nvollmer@hockingcountymrdd.com

By Jon on Oct 9, 2008 | Reply

I ran every spywear fix I could find that specified it could fix VirusAntivirus 2009/VirusResponceLab. It looks like they deleted all the files, since I , nor any other program can find any, but that AVR warning is still in the tray by the clock. Otherwise, no changes in system performance. I can’t find it as a running process by any name. It’s a real ghost. Anyway, I’ve been battling for days, all files are clean, and I’m ready to back up
and reformat. Even so, I have this horrific fantacy that the damn thing will still be there. It’s VOODOO!!!!

By Andrew on Oct 9, 2008 | Reply

any one figure out how to remove the blinking icon from the tool bar?

By Ozan on Oct 10, 2008 | Reply

Well, I removed all the files myself, but again, the blinking icon is a real ghost, somehow still there.

There is one workaround though. Right click on the taskbar and click on Properties. In the Notification Area section of the taskbar tab, click customize. Under the current items there will be one which you will recognize by the picture called “no title.” Set that to “Always Hide.” If you do this once when you boot, you dont have to worry about it again. Not perfect, but the best I can figure out right now.

By pamela on Oct 10, 2008 | Reply

help!!!!!!! I have this, 3 actually false alerts. i ran spybot and the icons on tool bar still there and pop ups still poppin.

By Elisa on Oct 10, 2008 | Reply

Is there anyway to remove the blinking icon completely?

By Mathew on Oct 10, 2008 | Reply

Elisa, I believe the blinking icon is relating to Virus Response Lab 2009. If you follow the instructions to delete the virus-relating files, then the icon should be gone.

By Nathan on Oct 11, 2008 | Reply

Hey VirusHater,

I had the same problem. Have you been able to get this stupid virus off your computer? Any help would be great!

Nathan

By James on Oct 11, 2008 | Reply

Download a copy of autoruns from “http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx” and look for suspicious dlls which have no publisher. You can try just disabling them and see if that clears the icon. It worked for me, but be carefull. I think the dll was named obicx.dll on my system but I suspect this changes.

By SR3000 on Oct 12, 2008 | Reply

I found virusrl2009.exe. I followed the instructions and some very helpful suggestions in “learn how to stop process” article. As of now, I no longer see Virus Response Lab 2009 on my computer anymore. Hope this is the end of it. I don’t want to deal with this hassle anymore.

By deadonce on Oct 12, 2008 | Reply

Rod, to your question
” How can I remove Virus Response Lab 2009 without damaging my data? I cannot afford to lose any photos since I do not have an up-to-date backup.”

try copying every files or photos you need into the “my documents” folder, before performing a system restore. When u system restore, the computer should restore everything back to an earlier date except files in your “my document” folder.

By Rich on Oct 12, 2008 | Reply

I removed all files from the instructions, but still get a norton detection of the trojan horse every minute or so…

can anyone help me out?

By Ric on Oct 13, 2008 | Reply

People. it morphed. On my machine it showed up as VirRL2009.

I managed to keep it from completely comming in and got it uninstalled mostly. However, it’s got a new piggy back program with it that I think I’ll still have to fight after the above procedure. However, the above procedure helped.

By Antun on Oct 13, 2008 | Reply

molim vas ak mi netko moze pomoc. kliknem na brisanje virusa i trazi me aktivacijski kod. KOJI JE TO KOD??? AKO NETKO ZNA NEKA NAPISE MOLIM VAS!!!!!!!! UNARIJED HVALA SVIMA

By TIFFANY on Oct 13, 2008 | Reply

HOW DO I GET THIS FUCKEN THING OFF OF MY COMPUTER NOW!!!!!!!!!!!!!!!!!!!!!!!!

By mus2635 on Oct 13, 2008 | Reply

I got the variant VirRl2009 I ran opened regedit searched for the above files and then I searched for virrl2009 and deleted all the places where it was found…

then I searched my drives for VirRl2009 and deleted all the files…

after that I ran spyware doctor v6
found a lot of stange files etc. deleted them all.

and now it looks like it’s gone (will write back if it comes back )

By Judi on Oct 13, 2008 | Reply

what is VirRL2009’s Piggy Back program?

By Chris on Oct 14, 2008 | Reply

Follow mus2635’s instructions, top notch. Cheers.

By John Muench on Oct 14, 2008 | Reply

Thank you for Sysinternals. I got rid of the flashing icon. Mine was found through the sysinternals program; c:\windows\system32\oanlvs.dll. The name was found in registry HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHARED TASK SCHEDULER\IMPETUOUSITIES

By Lara_Croft on Oct 15, 2008 | Reply

Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: Trojan.Zlob
File: C:\WINDOWS\System32\675873\675873.dll
Location: Quarantine
Computer:
User:
Action taken: Clean failed : Quarantine succeeded : Access denied
Date found: Wed Oct 15 17:49:24 2008

this is sucks!!!!!!i cant even proceed to another webpages..is this a new trojan virus in this month of october!

By liz on Oct 15, 2008 | Reply

had this too. it was like 4 hours later i found a site that helped…dl smitfraudfix and follow directions it is a like saver. here is info about this damned virus

VirusResponse Lab 2009 is a new unwanted program (rogue anti-spyware) that displays exaggarated reports about security risks and spyware detections to scare users. As a result, many of deceived users may purchase commercial version of this useless software. VirusResponse Lab 2009 don’t remove spyware, it may install it through security backdoors, bypassing firewalls and antivirus protection. This program may cause system crashes and slowdowns, so we recomend to remove it without any regret.
—————

By Amanda on Oct 15, 2008 | Reply

I ran SpyHunter3 and found a bunch of stuff, but these four are giving me hell:
iebr.dll
iebt.dll
iebtm.exe
iebtmm.exe
Tried to delete them but error message pops up…
Cannot delete: Access is denied
Make sure the disk is not full or write protected and that the file is not currently in use.

Help! What do I do now?
And that stupid system alert keeps popping up, can’t get rid of it either.

By Jack on Oct 16, 2008 | Reply

Crap I just got this stupid thing today and am trying to get rid of it. Ran right through norton and changed its name so that I can’t search for it now. God I hope I can kill this thing….

By Nicholas on Oct 16, 2008 | Reply

F*ck my life!

By George Gregg on Oct 16, 2008 | Reply

If you try to delete one of these .exe. or .dll
files and you get an error, that may mean a process is running and using the file. My experience has been that if you can stop the process in Task Manager, then the file can be deleted. In my case the process in Task Manager had the same name as the file so it was easy to spot. You can try this to see if it helps. And as others have pointed out, don’t expect to see
the full name of this program in files or registry, but probably some form of abbreviation, although it is likely to have 2009 in it.

By macAV on Oct 16, 2008 | Reply

I too had a different variation: VirRL2009.

Following please find reg keys I found.

***** SPECIAL CARE WITH THE LAST ONE AS THERE IS ONLY ONE ENTRY TO BE REMOVED – THE OTHERS ARE (well may be !!!) LEGIT. ************

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}]
@=”VirRLWarningBHO Class”

[HKEY_CLASSES_ROOT\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}\InprocServer32]
@=”C:\\Program Files\\VirRL2009\\VirRLWarning.dll”
“ThreadingModel”=”Apartment”

[HKEY_CLASSES_ROOT\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}\ProgID]
@=”VirRLWarning.WarningBHO.1″

[HKEY_CLASSES_ROOT\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}\Programmable]

[HKEY_CLASSES_ROOT\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}\TypeLib]
@=”{3ED86073-2FA7-4cf4-810B-28B030671678}”

[HKEY_CLASSES_ROOT\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}\VersionIndependentProgID]
@=”VirRLWarning.WarningBHO”

____________________________________
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\VirRLWarning.WarningBHO]
@=”WarningBHO Class”

[HKEY_CLASSES_ROOT\VirRLWarning.WarningBHO\CLSID]
@=”{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}”

[HKEY_CLASSES_ROOT\VirRLWarning.WarningBHO\CurVer]
@=”VirRLWarning.WarningBHO.1″

____________________________________
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\VirRLWarning.WarningBHO.1]
@=”WarningBHO Class”

[HKEY_CLASSES_ROOT\VirRLWarning.WarningBHO.1\CLSID]
@=”{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}”

____________________________________
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A81EBFD7-0FA3-41EC-B60D-6DAE78B4D31A}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A81EBFD7-0FA3-41EC-B60D-6DAE78B4D31A}\iexplore]
“Type”=dword:00000003
“Flags”=dword:00000000
“Count”=dword:0000004f
“Time”=hex:d8,07,0a,00,04,00,10,00,0a,00,25,00,06,00,42,02

____________________________________
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}]
“NoExplorer”=dword:00000001

____________________________________
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
@=”_IBhoAppEvents”

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid]
@=”{00020420-0000-0000-C000-000000000046}”

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32]
@=”{00020420-0000-0000-C000-000000000046}”

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib]
@=”{A8954909-1F0F-41A5-A7FA-3B376D69E226}”
“Version”=”1.0″

____________________________________
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
@=”IBhoApp”

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid]
@=”{00020424-0000-0000-C000-000000000046}”

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32]
@=”{00020424-0000-0000-C000-000000000046}”

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib]
@=”{A8954909-1F0F-41A5-A7FA-3B376D69E226}”
“Version”=”1.0″

____________________________________
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0]
@=”BhoNew 1.0 Type Library”

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\win32]
@=”C:\\Program Files\\VirRL2009\\VirRLWarning.dll”

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS]
@=”0″

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR]
@=”C:\\Program Files\\VirRL2009\\”

____________________________________
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“VirRL2009″=”\”C:\\Program Files\\VirRL2009\\VirRL2009.exe\”"
****** THE ABOVE VALUE ONLY *************

By macAV on Oct 16, 2008 | Reply

Further to my previous comment I think victims have to be prepared to search around for variations as the perpetrators are constantly moving the goal posts.

By s2pidkitty on Oct 16, 2008 | Reply

It took awhile, but after manually removing all the programs and downloading spyhunter, I was able to remove the flashing icon and my Internet Explorer is working efficiently again. However, I did have to troubleshoot it with their help desk and they had me download a custom fix. Thanks spyhunter. Worth the money.

By iammetalhead123 on Oct 18, 2008 | Reply

i cant find VirusResponseLab2009.exe

By ker on Oct 18, 2008 | Reply

i hate virus response lab 2009! hate it! hate it! everything looks like a stranger to me. i don’t know what to do or how to do it. can you guys make it easier? thx.

By dandy on Oct 18, 2008 | Reply

Boot into safe mode. I was able to delete the files with good result. Virus Response Lab 2009 is gone after a long fight. thanks dude.

By beans on Oct 18, 2008 | Reply

Alright so I think I’ve gotten rid of every single dodgy file on here… Even the flashing icon in the taskbar and the annoying system problem popups are gone.

Problem NOW is that the computer still runs ridiculously slow, and I can’t even launch a single program without the system locking up outside of safe mode…

Help!

By narendra on Oct 18, 2008 | Reply

Hi Friends,
Could you please suggest me how to remove this Virus Response Lab 2009 and is there any freeware to remove this virus permeanently. Could you please send the reply ASAP.
Thanks in advance
Narendra

By Rabiteman on Oct 19, 2008 | Reply

Beans: Did you maybe remove or modify something you shouldn’t have? Try Run>cmd to open up the command prompt. Then type “sfc /SCANNOW”. This will check your system files to ensure that they’re intact. You’ll need your OS disc if anything needs repairing, mind.

TIPS FOR REMOVING THIS BLOODY PROGRAM.

Due to the polymorphic nature of this bastard, instructions such as “remove VirusResponseLab2009.exe” are of limited use (It was VirRL.exe for me and I didn’t have AVLWarning.dll either). As many people will be looking for other invasive files than those listed, here’s some tips:

1. Can’t uninstall iebtm (or whatever it’s called) and its partner because they’re running and End Process in Task Manger isn’t working? Try this: search for the .exe files listed in the Task Manger. When you find them, right click on them, choose the security tab and check the Deny All permissions box. You should now be able to end the process without them restarting and uninstall the programs. You can also use this if you have a file you aren’t sure of, but aren’t sure if you should delete. However I would recommend googling the filename first and see if any results come back indicating that it could be virus related.

2. If you can find one of the files associated with the infection, take a note of the date and time of its creation. Then go to Search choose “All files and folders” and open up “When was it modified?”. Change the tab to “Created” and do a blank search (make sure it’s set to search for hidden and system files and folders). From those results, choose View>Details, then View>Choose Details and check the “Date Created” box. You can then sort all the files by clicking on the Date Created tab at the top of window, grouping all the files created at time of infection together, ready for removal. Just scroll down/up to the files created at the time you noted. (I’m using XP, but if Vista lets you search based on time as well, just do that)

3. Getting rid of THAT flashing notification. You may have got rid of all trace of the virus, yet that fecker still might be there. Try downloading Autoruns from sysinternals.com. This let’s you take a gander at what is set to run at startup. Run it and when it’s finshed scanning, go to Options>Hide Microsoft Entries to make it easier to sift through all the info. Uncheck any box that looks suspicious. I found a dodgy looking entry under the Explorer tab, HKLM\Software\Microsoft\Windows\Currentversion\Explorer\TaskScheduler with no publisher or description called “amenity”. I think that was the source of the system tray notification.

Hopefully that can help you guys plus anyone else having problems get rid of this thing, plus it may help you if you are hit by similar infections in future.

By ryan on Oct 20, 2008 | Reply

I also found something called “smile” with the VirusResponse Lab 2009 warning sign that’s been sitting in my tray the whole time. When I ran Autoruns, I found it at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

By Ro on Oct 22, 2008 | Reply

i’m doing what everyone is saying to do, sometime i can’t find certain things, but any i do, i delete. Can someone please help me?
this is the stupidest thing
thanks

By jojo on Oct 23, 2008 | Reply

I deleted what I found and can’t fing anything else, but the lil icon next to the time is still there and the pop up keeps saying to click on it. Why can’t I find any more files, but that lil icon is still there. What am I to do?

By Eran485 on Oct 24, 2008 | Reply

If you Download the free version of Spy Hunter and find all of the items in the Registry. You can then use the Registry Editor and Kill them all off. I got rid of both Zlob and VirRL with this. I did another scan with Spy Hunter afterward and found nothing relating to the above items. So far I have not had any sketchy lag or that annoying message, so I think I am in the clear.

… I think

By Eran485 on Oct 24, 2008 | Reply

In addition to my last post.

I took that step after I had gone through the recommended steps.

Did additional file searching in relation to variations of the file names and searches relating to the time/date that the infections were picked up.

Used the autoruns tool and got rid of anything that looked suspect using my discretion (Luckily I did not get rid of anything important.)

Kudos to mus2625 and Rabitman for their helpful posts.

By Tina on Oct 24, 2008 | Reply

I had the virus response lab 2009 and i followed the directions for how to find and delete it. I found the virus response lab 2009 pretty fast by looking in my task manager, it was called virRL2009.exe. I did a search of all files and deleted two with that name. I had to stop the processes through the task manager before the main program would delete. However I still had the stupid flashing thing in my task bar. That one took some time to find, but it was called wcs.exe. It was a little more stubborn. I had to search for it, then drag it on to my desktop and rename it as a .doc then I had to restart my computer and only then would it let me delete it. I emptied the recycle and have had pop-up peace every since. Thanks to all the helpful posts. I feels good to have re-claimed my computer!!!

By Tina on Oct 24, 2008 | Reply

I also had to re-claim my home page. To do that I had to go to internet properties, then programs, manage add-ons. I found something called VirRLWarningBHOClass. I disabled it and the windows messenger under it because it didn’t have a publisher. My windows messenger still works fine, i think it’s fake or something. Thanks again for all the help, i hope i can help someone out with my 2 cents.

By René on Oct 26, 2008 | Reply

Thanks Rabiteman… Not only did I get rid of that system tray annoying notification, but cleaned a few more items that I couldn’t before. That autoruns tools is awesome.

For other users such as me, don’t forget to refresh your screen after hitting: Options>Hide Microsoft Entries. The faulty ones will popup as per Rabiteman’s instructions.

Great stuff, thanks again!

By She21 on Oct 26, 2008 | Reply

Thanks Rabiteman…Everything worked perfectly.

By Riks on Oct 26, 2008 | Reply

OK i have read all the posts on this f*cking program virus response lab 2009 and i don’t have a clue on what to do, i tried following the steps given but at step 2 i get confused so i tried skipping to step 3 and i couldn’t find any of the files. I keep getting these pop ups in the bottom right saying “infiltration alert” from this bloody virus response crap and its starting 2 piss me off i don’t have a clue what to do next SOMEONE PLEEEEEEEEEESE HELP ME!

By Bob on Oct 26, 2008 | Reply

I think i’ve finally managed to gid rid of this nasty piece of work! I followed the manual removal by checking all the files but it didn’t fix the problem, i was still getting pop-ups every minute or so…. I resorted to going into safe mode and doing a system restore returning the pc to the state it was in the day before i encountered the virus. This seems to have done the job – i’ve had peace for the last hour!! Hope this helps.

By eliel on Oct 26, 2008 | Reply

the icons in the bottom xp toolbar keep taking me to their site!!!!!!!!!!uuuggggggggg

By eliel on Oct 26, 2008 | Reply

how can i eliminate this??

By JeffMacNeill on Oct 27, 2008 | Reply

Hello I just purchased Virus resonce lab, When I did purchase you said it was $42 and when I got my confirmation it was $82. Also can’t get it to work, won’t let me activate? Please refund!

By Tina on Oct 28, 2008 | Reply

Yeah,the stupid flashing thing in the task bar. That one took some time to find, but it was called wcs.exe I had to search all files and folders for it, then drag it on to my desktop and rename it as a .doc then I had to restart my computer and only then would it finaly let me delete it. I emptied the recycle bin and have not seen it since. Good luck!

By Bruce on Oct 28, 2008 | Reply

We had Virus Response Lab 2009 hit one of our computers here at work, tried many things to get rid of it but the only thing that worked was SpyHunter, had to pay $29.95 but it cleaned it right out.

By Steve on Oct 28, 2008 | Reply

I beat the blinking yellow icon of doom by running Spyhunter freeware, using thier list of infections and their titles, I went to task manager and closed all of the listed processes…some of them respawn and spawn each other, BUT…one of them will kill the warning beacon. I have yet to get rid of the virus completely but that’s what I’ve got so far. Good luck.

By Steve on Oct 28, 2008 | Reply

Wait…the process is called wcs.exe and it probably stands for caution and warning signal…I just searched the file and I’m about to go delete it. Cheers

By James Bush on Oct 29, 2008 | Reply

Rabiteman is the man
I’ve been trying for days to get rid of that blinking icon. His idea finally worked and i didn’t have to download a sea of anti-spyware
Kudos.

By Hewgdragon on Oct 29, 2008 | Reply

Removed the Blinking Icon by following the instructions of searching for all files named “wcs.exe” and/or “wcs”…Moving them to my desktop and changing/adding an extension of “.doc”, then deleting them, and restarted PC.

Removed the annoying program by searching for all files named “virRL2009.exe” and/or “wcs”…Moving them to my desktop and changing/adding an extension of “.doc”, then deleting them, and restarted PC. (I am PC, I am PC, I am PC….)

That file name may be wrong, but when the security center comes up and starts to scan, you can look in the task bar and it is the one hogging the system…

Now, still fighting with the Homepage Changes that set it to the Security Homepage, anyone have ideas on what is causing that and how to permanently change that???

Additionally, I have a dumb “Security Toolbar 7.1″ on my IE Toolbar that I cannot remove…anyone have ideas on what is causing that and how to remove it too?

Thanks to Rabiteman (although I have no “security tab” options so I couldn’t “check the Deny All permissions box”) and others, putting it all together is really the key, and I did that by watching the Task Bar to see what processes were running, and then searched them without extensions in the search field, after going into advance to search hidden folders.

By job on Oct 30, 2008 | Reply

i tried multiple things.
things that dont work:

System reload
Anti virus
Complaining
smashing keyboards

Anyway, the simplest thing is”:
1. go to configuration, delete the software
2. then find all the files wcp, virus responder etc.
3: cut and paste em on desktop
4: put .doc behind all files
5: reboot and quickly delete all files before the apllication starts running

The only thing is i still got that freakin toolbar and homepage set.. any1 got a solver for that?

By kirstie on Oct 31, 2008 | Reply

I followed Hewgdragon’s advice, and now the flashing icon as gone. Yay!
But, when I turn on my laptop, I am still getting the VirusResponce Lab 2009 scanning thing and also many pop-ups from the bottom right hand corner of my screen. I can escape them, but they constantly pop up.
How do I get rid of these once and for all?
My Dad will kill me if he knows i got a virus on his laptop, so please help!

By LeechSlayer on Oct 31, 2008 | Reply

My friend had this POS on his system, followed instructions above to do a safe mode restore. Restored to 2 days before first symptom and that POS proof that romanians were friendly with buffaloes was gone forever.

Safemode to a few days in the past seems to be the fastest way to go.

By Sumit on Nov 1, 2008 | Reply

My VirusResponse Lab 2009 was actually nowhere to be found under the name of “VirusResponse Lab 2009″ on my PC. However, when I went to search for the Program folder of the same under C:\Program Files, I found another folder named “VResLab”. Apparently, my spyware might have morphed to this folder. Anyways, I started with the manual instructions process listed above and steps 1,2 and 3 were unsuccessful and did not yield any appropriate search results. However, step 4 (registry editing) produced positive results for some of the Keys listed above and I duly deleted them. After restarting, I found that the program was still runing. Apparently, the VResLab contained an .exe called VResLab. I terminated the process in Windows Task Manager and then subsequently deleted the .exe file.

Also, I had read in this community while researching the problem about the icon issue. As mentioned, it was due to a process called wcs.exe and it was a b****ass process which refused to be terminated in Task Manager. So I did what was reported as a possible solution. I searched for the file. Then dragged it to desktop. Renamed it to wcs.doc. Then the process wcs.exe which was nomore present as the original name could be deleted easily. Next, I also deleted wcs.doc file.

After rebooting, VResLab 2009 and the icon were gone…Voilaaa ! But it left a nasty side effect on my PC. It installed some stupid Security Toolbar 7.1 and a couple of nasty processes called “iebtm.exe” and “iebtmm.exe”. I removed both these processes in a similar fashion to what i did with wcs.exe i.e. search, dragging, renaming, terminate process and finally deleting renamed file.
I dont know how Security Toolbar 7.1 went away but I did do something apart from these things listed here. I went to Add/Remove Programs and removed “IE Explorer Bar” and “IE Browse Tool”. A small note : Before I could remove IE Browse Tool, I had to restart PC once as directed by the computer. After another reboot, the Toolbar was gone. I suppose that did the trick.
Or else, just type the keywords “Security Toolbar 7.1″ in Google and the first few entries come up all mentioning how to remove that piece of shit. I am sure one of those will work.

Now I lie exhausted on the Battlefield….Victorious !!!

By Daniel Slevin on Nov 1, 2008 | Reply

Hello JeffMacNeill, Same u, I just purchased Virus resonce lab..Did u get ur money back? I want refund also, can u help me find the way to return money? What did u do? u called them? or u ask ur bank to return money? Who is proccising this virus software

By Rabiteman on Nov 2, 2008 | Reply

Do not purchase Virus Response Lab! If you purchased it, IT WILL NOT WORK!!! This is a scam on top of the virus. Any activation codes it gives you are fake.

The ONLY software you should purchase if you don’t feel confident about attempting the manual removal is SpyHunter as that seems to work.

By Kunal on Nov 3, 2008 | Reply

I have also got the problem of the pop-up sorted only it was in my case it was the windows security alerter.
Go in the Add and remove programs there you will find it it will ask you to reboot your computer and it is gone well for me it worked……..
Thanks a lot everyone for helping me getting rid of Virus Labs 2009.

By linkie on Nov 3, 2008 | Reply

hello…….. ey plz cn sumone help me remove dis thng!!! its jst gettin in2 my nerves u knw! im fed up!

By David on Nov 6, 2008 | Reply

no need to go in registry it does that for you and the scan only takes about 10-15 mins but is worth it

By munkii on Nov 8, 2008 | Reply

wellz i ran heaps of scans and removed this .dll fille n i started the computor todaii n the virus seems to have gone. does anyone knoe how i can make sure thet this virus is gone?? cuz i dnt wanna trust this thing.

By paul on Nov 8, 2008 | Reply

get your money back and sue the mothers

By paul on Nov 8, 2008 | Reply

these people should be prsecuted maybe obama will do something about these jerks

By Kaite on Nov 8, 2008 | Reply

hi i had the same problem as you did and i found the file and now i can seem to figure out how to delete it can you help me as soon as posiable?
thanks

By Brecht on Nov 10, 2008 | Reply

Hello,

after a fierce battle of 4,5 hours the evil witch is defeated.

Thank you Rabiteman, your advice was very usefull to me

By od on Nov 11, 2008 | Reply

Search and rename (reboot then Delete)ebmkdz.dll located under C:/windows/system32/ebmkdz.dll

Also follow the advices above to clean the Registry.

Deleting the file “ebmkdz.dll” should disable the system alert Popup .

If you don’t find the ebmkdz.dll file you have a diffeent variant of the trojan.

To find the culprite dll. Go to C:\Windows\System32 and try to find it
Clue : check the dlls and find out
Is the dll is from Microsoft? If not, it is suspect go to Google and check it (if you point the mouse to a dll , it will tell you if it is Microsoft or not)

also I checked the most recent dll under system32 and search them on google for each of them. I was able to find out that ebmkdz.dll is the bad guy.

Hope it help

By Sara on Nov 12, 2008 | Reply

Has anyone requested a refund from SegPay? If so have you recieved the refund?

By Sara on Nov 12, 2008 | Reply

I called the SegPay number 1-800-990-6276. I gave them myTransaction # and last 4 digits of Credit Card Number. Said it would take 10-15 days to show on my CC statement. Just did it this a.m. so we’ll see.

Any one recieve a refund when they requested one from SegPay?

By Dave on Nov 13, 2008 | Reply

I am also having problems with this Virus Response Lab 2009
My son downloaded it and not it’s a real pain in the you know what
Any help getting rid of this would be greatly appreciated
Thank You Kindly
Dave

By Zac on Nov 15, 2008 | Reply

obama’s not guna do crap

By LWYODER on Nov 15, 2008 | Reply

I got infected when trying to download a patch to allow me to run a mov clip. Fortunately Mcafee and/or Windows Defender caught it, and I removed it right away. But the onery blinking icon was perverse. I finally stopped it by finding ebmkdz.exe in c:/windows/system32/ , dragging it to the desktop, and renaming it. After restarting, the icon was gone!!
I opened the file with notepad. In the middle of this binary file I found this line of text:

fishass.com/xzdir_12/21blowjob._xe T h e computer has been crushed!!

Explorer showed a file creation date of 1999.

By hess on Nov 16, 2008 | Reply

please tell me how to get rid of something you cant a ford

By becca on Nov 19, 2008 | Reply

I have the same problem…while trying to delete some files, it says they are in use. What do I do. Maybe there’s an answer in here somewhere, I’ll keep looking.

By daveid on Nov 24, 2008 | Reply

i just found the VIRsLab thing that was running in my task manager and when i searched it in my comp search thing it came back with 2 files i deleted both of em and 1 had a big icon which looked like limewires thing. anywathing else i should do cause this thing is driving me crazy def going to break skulls and take names

By praveen on Nov 27, 2008 | Reply

first end the process by clicking ctrl+alt+del then try again !!!!!!!

By cc on Dec 3, 2008 | Reply

has anybody deleted the virus w spy hunter?

By David on Dec 4, 2008 | Reply

hi there, can someone please help me because i can’t even get passed the log on screen of windows xp because this virus has basically shut down my entire computer….

i’m currently trying to attempt to start it in safe mode (i’m not even sure if that will work) but i can’t get to the screen that will allow me to put it into safe mode….

By Tony on Dec 5, 2008 | Reply

I’ve had this, but the folder and dll name has been changed from the article above, or possible it’s another variation.

The program still shows as being called VirusResponse Lab 2009. However, it now appears in a folder called avrlabs in Program files, and the dll is called avrlabsWarning.dll

By Tony on Dec 5, 2008 | Reply

Further to my previous comment, the registry entries that need deleted are also under the following; (in addition to th ones list in the article). I also removed anything related to avrlabs.

HKEY_CURRENT_USER\Software\avrlabs\
HKEY_CLASSES_ROOT\avrlabsWarning.WarningBHO.1
HKEY_CLASSES_ROOT\avrlabsWarning.WarningBHO

HKEY_CLASSES_ROOT\CLSID\{D695B871-8020-4041-A6D2-59F922E1B2E2}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D695B871-8020-4041-A6D2-59F922E1B2E2}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\avrlabs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\avrlabs

By MJordan on Dec 6, 2008 | Reply

If the item can’t be deleted because it is in use do all the stuff in safe mode.

By Toza on Dec 7, 2008 | Reply

This stupid program is driving me CRAZY!!!

By nevv on Dec 10, 2008 | Reply

Is there someone we all could give some money to that would kill the SOB that wrote this program?

By exhausted on Dec 10, 2008 | Reply

After many hours…I think that I have defeated the beast. There was a lot of stuff in my registry…it had VRL or BHO in the names. Also, the blinking icon was from the file 351631.dll – apparently, it is a Facebook worm. I deleted that file. Then, there was a file called pgfshvp.dll – after I moved it from the Systems32 folder (thanks to whomever here suggested looking in that folder for odd .dll files) to the desktop, renamed it, rebooted and then I could delete it. Blinking Icon…removed!

Now, I cannot get any webpages to load on my laptop, but I am working on that.

Good luck to everyone!

By Ray Callan on Dec 11, 2008 | Reply

RE : INFESTED HOMEPAGE

It would seem that this virus attacks Internet Explorer Homepage only !!!

I have Google Chrome loaded on the PC that got infected but havent been using it

Internet explorer gives me the nasty homepage
Using Google chrome — Normal service resumed…

Suggestion :
Try 1st : Download another Web browser (maybe..Mozilla Firefox/ Google Chrome)
OR
2. uninstall IE and reinstall…am trying this and will let you all know result ??

By Ja on Dec 11, 2008 | Reply

Taj “antivirus” program je virus, ne kupuj nista

By Anonymous on Dec 18, 2008 | Reply

After deleting the files and you are still getting the little icon on the taskbar after rebooting. Do a system restore back to a time before you were infected. Worked for me.

By Mac on Feb 10, 2010 | Reply

The big question would be : Why doesn’t Windows Defender find and remove this item ?