Antivirart.com

Antivirart.com is one of many malicious websites that use the rogue security program Antivirus Protection to defraud you of your money and computer security. Antivirus Protection's eighty-dollar cost is in no way an indicator of high-quality, since this rogue anti-virus program will block other applications, spout fake alerts and even hijack your browser to redirect you to Antivirart.com and other dangerous sites. Removing Antivirart.com-related software and staying far away from Antivirart.com are both mandatory for insuring the safekeeping of your computer and your finances.

A Different URL for a Not-So-Different Threat

The star of Antivirart.com's website, Antivirus Protection (also known as Antivirus Protection Trial) is just one more rogue security program using a simple name switch to avoid being identified. Other such threats related to Antivirart.com's malicious software include AntiVira AV, Antivirus .NET and Antivirus Monitor. Even Antivirart.com is just one of many similar websites marketing dozens of spin-offs of the same fraudulent product; related websites include Antivirvip.net and Antivirea.com.

Visiting any one of these many websites, like Antivirart.com, may infect you with Antivirus Protection or one of Antivirus Protection's many clones. By abusing security holes in browsers Antivirart.com can force you to download a rogue security program without requesting your permission or even telling you that the download is happening.

For many people, the first sign of Antivirart.com attacking their computer is the appearance of warnings like these:

Windows Security Alert
Windows reports that computer is infected. Antivirus software helps to protect your computer against viruses and other security threats. Click here for the scan your computer. Your system might be at risk now.

Security Alert
Virus Alert!
Application can't be started! The file [application executable] is damaged. Do you want to activate your anti-virus software now?

Antivirart.com-related infections do not damage your files; instead, Antivirus Protection stops programs from running and then tells you that Antivirus Protection can fix the problem – if you're willing to pay for the solution. The reality of the situation, of course, is that Antivirart.com programs can't detect or remove any malware, and all their system alerts are fake.

What You Can Do to Beat Antivirart.com

Exposure to Antivirart.com may also cause your web browser to behave in strange ways; you may be redirected to Antivirart.com, experience errors that stop you from visiting normal websites or see your homepage changed to Antivirart.com.

Between browser hijacks and malfunctioning programs, it's difficult to remove Antivirart.com threats without first stopping them from running. The usual method of accomplishing this is to switch to Safe Mode, which can be done from the menu accessed with F8 during system startup (but before Windows has begun to load).

From a Safe Mode environment, you can easily remove Antivirart.com software by using high-quality anti-malware scanners. Try to avoid deleting Antivirart.com threats by doing the job yourself, since this task is difficult without the help of experts and can cause other problems for your PC.

File System Modifications

• The following files were created in the system:
  

  #	File Name
  1	%Temp%\[RANDOM CHARACTERS]\
  2	%Temp%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe

Registry Modifications

• The following newly produced Registry Values are:
  HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = '1'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = 'http=127.0.0.1:59274'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.exe'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”HKEY_CURRENT_USER\Software\[RANDOM CHARACTERS]