Home Malware Programs Browser Hijackers Aviraprotect.com

Aviraprotect.com

Posted: April 6, 2011

Aviraprotect.com is a malicious website as well as a web browser hijacker for the same site. Although Aviraprotect.com's design and appearance are seemingly professional and benevolent, any computer that comes into contact with Aviraprotect.com is at risk of being attacked by malware. Malware may be downloaded automatically through abusing browser vulnerabilities, or Aviraprotect.com may display a fake system scan that requests that you download a rogue security program to fix fictitious system errors. Deleting Aviraprotect.com hijackers and all other applications related to this malicious website is utterly necessary to keep your PC safe and to insure the privacy of personal information like credit card data.

Aviraprotect.com Offers a Poor Trial for Any Product

As a website, Aviraprotect.com is currently known for promoting the rogue security program Antivirus Protection Trial. Antivirus Protection Trial itself is no more than a copy of other known threats like Antivirus .NET, AntiVira AV, AntiMalware GO and Antivirus Monitor. Aviraprotect.com is eager to tell you that these rogue security programs are all useful anti-virus tools, but they actually interfere with your PC and have no positive traits.

Usual signs of attack by rogue security programs related to Aviraprotect.com include:

  • Altered homepages, unusual search results, blocked website access due to strange errors or pop-ups. These are signs of a hijacked browser - be especially wary about being redirected to malicious sites.
  • The appearance of strange programs during each startup of Windows, particularly supposed anti-virus programs that offer to scan your PC. Scanning results will inevitable tell you that there are countless infections on your computer that require the expenditure of cash on your part to remove.
  • A stream of alarming infection alerts and other desktop warnings. These fake warnings will offer inaccurate information as part of the larger scam to try and convince you to purchase a registration key for the rogue security program Aviraprotect.com is marketing.

Banishing Aviraprotect.com from Your Browser

A simple visit to Aviraprotect.com is all it takes for the site to force a malicious download onto your computer. Actually giving Aviraprotect.com personal information like your credit card number is highly ill-advised, and any fraudulent charges should be disputed with the company in charge of your credit card to get the payments canceled.

Most people will only contact Aviraprotect.com unintentionally after acquiring one of the above rogue security program infections. These infections will come with multiple components, some of which are browser hijackers that redirect you to Aviraprotect.com and similar dangerous sites. Ultimately, you can't afford to trust any website you're redirected to until you're certain that your PC is clean of Aviraprotect.com's attacks.

Removing the Aviraprotect.com hijacker should be done by a method that also detects and removes potential Trojans and rogue security programs that are likely to be cooperating with the hijacker. Manually deleting the files related to Aviraprotect.com has a tendency to fail, since Aviraprotect.com will hide Aviraprotect.com's files in unusual places as well as alter the Registry.

Accessing Safe Mode will let you launch Windows with minimal or no malware interference in ordinary circumstances. After that, you can download any required updates or dedicated anti-malware programs to scan for and remove Aviraprotect.com and Aviraprotect.com's dangerous relatives.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Temp%\[RANDOM CHARACTERS]\
    2 %Temp%\[RANDOM CHARACTERS]\[RANDOM CHARACTERS].exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = '1'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = '0'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = '1'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ''HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = '127.0.0.1:33554'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.exe'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"HKEY_CURRENT_USER\Software\[RANDOM CHARACTERS]
Loading...