Home Malware Programs Rogue Anti-Spyware Programs Avira AntiVir Enhanced Protection Mode

Avira AntiVir Enhanced Protection Mode

Posted: July 27, 2011

ScreenshotAvira AntiVir Enhanced Protection Mode is a fake Avira program that pretends to keep your Avira-brand security software updated, even when the software has been disabled. Rogue security applications often use such attacks to create security vulnerabilities and may be accompanied by similar security-related programs being blacklisted by Avira Enhanced Protection Mode. Our SpywareRemove.com malware researchers have discovered that like many rogue anti-spyware applications Avira AntiVir Enhanced Protection Mode uses fake media updates as a primary method of infecting new PCs. If you believe that you’ve been infected by Avira Enhanced Protection Mode or a similar rogue anti-spyware program, watch for the symptoms noted below, and don't hesitate to use good anti-virus software to delete Avira Enhanced Protection Mode and related infections.

Meet the Avira Enhanced Protection Mode Fake Brand-Name Gang

Our SpywareRemove.com malware analysts have unearthed Avira AntiVir Enhanced Protection Mode's origins as a simple brand-name-switched clone of other rogue security programs that use similar techniques to hide themselves. Some of Avira AntiVir Enhanced Protection Mode's modern relatives include Norton Enhanced Protection Mode, ESET Smart Security Enhanced Protection Mode and Avast Enhanced Protection Mode. Avira AntiVir Enhanced Protection Mode and its kin use well-known brand names to pretend to be a part of your native security software packages, and even create fake messages that are related to these types of software.

Avira Enhanced Protection Mode Fake (also known as Avira AntiVir Enhanced Protection Mode Fake) will create fake update status checks that make it look like your anti-virus software databases are always up-to-date. However, it's not hard to catch the lie in Avira Enhanced Protection Mode Fake's update statistics, since Avira Enhanced Protection Mod only changes the latest update date to match the date and time of your last login.

You can also catch Avira AntiVir Enhanced Protection Mode faking your security by noting an unusual new icon in your taskbar. When clicked, this icon creates the following pop-up:

"Attention! [rogue program name] operates under enhanced protection mode. This is a temporary measure necessary for immediate response to threat from virus. No action is required from you."

This pop-up is shared between all members of Avira AntiVir Enhanced Protection Mode's little and fraudulent family of rogue anti-spyware programs, but, as you should guess, Avira AntiVir Enhanced Protection Mode has no 'enhanced' mode to offer you. Instead, this message is presented to make you believe you're safe, when the reality is as far from that as possible.

The Hard Truth of What Avira AntiVir Enhanced Protection Mode Really Does

Rather than giving your PC improved security, Avira AntiVir Enhanced Protection Mode will try to disable your official anti-virus software, including Avira products and other well-known AV brands. If your security programs appear to be inactive or display unusual messages in lieu of providing their usual functions, you should check for signs of Avira Enhanced Protection Mode or a similar infection.

Removing Avira AntiVir Enhanced Protection Mode or any other rogue security program from its family should utilize a good anti-malware program. If you find all your security applications blocked, Safe Mode or even booting from a CD will let you launch Windows without Avira Enhanced Protection Mode launching too.

Our SpywareRemove.com malware researchers have found that Avira AntiVir Enhanced Protection Mode pretends to be a Flash player update to install itself on your PC. If you always acquire your media updates from official sources, you will not have to worry about Avira Enhanced Protection Mode infecting your PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Users%\[UserName]\Downloads\OTS.exe File name: %Users%\[UserName]\Downloads\OTS.exe
File type: Executable File
Mime Type: unknown/exe
%Windows%\systemup.exe File name: %Windows%\systemup.exe
File type: Executable File
Mime Type: unknown/exe
%Windows%\sysdriver32.exe File name: %Windows%\sysdriver32.exe
File type: Executable File
Mime Type: unknown/exe
%Windows%\l1rezerv.exe File name: %Windows%\l1rezerv.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\Software\Avira AntiVir Enhanced Protection ModeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Avira AntiVir Enhanced Protection Mode"

Additional Information

The following messages's were detected:
# Message
1Avira AntiVir ENHANCED PROTECTION MODE Attention! Avira AntiVir operates under enhanced protection mode. This is temporary measure necessary for immediate response to the threat from virus. No action is required from you.

Loading...