Threat Database Rogue Anti-Spyware Program Avira Enhanced Protection Mode

Avira Enhanced Protection Mode

By ESGI Advisor in Rogue Anti-Spyware Program

Screenshot

Why Is Avira Suddenly Displaying an 'Avira Enhanced Protection Mode' Message?

If your Avira anti-virus is suddenly displaying an Avira Enhanced Protection Mode message or window, what you are seeing is really the result of a malware application that disables your computer's security. The Avira Enhanced Protection Mode malware infection is often the result of having downloaded a fake update for Adobe Flash from an unsafe source. This malware invader disables your real anti-virus protection and displays a window claiming that your anti-virus is actually running in 'Enhanced Protection Mode.' Meanwhile, Avira Enhanced Protection Mode can track your online activity and relay your personal information to a third party. Also, your computer is open to attack from virtually any other source. Our ESG security researchers advise you to remove the Avira Enhanced Protection Mode malware from your computer with a fully-updated anti-malware program, to restore your Avira Anti-virus' full operation.
 

Recognizing the Avira Enhanced Protection Mode Malware Invader

To make its recognition and eradication as easy as possible, our ESG malware researchers have identified several key features of the Avira Enhanced Protection Mode, This malware can recognize the anti-virus on your computer and change its name and message to match it. For example, computers running the Norton Anti-Virus utility are typically infected by Norton Enhanced Protection Mode, while computers with Avast Anti-Virus will display messages from the Avast Enhanced Protection Mode malware infection. There are two features that all clones of Avira Enhanced Protection Mode malware have in common:

  1. Upon start-up, they will display an authentic-looking beige display claiming that the anti-virus databases have been updated. This message will display the current date as the date in which the last update occurred.
  2. If the computer user clicks on the fake Avira icon on his Task Bar, a red pop-up window will appear, claiming that, due to a virus threat, Avira is running in Enhanced Protection Mode, and that no action from the computer user is necessary.

Don’t Fall for the Avira Enhanced Protection Mode

There is a reason why the criminals behind the Avira Enhanced Protection Mode want you to believe their scam. Our ESG security researchers consider Avira Enhanced Protection Mode a severe threat because it shuts down your anti-virus application while making you believe that your computer is still protected. Not only that, the malware invader Avira Enhanced Protection Mode can take advantage of the fact that your computer is unprotected, to monitor your online activity and steal sensitive information like credit card numbers, email passwords, and important documents.Screenshot

File System Details

Avira Enhanced Protection Mode may create the following file(s):
# File Name Detections
1. %WinDir%\sysdriver32_.exe
2. %WinDir%\l1rezerv.exe
3. %WinDir%\sysdriver32.exe
4. %WinDir%\systemup.exe
5. %TempDir%\[RANDOM CHARACTERS].exe
6. %WinDir%\services32.exe
7. %WINDOWS%\unrar.exe
8. %WINDOWS%\geoiplist
9. %WINDOWS%\iplist.txt
10. %WINDOWS%\proc_list1.log
11. %WINDOWS%\ufa.rar
12. %WINDOWS%\update.5.0
13. %WINDOWS%\front_ip_list.txt
14. %WINDOWS%\info1
15. %WINDOWS%\phoenix.rar
16. %WINDOWS%\ufa
17. %WINDOWS%\update.2
18. %WINDOWS%\ddh_iplist.txt
19. %WINDOWS%\iecheck_iplist.txt
20. %WINDOWS%\phoenix
21. %WINDOWS%\rpcminer.rar
22. %WINDOWS%\update.1

Registry Details

Avira Enhanced Protection Mode may create the following registry entry or registry entries:
HKLM\SOFTWARE\sysdriver32.exe
HKEY_LOCAL_MACHINE\Software\Avira AntiVir Enhanced Protection Mode
HKLM\SYSTEM\CurrentControlSet\Services\srvsysdriver32
HKCU\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"
HKLM\SOFTWARE\systeminfog
HKLM\SOFTWARE\systemdrv64
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Avira AntiVir Enhanced Protection Mode"

Messages

The following messages associated with Avira Enhanced Protection Mode were found:

Attention!
Avira operates under enhanced protection mode. This is a temporary measure necessary for immediate response to the threat from virus. No action is required from you.

Trending

Most Viewed

Loading...