AntivirusMaster Info & Manual Removal Guide

Do you have AntivirusMaster?

This “AntivirusMaster Removal Guide” article will show you how to identify and remove AntivirusMaster. This guide will be updated as more information is available.

AntivirusMaster Detection Test

Run SpyHunter’s Spyware Scanner to check for AntivirusMaster infections on your PC.

AntivirusMaster Description

AntivirusMaster, Antivirus Master or AV Master, is a rogue anti-spyware program and a clone of a AntivirusXP2008, Antivirus 2009 and Antivirus 2008. AntivirusMaster may be installed onto the user’s computer system by a Trojan Zlob. Once Zlob is installed, it will display popups and system notifications stating that the computer is infected with spyware threats, in an attempt to persuade the user into purchasing the full AntivirusMaster’s commercial version. AntivirusMaster may also use its system scanner to run a fake computer scan and list false positives as a result. AntivirusMaster’s purpose is to confuse the user with non-existent threats and that to fix the problem they need AntivirusMaster’s full program to solve their problems.

Parasite Type: Rogue AntiSpyware Programs

Aliases: Antivirus Master, AV Master, AVMaster

Important Notice: Enigmasoftware.com is not associated, affiliated, sponsored or owned by the AntivirusMaster creators. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of AntivirusMaster. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, AntivirusMaster from their computer with the help of SpyHunter and/or manual removal instructions provided on this article. This article is provided “as is” and to be used for educational information purposes only.

AntivirusMaster Method of Automatic Detection

The removal of spyware such as AntivirusMaster can be a difficult process. If you regularly run a spyware scan with a good spyware remover, you can automatically detect AntivirusMaster and other Spyware, Adware, Worms, Trojans and Browser Hijackers.

To quickly detect AntivirusMaster, follow the instructions below:

Download SpyHunter’s Spyware Scanner.
Select “Start Scan” to run a full system AntivirusMaster scan.
Reboot your computer.
Run another scan to pick up any remaining AntivirusMaster infections.

** SpyHunter’s Spyware Scanner only allows you to detect AntivirusMaster and other spyware. In order to remove AntivirusMaster, we advise you to buy the full-version of SpyHunter. Weekly AntivirusMaster file updates and technical support are available with SpyHunter’s spyware remover.

AntivirusMaster Method of Infection

The following AntivirusMaster actions occur:

The Internet user surfs the Web and visits a questionable website. A large amount of rogue anti-spyware programs like AntivirusMaster are mostly pushed through adult websites.
The Internet user downloads a free video codec, such as Video ActiveX Enhancement 2.07, which comes bundled with AntivirusMaster. Freeware or shareware programs tend to come with other unwanted programs such as AntivirusMaster. Do not install any free software without reading its EULA. By simply reading a program’s EULA, you can determine whether a program you are installing has spyware bundled with it.
The Internet user is infected with the rogue anti-spyware program AntivirusMaster. AntivirusMaster runs a scan on the computer and gives a false spyware report claiming that the computer is infected with spyware. Once the scan is completed, a warning message appears that lists the spyware ‘found’ and the user has to either click on a link or a button to remove it. This deceptive tactic is an attempt to scare the Internet user into clicking on the link or button to purchase AntivirusMaster.
The Internet user closes all the fake Windows error messages and warnings and is unaware that AntivirusMaster is still running its malicious tasks in the background. AntivirusMaster reloads itself on a timer so if the Internet user closes the program it will only take a few moments until it opens again. The average Internet user does not realize when spyware has infected his/her computer until it is too late and the spyware problem has already spread throughout the computer.
Internet user opens web browser and is redirected to a rogue website. Known rogue websites that promote rogue anti-spyware programs are iesecurepages.com, ahomepcsafety.com, securitypills.com, softhomepage.com, asafetyliner.com, puresafetyhere.com, safehomesite.com, instantsafepage.com, safetyonlinepage.com, among others. The Internet user is bombard with websites that pop up messages that tries to push a product on him/her. Ignore such messages! We recommend closing these windows by clicking on the X instead of the ‘OK’ button.

AntivirusMaster Symptoms

The following AntivirusMaster symptoms occur:

AntivirusMaster displays a fake system alert similar to a Windows notification message.
A red or green flashing icon appears in your system tray. If you click on the icon, a fake system alert pops up and directs you to a rogue website similar to safetyuptodate.com. In some cases, even when you don’t click on the icon the fake system alert may still pop up.
The fake system alert promises to give you a legitimate anti-spyware program that will help you fix spyware problems, but instead it really reports false information to try to trick you into purchasing the program.
AntivirusMaster hijacks or modifies your homepage and displays new desktop shortcuts.
AntivirusMaster changes your default homepage to a different homepage and creates new unnecessary shortcuts on your desktop. Sometimes AntivirusMaster won’t even allow you to change it back to your original homepage. A website you may be redirected to is AntivirusMaster.com or other rogue websites that promote AntivirusMaster.
AntivirusMaster installs a rogue toolbar called Security Toolbar 7.1.
Security toolbar 7.1 is a rogue toolbar that comes with two green bars, one that says “block adware” and the other “remove spyware”. If you click on either of them you’re directed to a rogue anti-spyware site which can install additional malware.
AntivirusMaster bombards your PC with fake Windows warnings messages.
Even after you’ve closed all the AntivirusMaster messages or your PC has been idle for awhile, you’ll still get constant alert popups appearing on your system tray or on your screen.

AntivirusMaster Anatomy

As new AntivirusMaster spyware components are reported by our customers and our Spyware Threat Research Labs, we will update this section.

Name: install_4683_MHwzNXwwfHx8fHx8fHw_[1].exe
File Size: 927640
MD5: ee2558ab80b0f7407c3b39edbdfe26b7

Name: avm.exe
File Size: 369664
MD5: 441b6d4f70a8a1a79ea4536ef9762c88

Name: avm.exe
File Size: 370176
MD5: 4928374b639d4f095102cecdb848db66

Name: avm.exe
File Size: 412672
MD5: fc0f5c7e14a9cd57ad2ee99f9d61a02c

Name: setup.dll
File Size: 20480
MD5: df7d7e6da998c18d4f1ff78b9a229304

Name: install_4683_MHwyN3wwfHx8fHx8fHw_[1].exe
File Size: 971616
MD5: b9c0ac61b3dd44a0e7b49ca07f9fb468

Name: avm.exe
File Size: 445440
MD5: 4e04e3b1a6e82159ff8008cacabf9486

Name: PWA.exe
File Size: 395264
MD5: e36d60e0caed8c04b213fbfe76f0f565

Name: avm.exe
File Size: 461312
MD5: bba532743837f1a1aa5822ca50f4214e

AntivirusMaster Manual Removal Instructions

Use Caution! Please read the instructions below carefully. Manual removal of AntivirusMaster is a delicate procedure. Proceed at your own risk. We advise you to backup your system before you manually remove AntivirusMaster.

If you are still having problems with AntivirusMaster after completing these instructions, we recommend you download SpyHunter’s Spyware Detection Tool to safely remove AntivirusMaster.

To manually remove AntivirusMaster, follow these removal steps:

Step 1: How to Kill AntivirusMaster files using Process Explorer.

1a. How to Kill AntivirusMaster Processes.
1. Download and install Process Explorer.
2. Open Process Explorer.
3. Locate the AntivirusMaster processes listed below.
4. To kill an AntivirusMaster process, right-click the AntivirusMaster process and choose the option “Kill Process Tree”.
5. Kill the following AntivirusMaster processes:
  avm.exe
  avm.exe

Step 2: How to Delete AntivirusMaster Registry Keys and Values.

Right-click on your Desktop > select “New” option > select “Text Document” (.txt file) option.
Rename the .txt file as a .reg file and call it “Delete_Registry_
AntivirusMaster_Entities.reg”. This renamed .reg file is a command that creates a shortcut to your Windows registry and allows you to easily delete registry values.
Right-click and select the “Edit” option.
Copy and paste the AntivirusMaster keys listed below.
In the menu bar, go to “File” > select “Save” > then click the “X” button to close the file.
Double-click on the .reg file.
When the message box appears saying “Are you sure you want to add the information in C:DOCUME~1%username%DesktopDELETE~1.REG to the registry?”, click the “Yes” button.
When the message box appears saying “Information in C:DOCUME~1
%username%DesktopDELETE~1.REG has been successfully entered into the registry.”, click the “OK” button.
The AntivirusMaster registry keys have been deleted from your registry.

Copy and paste the following AntivirusMaster keys:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{d1df3517-6fd8-4198-b31b-61df201e94cf}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\avm.cpl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\avm.cpl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avm.cpl]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\avm.cpl]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\avm.cpl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\avm.cpl]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\avm.cpl]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\avm.cpl]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\avm.cpl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\avm.cpl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\avm.cpl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\avm.cpl]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\avm.cpl]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\avm.cpl]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\avm.cpl]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\avm.cpl]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\avm.cpl]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\avm.cpl]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\avm.cpl]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\avm.cpl]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\avm.cpl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\Antivirus Master.lnk]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\Antivirus Master.lnk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\avm.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\avm.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avm.exe]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\avm.exe]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\avm.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\avm.exe]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\avm.exe]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\avm.exe]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\avm.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\avm.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\avm.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\avm.exe]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\avm.exe]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\avm.exe]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\avm.exe]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\avm.exe]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\avm.exe]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\avm.exe]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\avm.exe]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\avm.exe]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\avm.exe]

Submit AntivirusMaster To Our Spyware Threat Research Labs

Since AntivirusMaster spyware components change constantly, you may come across application issues that prevent you from removing AntivirusMaster completely.

You can report AntivirusMaster spyware components by using SpyHunter’s Free Support Log System. Our Support Log System takes snapshots of all the points of execution on your operating system, allowing us to precisely identify each and any problem.

We encourage you to post your Support Logs on this article so we can help you come up with a custom fix.

Below are the instructions on how to generate Support Logs using SpyHunter.

Open SpyHunter > click on the “Generate Support Log” button > click on the “Copy to Clipboard” button to save your Support Logs > Post your Support Logs to this article.

Disclaimer

Warning!! Enigma Software Group can not be held responsible for any problems that may occur by using the information contained within this AntivirusMaster removal guide. By following any of these AntivirusMaster removal instructions, you agree to be bound by the disclaimer. If you do not agree, do not follow these AntivirusMaster removal instructions. We make no guarantees that these AntivirusMaster removal instructions will completely remove AntivirusMaster. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means. In order to effectively clean and secure your computer, we recommend you purchase our spyware remover SpyHunter or seek professional help from a computer expert.

This entry was posted by Grace Mathews on Tuesday, July 15th, 2008 at 11:56 am and is filed under Spyware Alerts. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.

Comments are closed.