Avira Enhanced Protection Mode

Avira Enhanced Protection Mode Description


Why Is Avira Suddenly Displaying an 'Avira Enhanced Protection Mode' Message?

If your Avira anti-virus is suddenly displaying an Avira Enhanced Protection Mode message or window, what you are seeing is really the result of a malware application that disables your computer's security. The Avira Enhanced Protection Mode malware infection is often the result of having downloaded a fake update for Adobe Flash from an unsafe source. This malware invader disables your real anti-virus protection and displays a window claiming that your anti-virus is actually running in 'Enhanced Protection Mode.' Meanwhile, Avira Enhanced Protection Mode can track your online activity and relay your personal information to a third party. Also, your computer is open to attack from virtually any other source. Our ESG security researchers advise you to remove the Avira Enhanced Protection Mode malware from your computer with a fully-updated anti-malware program, to restore your Avira Anti-virus' full operation.

Recognizing the Avira Enhanced Protection Mode Malware Invader

To make its recognition and eradication as easy as possible, our ESG malware researchers have identified several key features of the Avira Enhanced Protection Mode, This malware can recognize the anti-virus on your computer and change its name and message to match it. For example, computers running the Norton Anti-Virus utility are typically infected by Norton Enhanced Protection Mode, while computers with Avast Anti-Virus will display messages from the Avast Enhanced Protection Mode malware infection. There are two features that all clones of Avira Enhanced Protection Mode malware have in common:

  1. Upon start-up, they will display an authentic-looking beige display claiming that the anti-virus databases have been updated. This message will display the current date as the date in which the last update occurred.
  2. If the computer user clicks on the fake Avira icon on his Task Bar, a red pop-up window will appear, claiming that, due to a virus threat, Avira is running in Enhanced Protection Mode, and that no action from the computer user is necessary.

Don't Fall for the Avira Enhanced Protection Mode

There is a reason why the criminals behind the Avira Enhanced Protection Mode want you to believe their scam. Our ESG security researchers consider Avira Enhanced Protection Mode a severe threat because it shuts down your anti-virus application while making you believe that your computer is still protected. Not only that, the malware invader Avira Enhanced Protection Mode can take advantage of the fact that your computer is unprotected, to monitor your online activity and steal sensitive information like credit card numbers, email passwords, and important documents.Screenshot

Technical Information

File System Details

Avira Enhanced Protection Mode creates the following file(s):
# File Name Detection Count
1 %WinDir%\sysdriver32_.exe N/A
2 %WinDir%\l1rezerv.exe N/A
3 %WinDir%\sysdriver32.exe N/A
4 %WinDir%\systemup.exe N/A
6 %WinDir%\services32.exe N/A
7 %WINDOWS%\unrar.exe N/A
8 %WINDOWS%\geoiplist N/A
9 %WINDOWS%\iplist.txt N/A
10 %WINDOWS%\proc_list1.log N/A
11 %WINDOWS%\ufa.rar N/A
12 %WINDOWS%\update.5.0 N/A
13 %WINDOWS%\front_ip_list.txt N/A
14 %WINDOWS%\info1 N/A
15 %WINDOWS%\phoenix.rar N/A
16 %WINDOWS%\ufa N/A
17 %WINDOWS%\update.2 N/A
18 %WINDOWS%\ddh_iplist.txt N/A
19 %WINDOWS%\iecheck_iplist.txt N/A
20 %WINDOWS%\phoenix N/A
21 %WINDOWS%\rpcminer.rar N/A
22 %WINDOWS%\update.1 N/A

Registry Details

Avira Enhanced Protection Mode creates the following registry entry or registry entries:
Registry key
HKEY_LOCAL_MACHINE\Software\Avira AntiVir Enhanced Protection Mode
HKCU\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Avira AntiVir Enhanced Protection Mode"

More Details on Avira Enhanced Protection Mode

The following messages associated with Avira Enhanced Protection Mode were found:
Avira operates under enhanced protection mode. This is a temporary measure necessary for immediate response to the threat from virus. No action is required from you.