Welcome to remove-malware.net

How to remove Antivirus-armature.com hijacker

Malware Description:
Some of the rogue security programs existing nowadays are entirely helpless without web support from the so-called browser hijackers. Antivirus Suite is one of such scarewares, being much dependent on the use of constantly appearing new ‘official’ websites dedicated to its promotion. Antivirus-armature.com is a brand-new hijacker of Antivirus Suite. The typical situation to encounter its pranks is getting redirected to that URL. One’s browser can get forcibly diverted to Antivirus-armature.com in case the associated rogue software changes the system settings that control the web-surfing activity. There are two basic parameters responsible for this: the HOSTS file and of course browser settings. Antivirus Suite affects both of them. Regarding Windows HOSTS file, the rogueware even ventures to insert a new value in there – it’s Antivirus-armature.microsoft.com, and that is precisely the URL you hit whenever you try to visit any site. However, this URL is not even an existing one and its only purpose is to add some credibility to the shameful campaign conducted by Antivirus Suite. Summing up the info provided above, Antivirus Suite uses all of its malicious potential to paralyze your Internet browsing and make you feel doomed because of inability to go online. By the way, Antivirus-armature.microsoft.com is a warning page that attempts to denote that your Internet session is not safe. That bogus alert script is a springboard for the user to look for a way out. This solution will be prompted right there for the victim. Anyway, you will be compelled to get driven to Antivirus-armature.com where the main offer is to buy Antivirus Suite. In terms of handling Antivirus-armature.com redirect problem, you may have to do something more than just avoiding that domain. The biggest difficulty has to do with the fact that you can’t prevent your browser from being diverted unless you go ahead and resolve the main issue, i.e. the activity of rogue anti-spyware on your workstation. We are inclined to put an equality sign between Antivirus-armature.com hijacker and Antivirus Suite crimeware activity. Please get more details on this point in the tutorial below.

Malware Type: Browser Hijackers

Malware Author: Antivirus Suite, Inc.

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

Antivirus-armature.com Hijacker Free Scanner and Remover: Download Now

Antivirus-armature.com Screenshot:

Antivirus-armature.microsoft.com Fake Internet Warning Screenshot:

How to remove Antivirus-armature.com hijacker and affiliated threats manually:
Manual removal of Antivirus-armature.com hijacker is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

• %Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\[random string]sysguard.exe
• %Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\[random string]ftav.exe
• %Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\[random string]tssd.exe

The registry entries that need to be removed are as follows:

• HKEY_LOCAL_MACHINE\SOFTWARE\avsuite
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1:5555″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = “.exe”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = “1″
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = “no”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyEnable” = “1″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”[random string].exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”[random string].exe”

Please, be aware that manual removal of Antivirus-armature.com hijacker is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal of Antivirus-armature.com hijacker, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Related Articles:

How to remove Antivirus-protectsoft.microsoft.com hijacker
How to remove Antivirus Suite rogue anti-spyware