Welcome to remove-malware.net

How to remove Av-armor.com hijacker

Malware Description:
Figuratively speaking, Av-armor.com is a new soldier in the army of browser hijackers promoting Antivirus Suite rogue application. At first sight, it may appear that Av-armor.com is a harmless official website devoted to some antivirus software. However, once you start looking into the actual essence of Av-armor.com, some additional hideous aspects come out. You don’t normally visit that site on your own. The most common way to hit Av-armor.com is via a browser redirect triggered by Antivirus Suite fake anti-spyware as it infiltrates your computer. This hijacker is also known under the name of Av-armor.microsoft.com which is not a Microsoft domain in fact. This one is Windows HOSTS file modification instance. In other words, Antivirus Suite tends to make some serious changes to the system it compromises. In this individual case, the rogueware assigns a trusty-looking (yet non-existent) domain name to an IP address affiliated with Antivirus Suite scareware propagation. Therefore, trying to visit sites on a PC injected with Antivirus Suite malcode will get you to Av-armor.microsoft.com each time. Once you visit it, you realize it’s a warning page – unfortunately, a bogus one (please see one of the images below to get a better understanding of what it looks like). Av-armor.com is going to be linked to, turning out to be the main web page of the rogue security product we mentioned. You will be typically directed to Av-armor.com/purchase URL which is meant for enabling people to fill out their payment card data and thus submit a payment for Antivirus Suite license. This is the core issue here – the malicious application tries to scare and compel you into buying its licensed copy. In this dirty activity, Antivirus Suite can hardly do without scam sites like Av-armor.com which constitute an inalienable part of the rogue’s dishonest practices. We are afraid simply avoiding Av-armor.com is not enough to keep your system safe. Like we wrote above, trojans usually redirect to Av-armor.com (Av-armor.microsoft.com) so you will need to take care of the originator of such annoying browser behavior. To handle Av-armor.com problem, you may find the tutorial below helpful.

Malware Type: Browser Hijackers

Malware Author: Antivirus Suite, Inc.

Threat Level: Critical

Advice: Immediately remove and scan for additional malware

Av-armor.com Hijacker Free Scanner and Remover: Download Now

Av-armor.com Screenshot:

Av-armor.microsoft.com Fake Internet Warning Screenshot:

How to remove Av-armor.com hijacker and affiliated threats manually:
Manual removal of Av-armor.com hijacker is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

• %Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\[random string]sysguard.exe
• %Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\[random string]ftav.exe
• %Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\[random string]tssd.exe

The registry entries that need to be removed are as follows:

• HKEY_LOCAL_MACHINE\SOFTWARE\avsuite
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1:5555″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = “.exe”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = “1″
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = “no”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyEnable” = “1″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”[random string].exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”[random string].exe”

Please, be aware that manual removal of Av-armor.com hijacker is a cumbersome process and does not always ensure complete deletion of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards. Moreover, manual interference of this kind may cause damage to the system. That’s why we strongly recommend automatic removal of Av-armor.com hijacker, which will save your time and enable avoiding any system malfunctions and guarantee the needed result.

Related Articles:

How to remove Armor Defender rogue anti-spyware