Antivirus Action Adware Removal Instructions
The Emsisoft malware research team has discoverd a new outbreak of the Antivirus Action adware. Emsisoft Anti-Malware detects this malware as Adware.Win32.AntivirusAction.
Antivirus Action is a rogue security program, this is a new variant from Antivirus IS, Security Suite, AV Security Suite, Antivirus Suite, and Antivirus Soft. A rogue application tries to trick you by displaying false positive/misleading scan results report, which says that your computer is infected with viruses or trojan, but you will not be able to delete them before you purchase.
Create new file:
- %UserProfile%\Local Settings\Temp\%random%\%random%.exe
Create/modify registry entries:
- HKEY_CURRENT_USER\software\Microsoft\Internet Explorer\Download
(dword) RunInvalidSignatures = 0×00000001 (1)
- HKEY_CURRENT_USER\software\Microsoft\Internet Explorer\PhishingFilter
(dword) EnabledV8 = 0×00000000 (0)
(dword) Enabled = 0×00000000 (0)
- HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Internet Settings
(string) ProxyOverride = <local>
- HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run
(string) qeaklkpo = %UserProfile%\Local Settings\Temp\%random%\%random%.exe
- HKEY_CURRENT_USER\software\opsmr9ibkfl
(dword) knkd = 0×00000001 (1)
(string) id = 49.4
(dword) ready = 0×00000001 (1)
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings
(dword) ProxyEnable = 0×00000001 (1)
- HKEY_CURRENT_USER\software\Microsoft\Internet Explorer\Download
(string) CheckExeSignatures = no
- HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Internet Settings
(DWORD) ProxyEnable = 0×00000001 (1)
(SZ) ProxyServer = http=127.0.0.1:29775
Screenshots:
How to remove the infection of Antivirus Action (Adware.Win32.AntivirusAction)?
To delete this malware infection, please download and install Emsisoft Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.
