Advanced Virus Remover is a fake antispyware software (rogue antispyware program) that looks like an antispyware but in reality does not offer any protection to computer! Advanced Virus Remover detects fake infections, shows fake security alerts and nag screens as a method of scaring you into buying the software. Once installed, Advanced Virus Remover will be set to start automatically when you start your computer. Once running, the fake antispyware starts scanning the computer and found a lot of infections. In reality your PC is clean. All these infections do not exist on your computer, so you can safely ignore them.
When Advanced Virus Remover is running your computer will display fake security alerts from Windows taskbar stating the computer is infected. Some of the alerts:
System warning!
Continue working in unprotected mode is very dangerous.
Viruses can damage your confidential data and work on your
computer. Click here to protect your computer.
System warning!
Intercepting programs that may compromise your privacy and
harm your system have been detected on your PC.
It`s highly recommended you scan your PC right now.
Like scan fake results, these warnings are all fake and should be ignored. If your computer is infected with Advanced Virus Remover, then use these removal instructions below, which will remove Advanced Virus Remover and any other infections you may have on your computer for free.
Symptoms in a HijackThis Log
O4 – HKLM\..\Run: [winupdate.exe] C:\WINDOWS\system32\winupdate.exe
O4 – HKCU\..\Run: [Advanced Virus Remover] C:\Program Files\AdvancedVirusRemover\PAVRM.exe
O4 – HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 – HKCU\..\Run: [Advanced Virus Remover] C:\Program Files\AdvancedVirusRemover\AVR.exe
Use the following instructions to remove Advanced Virus Remover (Uninstall instructions)
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select Perform Quick Scan, then click Scan, it will start scanning your computer for Advanced Virus Remover infection. This procedure can take some time, so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected for start Advanced Virus Remover removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
Advanced Virus Remover creates the following files and folders
C:\Program Files\AdvancedVirusRemover
C:\Program Files\AdvancedVirusRemover\PAVRM.exe
C:\Documents and Settings\comp\Desktop\Advanced Virus Remover.lnk
C:\Documents and Settings\comp\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk
C:\Documents and Settings\comp\Start Menu\Advanced Virus Remover.lnk
Advanced Virus Remover creates the following registry keys and values
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advanced virus remover
I had this virus and I was unable to download any sort of program to clean it up. Also, simply renaming it, like other Rogue ware, was not working. I used HiJack This to locate the registry entries,
O4 – HKLM\..\Run: [winupdate.exe] C:\WINDOWS\system32\winupdate.exe
O4 – HKCU\..\Run: [Advanced Virus Remover] C:\Program Files\AdvancedVirusRemover\PAVRM.exe
O4 – HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 – HKCU\..\Run: [Advanced Virus Remover] C:\Program Files\AdvancedVirusRemover\AVR.exe
Once I deleted them, I was able to delte the file. Now, I have to get stronger antivirus and anti malware software.
Does anyone know if there is a portable version of HijackThis?
I used a portable version of FileAssasin to kill the original .exe, which let me back into *most* of what it had locked me out of (Command Prompt, Task Manager, etc.) but not the Registry Editor. Don’t even bother trying to install anything on the infected machine, install processes get killed very fast.
Dartigen, you can download portable version of HijackThis from here.
I cant get online to download Malwarebytes. This rogue antispyware is blocking everything. I cant use task mgr or run a command. How do I get online, please?
Terrence, try download Malwarebytes in Safe mode with networking or copy it from another PC using a flash or cd disk.