Norton AntiVirus Enhanced Protection Mode

27 July 2011 Rogue 0 Comment

Norton AntiVirus Enhanced Protection Mode is a completely fake security application that has the ability to detect compromised system’s installed anti-virus program. Based on the gathered security information, this rogue software will release a warning about the enhanced operation that contains the following messages:

Norton Antivirus
Norton AntiVirus Enhanced Protection Mode
Attention!
Norton AntiVirus operates under enhanced protection mode.
This is temporary for immediate response to the threat from a virus.
No action is required from you.

It may look very legitimate but in reality this potentially unwanted program has hidden malicious purposes. Later, it will disable installed security application and declare that it is already contaminated with a virus. Norton AntiVirus Enhanced Protection Mode will then prompt user to obtain the updated version of the damaged program which is actually a bogus product. To make things clear, Norton AntiVirus Enhanced Protection Mode is not in any way associated to presently installed Norton security product. It is a total scam that tends to steal money from computer users by selling a useless software by making use of misleading marketing method. Immediately remove Norton AntiVirus Enhanced Protection Mode from the system before it can enhance its fraudulent operation.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Norton AntiVirus Enhanced Protection Mode Removal Procedures

Norton AntiVirus Enhanced Protection Mode Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected computer.
Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Norton AntiVirus Enhanced Protection Mode”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
l1rezerv.exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the system and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Norton AntiVirus Enhanced Protection Mode Virus.
4. Registry entries created by Norton AntiVirus Enhanced Protection Mode must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Norton AntiVirus Enhanced Protection Mode start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
l1rezerv.exe

7. Click Apply and restart Windows.

Additional Useful Tools

Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be get rid as well. Click here to download and run SAS Portable Scanner.

Scan with Norton Power Eraser:
A free removal tool from Norton Antivirus was developed to remove unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.

Technical Details and Additional Information:

Malicious Files Added by Norton AntiVirus Enhanced Protection Mode
%UserProfile%\[UserName]\Downloads\OTS.exe
%Windows%\l1rezerv.exe
%Windows%\systemup.exe
%Windows%\sysdriver32.exe

File Location for Windows Versions:

• %UserProfile% for Vista/7 user is C:\Users\<Current User> for Windows Vista/7, for Windows XP/2000 this is C:\Documents and Settings\<Current User>.

Norton AntiVirus Enhanced Protection Mode Registry Entries:
HKEY_LOCAL_MACHINE\Software\Avast Enhanced Protection Mode
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Avast Enhanced Protection Mode”