HT Logs. Tips, FAQs, Analyze.

av.exe is a harmful program.

It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program. If that does not help, then ask us for help in the Spyware removal forum.

Name: av
Filename: av.exe
Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\secfile
HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\secfile
HKEY_CURRENT_USER\Software\Win Antispyware Center
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Win Antispyware Center
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Win Antispyware Center

Command: command
Startup Type: HKLM->Run, HKCU->Run, File associations
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [Win Antispyware Center] C:\Program Files\WinAntispywareCenter\av.exe
O4 – HKCU\..\Run: [Win Antispyware Center] C:\Program Files\WinAntispywareCenter\av.exe

DDS Line:

mRun: [Win Antispyware Center] C:\Program Files\WinAntispywareCenter\av.exe
uRun: [Win Antispyware Center] C:\Program Files\WinAntispywareCenter\av.exe

Combofix/RSIT Line:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“Win Antispyware Center”=C:\Program Files\WinAntispywareCenter\av.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“Win Antispyware Center”=C:\Program Files\WinAntispywareCenter\av.exe

Description: core component of Win Antispyware Center. Win Antispyware Center is a rogue antispyware program.

How to remove: use these Win Antispyware Center removal instructions or the steps below.
1. Download fix1.zip from here, unzip it. Right click fix.inf and select Install.

2. Download OTM by OldTimer from here and save to your desktop.
Run OTM, copy,then paste the following text in “Paste Instructions for Items to be Moved” window (under the yellow bar):

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“Win Antispyware Center”=-

:Commands
[emptytemp]
[Reboot]
Click the red Moveit! button. If you are asked to reboot the machine choose Yes. When the tool is finished, it will produce a report for you.

3. Download Malwarebytes Anti-malware. Install and perform a scan.

This entry was posted on Sunday, May 23rd, 2010 at 7:36 am and is filed under File associations, O4, Rogue Antispyware/Antivirus, Run. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.