Rogue software details: Win Antispyware Center

Win Antispyware Center is a rogue security application. In order to remove it, find out what files and registry entries to look for below.

Known system changes:

Files
c:\ProgramFiles\WinAntispywareCenter\av.exe

Folders
c:\CommonPrograms\WinAntispywareCenter

Registry entries
Key: HKEY_CURRENT_USER\Software\Win Antispyware Center
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
Value: Win Antispyware Center
Data: C:\Program Files\WinAntispywareCenter\av.exe
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenu
Internet\IEXPLORE.EXE\shell\open\command
Value: (Default)
Data: “C:\Program Files\WinAntispywareCenter\av.exe” /START
“C:\Program Files\Internet Explorer\iexplore.exe”
Key: HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
Value: (Default)
Data: “C:\Program Files\WinAntispywareCenter\av.exe”
/START “%1” %*
Key: HKEY_CURRENT_USER\Software\Classes\secfile\shell
\open\command
Value: (Default)
Data: “C:\Program Files\WinAntispywareCenter\av.exe”
/START “%1” %*
Key: HKEY_CLASSES_ROOT\secfile\shell\open\command
Value: (Default)
Data: “C:\Program Files\WinAntispywareCenter\av.exe”
/START “%1” %*

Source: Lavasoft Malware Lab’s Rogue Gallery.




Share this