Win Antispyware Center is a rogue anti-spyware program that is promoted through the use of Trojans. These Trojans are found on fake video pages that state that you need an update to properly view a video and then prompts you to download and install the update on your computer. Once this Trojan is run it will download and install Win Antispyware Center onto your computer without permission. Once installed it will configure itself to start automatically when you login to Windows and then start scanning your computer. When it is done it will state that you have numerous infections, but will not allow you to remove any of them until you first purchase the program. All of the infections that Win AntiSpyware Center reports, though, do not actually exist on your computer and are only being shown to scare you into thinking that you are infected.

 

Win Antispyware Center screenshot
For more screen shots of this infection click on the image above.
There are a total of 10 images you can view.

 

While Win Antispyware Center is running it will display fake security warnings and alerts that are designed to make you think that you have a security problem on your computer. A list of alerts that you may see while this program is running include:

Critical System Alert!
Unknown software is try to take control over your system!

Malware intrusion!
Sensitive areas of your system ware found to be under attack. Spy software attack or virus infection possible. Prevent further damage or your private data will get stolen. Run an anti-spyware scan now. Click here to start.

Stealth intrusion!
Infection detected in the background. Your computer is now attacked by spyware and rogue software. Eliminate the infection safely, perform a security scan and deletion now.

System danger!
Your system security is in danger. Privacy threats detected. Spyware, keyloggers or Trojans may be working in the background right now. Perform an in-depth scan and removal now, click here.

System hacked!
Unknown program is scanning your system registry right now! Identity theft detected!

Threat detected!
Security alert! Your computer was found to be infected with privacy-threatening software. Private data may get stolen and systemmay be severe. Recover your PC from the infection right now, perform a security scan.

Severe system damage!
Your system security is in danger. Privacy threats detected. Spyware, keyloggers or Trojans may be working in the background right now. Perform an in-depth scan and removal now, click here.

Security Breach!
Beware! Spyware infection was found. Your system security is at risk. Private information may get stolen, and your PC activity may get monitored. Click for and anti-spyware scan.

System hijack!
System security threat was detected. Viruses and/or spyware may be damaging your system now. Prevent infection and data loss or stealing by running a free security scan.

Privacy alert!
Rogue malware detected in your system. Data leaks and system damage are possible. Click here for a free security scan and spyware deletion.

Privacy threat!
Spyware intrusion detected. Your system is infected. System integrity is at risk. Private data can be stolen by third parties, including credit card details and passwords. Click here to perform a security repair.

Virus infection!
System security was found to be compromised. Your computer is now infected. Attention, irreversible system changes may occur. Private data may get stolen. Click here now for an instant anti-virus scan.

Just like the scan results, none of the above alerts are real and should be ignored.

While the program is running, Win Antispyware Center will also attempt to protect itself by not allowing you to run executable programs on your computer. When you attempt to run an executable it will state that program is infected and then shut it down. The message you will see will be similar to the following:

Win Antispyware Centerhas <sic> blocked a program from accessing the internet.
Notepad is infected with Trojan-BNK.Win32.Keylogger.gen. Private data can be stolen by third parties, including credit card details and passwords.

As you can see, Win Antispyware Center was created to trick you into thinking that you have a security problem on your computer in order to scare you into purchasing it. Therefore, you should definitely not purchase this software, and if you already have, you should contact your credit card company and dispute the charge stating it is a scam. To remove this program and any related malware, please use the removal guide below.

 

Threat Classification:

• Information on Rogue Programs & Scareware

 

Advanced information:

View Win Antispyware Center files.
View Win Antispyware Center Registry Information.

 

Tools Needed for this fix:

• Malwarebytes Anti-Malware

 

Symptoms that may be in a HijackThis Log:

O4 - HKLM\..\Run: [Win Antispyware Center] C:\Program Files\WinAntispywareCenter\av.exe
O4 - HKCU\..\Run: [Win Antispyware Center] C:\Program Files\WinAntispywareCenter\av.exe

 

Guide Updates:

05/23/10 - Initial guide creation.

 

---

Automated Removal Instructions for Win Antispyware Center using Malwarebytes Anti-Malware:

 

1. Print out these instructions as we may need to close every window that is open later in the fix.
   
   
2. It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.
   
   
3. Before we can do anything we must first end the processes that belong to Win Antispyware Center so that it does not interfere with the cleaning procedure. To do this, please download RKill from the following link and save it to your desktop.
   
   RKill Download Link - (Download page will open in a new tab or browser window.)
   
   When at the download page, click on the Download Now button labeled iExplore.exe download link. When you are prompted where to save it, please save it on your desktop.
   
   
4. As this infection hides the Windows desktop, we need to open up a window that allows us to see the icons.
   
   If you are using Windows XP perform the following steps:

   Click on the Start button and then click on the Run menu item. When the Run box opens, type %UserProfile%\desktop in the Open: field and then press Enter on your keyboard.

   If you are in Windows Vista or Windows 7 perform the following steps.

   Click on the Start button and type %UserProfile%\desktop in the Search field at the bottom of the start menu. Then press Enter on your keyboard.

5. Once the Windows opens, double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with Win Antispyware Center and other Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that RKill is an infection, do not be concerned. This message is just a fake warning given by Win Antispyware Center when it terminates programs that may potentially remove it. If you run into these infections warnings that close RKill, a trick is to leave the warning on the screen and then run RKkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that RKill can terminate Win Antispyware Center . So, please try running RKill until the malware is no longer running. You will then be able to proceed with the rest of the guide. Do not reboot your computer after running RKill as the malware programs will start again.
   
   If you continue having problems running RKill, you can download the other renamed versions of RKill from the RKill download page. Both of these files are renamed copies of RKill, which you can try instead. Please note that the download page will open in a new browser window or tab.
   
   
6. Now you should download Malwarebytes Anti-Malware, or MBAM, from the following location and save it to your desktop:
   
   Malwarebytes Anti-Malware Download Link (Download page will open in a new window)
   
   


7. Once downloaded, close all programs and Windows on your computer, including this one.
   
   
8. Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MBAM onto your computer.
   
   
9. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware checked. Then click on the Finish button. If MalwareBytes' prompts you to reboot, please do not do so.
   
   
10. MBAM will now automatically start and you will see a message stating that you should update the program before performing a scan. As MBAM will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main program as shown below.
    
    
    
    
    
    
    
11. On the Scanner tab, make sure the the Perform full scan option is selected and then click on the Scan button to start scanning your computer for Win Antispyware Center related files.
    
    
12. MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.
    
    
    
    
    
    
    
13. When the scan is finished a message box will appear as shown in the image below.
    
    
    
    
    
    
    You should click on the OK button to close the message box and continue with the Win Antispyware Center removal process.
    
    
14. You will now be back at the main Scanner screen. At this point you should click on the Show Results button.
    
    
15. A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.
    
    
    
    
    
    
    
    You should now click on the Remove Selected button to remove all the listed malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.
    
    
16. When MBAM has finished removing the malware, it will open the scan log and display it in Notepad. Review the log as desired, and then close the Notepad window.
    
    
17. You can now exit the MBAM program.
    

Your computer should now be free of the Win Antispyware Center program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

 

---

 

Associated Win Antispyware Center Files:

c:\Program Files\WinAntispywareCenter\
c:\Program Files\WinAntispywareCenter\av.exe

 

Associated Win Antispyware Center Windows Registry Information:

HKEY_CURRENT_USER\Software\Classes\secfile
HKEY_CURRENT_USER\Software\Win Antispyware Center
HKEY_CLASSES_ROOT\secfile
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "C:\Program Files\WinAntispywareCenter\av.exe" /START "%1" %*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Win Antispyware Center"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Win Antispyware Center"

 

---

 

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus, Trojan, Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.