We received the file VVSNINST.EXE and detected that VVSNINST.EXE is not good.
VVSNINST.EXE is Adware. You should remove the file VVSNINST.EXE.
Kill the process VVSNINST.EXE and remove VVSNINST.EXE from Windows.
Malware Analysis of VVSNINST.EXE
Full path on a computer: %Program Files%\Audio Recorder For FREE\VVSNInst.exe
Detected by UnHackMe:
VVSNINST.EXE
Default location: %Program Files%\Audio Recorder For FREE\VVSNInst.exe
Removal Results: Success
Number of reboot: 1
VVSNINST.EXE is known as:
Adware.SaveNow, Adware.WhenU, Unwanted-Program ( 00454f261 ), Adware.SaveNow.bo, Adware.Vvsn.B, W32.SaveNow.D, Win32.WhenU, Win32:Whenu-I [PUP], not-a-virus:WebToolbar.WhenU.a, ApplicUnsaf.Adware.WhenU.SaveNow, Adware.SaveNow, WhenU.Save (v), Adware.WhenU.A.13, WhenU, Win-Adware.SaveNow.106560, Signed-AdTool.WhenU.a, Adware.ClockSync, Win32.Adware.WhenU.SaveNow, not-a-virus:WebToolbar.WhenU
VVSNINST.EXE hash:
- MD5: 3e9c72f5b57307229d75fd5b8891593d
The file tries to download information from some web sites.
How to quickly detect VVSNINST.EXE presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKLM\Software\Classes\CLSID\{1C9920E5-7623-4AAF-936B-A14BCAB742EC}\InprocServer32\: “%Program Files%\Audio Recorder For FREE\NCTAudioRecord2.dll”
- HKLM\Software\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}\InprocServer32\: “%Program Files%\Audio Recorder For FREE\NCTAudioFile2.dll”
- HKLM\Software\Classes\CLSID\{6ED74AE3-8066-4385-AABA-243E033F75A3}\InprocServer32\: “%Program Files%\Audio Recorder For FREE\NCTWMAFile2.dll”
- HKLM\Software\Classes\CLSID\{77829F14-D911-40FF-A2F0-D11DB8D6D0BC}\InprocServer32\: “%Program Files%\Audio Recorder For FREE\NCTAudioFile2.dll”
- HKLM\Software\Classes\CLSID\{A8FA2FDE-BF01-4DD9-AAFF-7BACFDCAE896}\InprocServer32\: “%Program Files%\Audio Recorder For FREE\NCTWMAFile2.dll”
- HKLM\Software\Classes\CLSID\{D24FF6DB-59CF-44D6-96B9-023A901EF476}\InprocServer32\: “%Program Files%\Audio Recorder For FREE\NCTAudioVisualization2.dll”
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VVSN: “%Program Files%\VVSN\VVSN.exe”
- HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Audio Recorder For FREE\UninstallString: “C:\PROGRA~1\AUDIOR~1\UNWISE.EXE C:\PROGRA~1\AUDIOR~1\INSTALL.LOG”
- HKLM\System\CurrentControlSet\Services\BITS\Start: 0×00000003
Folders:- %Programs%\Audio Recorder For Free
- %Program Files%\Audio Recorder For FREE
- %Program Files%\VVSN
- %Program Files%\VVSN\URL1
- %WinDir%\LastGood
- %WinDir%\LastGood\INF
Files:- %Desktop%\Audio Recorder For Free.lnk
- %Programs%\Audio Recorder For Free\Audio Recorder For FREE Help.lnk
- %Programs%\Audio Recorder For Free\Audio Recorder For FREE.lnk
- %Programs%\Audio Recorder For Free\Uninstall.lnk
- %Program Files%\Audio Recorder For FREE\fae.exe
- %Program Files%\Audio Recorder For FREE\help.chm
- %Program Files%\Audio Recorder For FREE\INSTALL.LOG
- %Program Files%\Audio Recorder For FREE\lame_enc.dll
- %Program Files%\Audio Recorder For FREE\License Agreement.txt
- %Program Files%\Audio Recorder For FREE\msvcr70.dll
- %Program Files%\Audio Recorder For FREE\NCTAudioFile2.dll
- %Program Files%\Audio Recorder For FREE\NCTAudioRecord2.dll
- %Program Files%\Audio Recorder For FREE\NCTAudioVisualization2.dll
- %Program Files%\Audio Recorder For FREE\NCTWMAFile2.dll
- %Program Files%\Audio Recorder For FREE\Save License Agreement.txt
- %Program Files%\Audio Recorder For FREE\UNWISE.EXE
- %Program Files%\Audio Recorder For FREE\VVSNInst.exe
- %Program Files%\VVSN\URL1\vsn.cfg
- %Program Files%\VVSN\vvsn.cfg
- %Program Files%\VVSN\VVSN.exe
- %WinDir%\LastGood\INF\oem14.inf
- %WinDir%\LastGood\INF\oem14.PNF