Member Avatar for chukeej

I was doing a 'search' on my winxp pc, and accidentally found this file folder C:\Program Files\MAV and mavinst.exe. i am baffled as to what this file/program could be. Anyone here..any ideas? Thanks for all your help.

  • 3 Contributors
  • 6 Replies
  • 314 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by PhilliePhan

Dani AI

Generated

Short answer: mavinst.exe is not a standard Windows core file. Older AV logs and forum scans show copies packaged as a WISE/installer archive (sometimes containing McAfee installer assets or other vendor graphics), so finding a MAV folder and a mavinst.exe outside %WINDIR%\System32 is a red flag that the file is an installer or a third‑party dropper rather than a Windows system binary. (wilderssecurity.com)

A safe, repeatable checklist to identify it without executing the file:

  • Do not run the EXE. Work from an elevated command prompt or copy the file to a clean analysis machine.
  • Check the file signature and vendor info (don’t trust only the file name). Use Sysinternals Sigcheck for a one‑shot signature/version/hash view.
  • Compute a SHA‑256 and compare it to known results or post it when asking others to check. Windows has a built‑in tool for hashes.
  • Inspect the EXE as an archive (many installers are self‑extracting): list or extract with 7‑Zip; scan internal scripts/resources with strings for URLs or vendor names.

Example commands (run on a clean PC or from a rescue environment):

certutil -hashfile "C:\Program Files\MAV\mavinst.exe" SHA256
sigcheck -i "C:\Program Files\MAV\mavinst.exe"
7z l "C:\Program Files\MAV\mavinst.exe"
strings.exe -n 8 "C:\Program Files\MAV\mavinst.exe" | findstr /i "http"

Documentation: Sigcheck, certutil, 7‑Zip SFX behavior, and Strings utility. (learn.microsoft.com)

If those tests show an unsigned file, suspicious strings, or the EXE is clearly an unrequested installer, isolate the PC and remove persistence: boot from rescue media or run a bootable scanner, disable/remove related startup entries with Autoruns, then clean with an offline/rescue scan before rebooting. If the file is signed by a known vendor and its internal files point to a legitimate installer, it may simply be leftover installer data — in that case remove it only after confirming the product is not needed. See Autoruns and common rescue‑disk workflows. (learn.microsoft.com)

Build on ’s tip about checking properties: verifying signature + hash + a quick static inspection (7‑Zip/Strings) will answer most questions without executing the file. If unsure, post the SHA‑256 and the sigcheck output when asking others for help — that’s the safest way to get a reliable second opinion.

Recommended Answers

All 6 Replies

Member Avatar for lolafuertes

Find info here

Usually this is located under %WINDIR%\System32 folder. If found elsewhere, then probably is a virus.

I'll suggest to run a full disc scan booting from a clean OS.

Hope this helps

Member Avatar for PhilliePhan

RightClick mavinst.exe and check the properties for ID info.


Due to the location of the file/folder, this is likely a component of a rogue anti-spy app.

You ought to upload mavinst.exe to http://virusscan.jotti.org/en for analysis and post back with the results.


Cheers :)
PP

Edited by PhilliePhan because: n/a
Member Avatar for chukeej

Many thanks for replies. How do I upload mavinst.exe (found in C:\Program Files\mavinst.exe) to virusscan.jotti.org to be scanned?

Member Avatar for PhilliePhan

Many thanks for replies. How do I upload mavinst.exe (found in C:\Program Files\mavinst.exe) to virusscan.jotti.org to be scanned?

Just go to Jotti or virustotal and click the browse button to navigate to the file and then click submit.

PP:)

Member Avatar for chukeej

RightClick mavinst.exe and check the properties for ID info.


Due to the location of the file/folder, this is likely a component of a rogue anti-spy app.

You ought to upload mavinst.exe to http://virusscan.jotti.org/en for analysis and post back with the results.


Cheers :)
PP

PP: Many thanks for your reply. Its been several weeks since I submitted the file to virusscan.jotti.org and never did get an answer. I did a scan with Malwarebytes/SuperAntispyware/and Avira and no virus was detected so I am hoping this means that the file is legitimate.

Member Avatar for PhilliePhan

PP: Many thanks for your reply. Its been several weeks since I submitted the file to virusscan.jotti.org and never did get an answer. I did a scan with Malwarebytes/SuperAntispyware/and Avira and no virus was detected so I am hoping this means that the file is legitimate.

The results from Jotti and Virustotal are pretty much immediate unless there is a long queue of uploaded files waiting to be scanned. Both sites tell you where you are in line - usually there is no line and your file will begin being scanned as soon as the upload is finished.
The process takes only a minute or so.

Cheers :)
PP

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.