Should I block it?

No, this file is 100% safe to run.

Additional versions

10.00.01.59	82.61%
10.00.01.59	4.35%
10.00.01.43	4.35%
9.00.01.32	4.35%
9.00.01.26	4.35%

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegSetValueExW, RegDeleteValueW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegQueryValueExA, RegCreateKeyExW, RegQueryValueExW, RegCloseKey, RegOpenKeyExW, GetSecurityDescriptorDacl, AdjustTokenPrivileges, BuildExplicitAccessWithNameW, FreeSid, SetEntriesInAclW, SetSecurityInfo, AllocateAndInitializeSid, DuplicateTokenEx, GetSecurityInfo, LookupPrivilegeValueW, SetTokenInformation, CreateProcessAsUserW, EqualSid, GetTokenInformation, GetSidSubAuthorityCount, GetUserNameW, GetSidSubAuthority, OpenProcessToken, GetSidIdentifierAuthority, LookupAccountSidW, ReportEventW, RegisterServiceCtrlHandlerW, SetServiceStatus, DeregisterEventSource, StartServiceCtrlDispatcherW, RegisterEventSourceW, QueryServiceStatus, StartServiceW, OpenServiceW, OpenSCManagerW, CloseServiceHandle, RegOpenKeyExA

kernel32.dll

GetDateFormatW, CopyFileW, GetTimeFormatW, GetCurrentProcess, OpenProcess, GetStartupInfoW, Process32FirstW, Process32NextW, CreateToolhelp32Snapshot, lstrcpynW, lstrlenW, MoveFileW, CreateSemaphoreW, SetFileAttributesW, DeviceIoControl, WaitForMultipleObjects, ConnectNamedPipe, GetModuleHandleW, CreateNamedPipeW, GetVersionExW, GetOverlappedResult, SetLastError, QueryPerformanceFrequency, GetWindowsDirectoryW, WaitForSingleObject, SetEvent, GetLastError, QueryPerformanceCounter, ReleaseSemaphore, GetTickCount, GetExitCodeProcess, GetComputerNameW, SetErrorMode, DeleteFileW, GetCurrentThreadId, GetPrivateProfileIntW, IsBadReadPtr, GetSystemTimeAsFileTime, InterlockedDecrement, InterlockedIncrement, DeleteCriticalSection, QueryDosDeviceW, RemoveDirectoryW, EnterCriticalSection, GetTempPathW, WritePrivateProfileStringW, ReadFile, LeaveCriticalSection, InitializeCriticalSection, WriteFile, GetPrivateProfileStringW, SetEndOfFile, SetFilePointer, CreateMutexW, GetFileSize, GetCurrentProcessId, InterlockedExchangeAdd, GetLocalTime, InterlockedCompareExchange, OpenEventW, LocalAlloc, Sleep, GetProcAddress, GetModuleFileNameW, LoadLibraryW, FreeLibrary, ExpandEnvironmentStringsA, lstrlenA, MultiByteToWideChar, GetExitCodeThread, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoA, InterlockedExchange, LoadLibraryA, GetFileAttributesW, LoadLibraryExW, VerSetConditionMask, VerifyVersionInfoW, CreateEventW, CloseHandle, FormatMessageW, LocalFree, FindFirstFileW, CreateDirectoryW, CreateFileW, FindClose, ResetEvent, CreateProcessW, FindNextFileW

msvcp90.dll

DllMain

msvcr90.dll

DllMain

ole32.dll

OleRun, CoCreateInstance, CLSIDFromProgID, CLSIDFromString, CoUninitialize, CoInitialize

shell32.dll

ShellExecuteW

shlwapi.dll

PathIsDirectoryW

user32.dll

CharUpperW, wsprintfW, LoadStringW, GetForegroundWindow, OemToCharBuffW

version.dll

GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

avguard.exe

AntiVir Desktop by Avira GmbH (Signed)

Remove avguard.exe

Version:	9.00.01.26
MD5:	81e58f368d62ec818f49d1c5cf3854c3
SHA1:	abee374db6550732b5716eab0e62043f03bc06e7
SHA256:	2a45de780713fbdcac73f4aa7f99b97203a8b5a79882bcfe2156b8613ccd4599

What is avguard.exe?

Antivirus On-Access Service - Avira Antivirus runs as a background process which checks every file opened or downloaded. Like many antivirus programs, it can run a full or custom scan to check the computer for malware in order to remove them. It updates its virus definitions automatically everyday by default using the Internet.

About avguard.exe (from Avira GmbH)

“Avira Free Antivirus eliminates many forms of malware including worms, rootkits, and costly dialers. Features include system scanner prevents infection from viruses, worms, and Trojans, blocks new vir”

Details

File name:	avguard.exe
Publisher:	Avira GmbH
Product name:	AntiVir Desktop
Description:	Antivirus On-Access Service
Typical file path:	C:\Program Files\avira\antivir desktop\avguard.exe
File version:	9.00.01.26
Size:	180.75 KB (185,089 bytes)
Build date:	3/2/2009 5:35 PM
Certificate
Issued to:	Avira GmbH
Authority (CA):	VeriSign
Effective date:	Tuesday, February 10, 2009
Expiration date:	Saturday, February 11, 2012
Digital DNA
PE subsystem:	Windows GUI
Entropy:	6.532338
File packed:	No
Code language:	Microsoft Visual C++ 9.0
.NET CLR:	No

More details

Programs

The following programs will install this file

Avira AntiVir Personal - Free Antivirus

Avira GmbH

24% remove

Avira AntiVir Personal includes a branded version of the Ask.com Toolbar, a web browser extenstion that provides search advertising and results. Upon installation the user is presented with the option to install the Ask toolbar. If accepted, the toolbar will be installed in the user's web browser (Internet Explorer, Chrome and Firefox) and will modify the home page and search settings.

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

AntiVirService
'AntiVirService' (Avira AntiVir Guard)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.07087867%	0.028634%
Kernel CPU:	0.04940863%	0.013761%
User CPU:	0.02147004%	0.014873%
Kernel CPU time:	1,359 ms/min	100,923,805ms/min
Memory
Private memory:	55.73 MB	21.59 MB
Private (maximum):	14.7 MB
Private (minimum):	392 KB
Non-paged memory:	55.73 MB	21.59 MB
Virtual memory:	96.86 MB	140.96 MB
Virtual memory (peak):	104.73 MB	169.69 MB
Working set:	7.16 MB	18.61 MB
Working set (peak):	66.53 MB	37.95 MB
I/O
I/O read transfer:	276.05 KB/sec	1.02 MB/min
I/O read operations:	33/sec	343/min
I/O write transfer:	43.42 KB/sec	274.99 KB/min
I/O write operations:	3/sec	227/min
I/O other transfer:	232.75 KB/sec	448.09 KB/min
I/O other operations:	54/sec	1,671/min
Resource allocations
Threads:	27	12
Handles:	99	600
GUI GDI count:	4	103
GUI USER count:	1	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Owner:	SYSTEM
Windows Service
Service name:	SYSTEM\CurrentControlSet\Services\AntiVirService
Display name:	AntiVirService
Description:	“Offers permanent protection against viruses and malware with the AntiVir search engine.”
Type:	Win32OwnProcess, InteractiveProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads

Averages

ADVAPI32.dll
Total CPU:	0.43301070%	0.272967%
Kernel CPU:	0.04669723%	0.107585%
User CPU:	0.38631346%	0.165382%
Memory:	620 KB	1.16 MB
MSVCR90.dll
Total CPU:	0.12410625%
Kernel CPU:	0.01685083%
User CPU:	0.10725542%
Memory:	652 KB
avevtlog.dll (AntiVir Desktop by Avira GmbH)
Total CPU:	0.00212274%
Kernel CPU:	0.00000000%
User CPU:	0.00212274%
Memory:	184 KB
avguard.exe (main module)
Total CPU:	0.00212256%
Kernel CPU:	0.00000000%
User CPU:	0.00212256%
Memory:	204 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Microsoft Windows XP	38.10%
Windows 7 Ultimate	38.10%
Windows Vista Home Premium	9.52%
Windows 8	4.76%
Windows XP Professional	4.76%
Windows 7 Starter	4.76%

Distribution by country

United States installs about 25.00% of AntiVir Desktop.

Distribution by PC manufacturer

PC Manufacturer	distribution
Compaq	26.67%
Dell	26.67%
Acer	20.00%
American Megatrends	13.33%
ASUS	13.33%

Remove Adware and Spyware Programs, FREE Download!