What is avgrsstarter?

[kwschumm]

My Windows XP SP3 laptop was just idling away when Spybot S&D popped up a notification about a registry change to avgrsstarter.

Anyone know what that is?

I couldn't find much information about this key so I denied the change. It may be related to AVG but a search of their website turned up nothing.

[Tom.K]

Have you checked the path of it?
If the path does not lead to folder where you have installed AVG, search that file and if it's small size (> 500 KB) try to upload it for scanning to VirusTotal (Search for it using search engine like Google or Yahoo).
Does AVG still works after denying a registry change?

[kwschumm]

Thank you for your response.

Sorry, I did not check the path and will if it happens again.

The most recent Spybot log entry in

c:\Documents and Settings\All Users\Application Data\Spybot Search and Destroy\Logs

is Sept. 14th of 2007. Is that still the correct location for log file entries?

AVG 8 is doing a full scan of the computer right now and it seems to be running fine.

[kwschumm]

... and the AVG 8 Full Computer Scan reported no errors, and six warnings about tracking cookies which were deleted.

[kwschumm]

OK, there's definitely something going on.

Spybot just popped up another message that a registry entry was changed. There is no path reported. This is what it says:

Spybot - Search & Destroy has detected an important registry entry that has been changed.

Category: Winlogon notifiers
Change: Key added
Entry: avgrsstarter

The old data and new data fields are blank.

Coincident with this a Windows Security Center message popped up a message that says that Virus Protection was turned off. I didn't turn it off, the AVG icon in the tray is still there, and AVG says that "All security features are working correctly and are up to date".

Is this just something that AVG is doing? I haven't allowed or denied the registry change at this time.

[drragostea]

I'm a bit stumped too (some Google results came back clean with this .dll but some marked it as malicious), but it seems like this entry is associated with "avgrsstx.dll". You can perform a Search for this file on your machine and upload it to VirusTotal to see if it is flagged.

http://www.bleepingcomputer.com/star...dll-23492.html

I can't really give a definate answer, but an expert can.