'Update Available' Popup
'Update Available' Popup is a fake warning alert from the rogue program WinPC Antivirus. The text reads:
"Update available. WinPC Antivirus has detected that new threat database is available. Would you like to download and install update now? Installation is recommended"
If the user downloads and installs the update, they will automatically download and install WinPC Antivirus on their computer. Annoying pop-ups will continue with the intention of tricking the user into purchasing the full paid version of the rogue application WinPC Antivirus. It is strongly recommended that the user does not purchase the rogue program and removes the infection immediately.
File System Details
'Update Available' Popup may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | c:\Program Files\Common Files\System\mgnc\angpd.xml | |
| 2. | %UserProfile%\Desktop\ANG AntiVirus 09.lnk | |
| 3. | %UserProfile%\Start Menu\Programs\ANG AntiVirus 09\ANG AntiVirus 09.lnk |
Registry Details
'Update Available' Popup may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"ANG AntiVirus 09"
\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "UXPVP 1.0.7.0"
HKEY_CURRENT_USER\Software\ANG AntiVirus 09
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "65438761234587528"
HKEY_CURRENT_USER\Software\Total Virus Protection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ANG AntiVirus 09
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "76112549345328287"
