Warning! popup Description

Warning! popup is a fake security warning alert promoted by the rogue anti-spyware application Privacy Components. The alert text reads:

“Warning! One or several security components reported some problems! Traces of discreditable files (for example, the history of visiting porno sites) and security vulnerability have been found. Click this notification to eliminate vulnerability immediately!”

Once Privacy Components is installed onto the users PC, additional fake pop-ups and alerts will be displayed. The purpose of these fake alerts is to convince the user that their PC is infected so that the user will purchase the full version Privacy Components application. The user should remove the infection without hesitation.

Type: Fake Warning Messages

How Can You Detect Warning! popup?

Warning! popup has typically the following processes in memory:

• c:\Program Files\Privacy components\tools\sc\libeay32.dll
• c:\Program Files\Privacy components\tools\sc\tap0801.sys
• c:\Program Files\Privacy components\uninstall.exe
• c:\Program Files\Privacy components\pc.exe
• c:\Program Files\Privacy components\tools\sc\openvpn.exe
• c:\Program Files\Privacy components\tools\sp\sp.dll
• c:\Program Files\Privacy components\agent.exe
• c:\Program Files\Privacy components\tools\sc\libssl32.dll
• c:\Program Files\Privacy components\tools\sc\tapinstall.exe

Warning! popup creates the following registry entries:

• Microsoft\Windows\CurrentVersion\Run\agent.exe
• HKEY_CLASSES_ROOT\sp.TIEAdvBHO
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “agent.exe”
• Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}
• HKEY_CLASSES_ROOT\CLSID\{D032570A-5F63-4812-A094-87D007C23012}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Privacy components
• Microsoft\Windows\CurrentVersion\Uninstall\Privacy components
• Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Privacy components
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}
• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” => “C:\Program Files\Privacy components\pc.exe”

Important Article Disclaimer