Home Malware Programs Fake Warning Messages 'System Files Modification Alert!' Pop up

'System Files Modification Alert!' Pop up

Posted: March 2, 2009

'System Files Modification Alert!' Pop up is related to the rogue anti-spyware program ANG AntiVirus 09. Once you see the 'System Files Modification Alert!' Pop up on your PC screen you will know that your PC is infected with a Trojan that produces this phony pop up.

The following is the text of the pop up message:
"System Files Modification Alert!
Some important system files were modified by malicious application.
It may potentially lead to system slowdowns and data loss.
Click here to remove these system threats and stop unauthorized
instrusions (Recommended)."

The fake 'System Files Modification Alert!' Pop up appears on your screen to try to trick or scare you into purchasing the rogue ANG AntiVirus 09 program. Don't be deceived by this fake 'System Files Modification Alert!' and do NOT purchase the ANG AntiVirus 09 program.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Program Files%\Common Files\System\mgnc
    2 %Program Files%\Common Files\System\mgnc\angpd.exe
    3 %Program Files%\Common Files\System\mgnc\angpd.xml
    4 %Program Files%\Common Files\System\mgnc\mcdk.exe
    5 %Program Files%\Common Files\System\mgnc\rkgnd.exe
    6 %Program Files%\Common Files\System\mgnc\wsd.exe
    7 %UserProfile%\Desktop\ANG AntiVirus 09.lnk
    8 %UserProfile%\Start Menu\Programs\ANG AntiVirus 09
    9 %UserProfile%\Start Menu\Programs\ANG AntiVirus 09\ANG AntiVirus 09.lnk

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\ANG AntiVirus 09HKEY_CURRENT_USER\Software\Total Virus ProtectionHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "UXPVP 1.0.7.0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "76112549345328287"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "65438761234587528"
Loading...