Home Malware Programs Potentially Unwanted Programs (PUPs) Windows PC Backup Wizard

Windows PC Backup Wizard

Posted: March 2, 2016

Threat Metric

Ranking: 3,345
Threat Level: 1/10
Infected PCs: 9,441
First Seen: March 2, 2016
Last Seen: October 17, 2023
OS(es) Affected: Windows

The Windows PC Backup Wizard is a Potentially Unwanted Program (PUP) that may promote itself through semi-invasive methods, such as persistent pop-ups. System changes associated with the Windows PC Backup Wizard have historically avoided being detected by most PC security products, and also may deliver content that blocks your screen or provides no UI controls. All PC owners uninterested in using this product should remove the Windows PC Backup Wizard or the side effects associated with its marketing by restarting and scanning their PCs with their updated security programs.

The Windows PC Backup Wizard and Its Magical Pop-Up Act

The Windows PC Backup Wizard is a product that provides software backup through company-specific accounts. Unusually for subjects of malware researchers' interest, the Windows PC Backup Wizard, alone, lacks most of the characteristics associated with unwanted or threatening software and does not rely on browser hijackings or invasive affiliate advertising as part of its business model. However, malware researchers did confirm some cases of the Windows PC Backup Wizard being promoted by system-localized pop-ups dedicated to it.

Pop-ups for the Windows PC Backup Wizard ordinarily deliver themselves through the Windows Task Scheduler. Like other tasks in that default Windows utility, these pop-ups are set to load at timed intervals throughout the day (such as noon Central Time). These pop-ups include phrasing implying the possibility of security issues with your PC, which you can resolve by registering an account with the Windows PC Backup Wizard. Significantly, the registration form included in the pop-up alert's task doesn't provide a title bar or other controls that could let the PC user resize, minimize or close it. As a result, the form will remain onscreen until the account is logged out or the system reboots.

Malware experts stress that the above system modifications don't necessarily require the Windows PC Backup Wizard's installation in the first place. However, they may be associated with the presence of specific files, including various components in the PCWDownloader and PCWUpdated folders.

Dispelling the Marketing of a Wizardly PUP

Because the Windows PC Backup Wizard's registration pop-up is not a fully-installed program, PC security tools designed for detecting unwanted programs may not identify the source of your pop-ups. Identifying the files and system changes related to it should be done by security products that include databases entries for various, unwanted system modifications, such as changes to your Hosts file or Start menu. Typically, these system changes are referred to as PUMs (Potentially Unwanted Modifications), to differentiate themselves from installed applications like PUPs or threats.

Making the correct choices for removing pop-up generators like the Windows PC Backup Wizard's scheduled tasks is only one characteristic of the overall security problem. Secondarily, you also should be concerned with the first breach of security that allowed the task's generation to occur automatically. Although malware experts still are gathering information on the delivery methods of these system changes, current evidence shows that the tasks and files are created automatically. They target business environments occasionally, which are most vulnerable to e-mail attachment-based vulnerabilities.

Whatever your feelings may be about the Windows PC Backup Wizard or the services it provides, you never should assume that a pop-up 'alert' has anything to do with your operating system or security software necessarily. Using such carefully-worded, erroneous warnings is one of the most popular methods of promoting both unwanted and threatening software, including everything from other PUPs to outright scamware.

Technical Details

Additional Information

The following URL's were detected:
https://feed.update-search.com/?q=
Loading...