Home Malware Programs Rogue Anti-Spyware Programs MyPCCheck

MyPCCheck

Posted: February 7, 2011

Piggybacking on the good name of the Pc-Check, MyPCCheck is a rogue anti-malware application that will attempt to deceive the user about its true malicious nature. Although MyPCCheck tries to play the part of being a good anti-malware tool, it will harm your computer and serves no useful function. Simple, profitable extortion is the end game goal for this rogue anti-spyware program, and you should exterminate it quickly rather than allow it to have its way.

Where MyPCCheck Differs from the Real Thing

Despite having a similar name, MyPCCheck is easily seen as a different entity from Pc-Check. Currently, the brand logo even places visual emphasis on the 'My', making it very difficult to overlook. Visually, although it attempts to invoke the Microsoft name for the sake of a legitimate appearance – it is obviously not an official Microsoft program. The unusual slime-green color theme choice is actually very appropriate for this invader! MyPCCheck has been observed to have language support for non-English dialects, and based on this evidence it may have originated in China. This language support may be seen as gibberish on a system that doesn't have the appropriate character set for it.
 
Like all rogue anti-spyware programs, MyPCCheck will identify fake threats to your system while ignoring the real ones. MyPCCheck may also cause a number of other annoying and potentially destructive problems, all of which are standard operating procedure for this kind of malware.

  • MyPCCheck will start up without your permission, with no obvious way to disable this behavior.
  • MyPCCheck may hijack your browser, forcing you to be redirected towards malicious websites. Browser redirects can cause you to download more malware besides MyPCCheck, or your credit card information can be vulnerable to theft.
  • Your system may slow down to a turtle's pace, either directly or indirectly as a result of MyPCCheck's actions.
  • You may see frequent pop-ups, especially those that try to extort money from you.
  • Your computer or individual processes may become unstable or even crash.

Most operations can be filed under two categories – operations that deliberately stress the user, and operations that present the user with a quick solution to the first category. The solution is a false one, and by recognizing this as an illegal shakedown, you can react to MyPCCheck's attacks appropriately.

The Real Solution to Root Out MyPCCheck

Unlike some rogues, MyPCCheck has occasionally been reported to allow Windows Task Manager to run properly. This means that you can stop the process to force the rogue software to close, although you'll still need to delete MyPCCheck afterwards.
 
The true fix to MyPCCheck and its attendant problems is to conduct a thorough slash and burn action against it. No matter what your preference for ridding yourself of it is, you'll want to start your attack only after rebooting into Safe Mode. Doing this will prevent the program from running and interfering with any of your actions. Safe Mode can be accessed easily by tapping the F8 key during the startup process, which will bring up a menu for alternate boot options. If you need Internet access to download the right tools to root out MyPCCheck, selecting 'Safe Mode with Networking' will provide this.
 
Once in Safe Mode, you can choose to either run your preferred security software, or you can destroy the rogue software personally. The latter is usually not recommended as your first choice, since an up to date anti-malware scanner has less chance of missing infected files than human intervention.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 C:\Documents and Settings\My PC Check\My Documents\New Folder\hookdll.dll
    2 C:\Documents and Settings\My PC Check\My Documents\New Folder\mypccheck.exe
    3 C:\Windows\System32\My PC Check.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “MyPCCheck.exe”HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\setupapp7070010000.exe=C:\Documents and Settings\malwarehelp.org\My Documents\New Folder\setupapp7070010000.exeHKEY_CURRENT_USER\Software\My PC Check IncHKEY_CURRENT_USER\Software\My PC Check Inc\My PC CheckHKEY_CURRENT_USER\Software\My PC Check Inc\MyPCCheck\affid=7070010000HKEY_CURRENT_USER\Software\My PC Check Inc\MyPCCheck\database_version=256HKEY_CURRENT_USER\Software\My PC Check Inc\MyPCCheck\virus_signatures=62171HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}My PC CheckMy PC Check\DisplayIcon=C:\Documents and Settings\malwarehelp.org\My Documents\New Folder\setupapp7070010000.exe,0My PC Check\DisplayName=My PC CheckMy PC Check\InstallLocation=C:\Documents and Settings\malwarehelp.org\My Documents\New Folder\My PC Check\NoModify=1My PC Check\NoRepair=1My PC Check\UninstallString=C:\Documents and Settings\malwarehelp.org\My Documents\New Folder\setupapp7070010000.exe /uninstall
Loading...