Home Malware Programs Fake Warning Messages Update Available Popup

Update Available Popup

Posted: April 9, 2009

"Update Available" pop-up is a fake security notification generated by rogue anti-spyware WinPC Antivirus. Mainly, the "Update Available" notification displays information about new threat database updates and recommends to download this rogue anti-spyware WinPC Antivirus.

This is the text that usually appears on the "Update Available" pop-up:

"Update available. WinPC Antivirus has detected that new threat database is available. Would you like to download and install update now? Installation is recommended."

At first glance it may look like a normal update notification, however, "Update Available" pop-up is a scam. If you click on "Update Available" pop up window, you will automatically download and install WinPC Antivirus< on your computer. Instead, remove "Update Available" pop-up immediately after first appearance.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Desktop\ANG AntiVirus 09.lnk
    2 %UserProfile%\Start Menu\Programs\ANG AntiVirus 09\ANG AntiVirus 09.lnk
    3 c:\Program Files\Common Files\System\mgnc\angpd.xml

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\ANG AntiVirus 09HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"ANG AntiVirus 09"HKEY_CURRENT_USER\Software\Total Virus ProtectionHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsHKEY..\..\..\..{RegistryKeys}\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "UXPVP 1.0.7.0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "76112549345328287"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "65438761234587528"HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}ANG AntiVirus 09

Loading...