WinScan

Posted: January 31, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	40

First Seen:	February 28, 2011
Last Seen:	January 8, 2020
OS(es) Affected:	Windows

The WinScan rogue anti-virus product is a clone of related recent rogue anti-virus applications like WindowsScan, Windows Disk and Smart Scan. WinScan assaults the user with a barrage of fake error messages, will shut down programs repeatedly and can interfere with the proper display of folder contents. With no way to tell what's accurate and what's a lie as long as this infection is on your machine, deleting WinScan should be high-priority regardless of your computer maintenance skills.

Major Distinguishing Aspects of WinScan

The pretense of usefulness that WinScan puts up is merely a gaudy mask used to hide away its numerous attack methods on your computer. Some reports have indicated WinScan capable of browser hijacking, and most have noted related Trojans for infection vector routes. WinScan will change your registry file to let WinScan run in the background, although it will be difficult to avoid noticing WinScan in any case!

WinScan's most original trick is altering your view of a folder's contents. WinScan may display a different folder or simply cause the folder to appear empty, an unusually devious tactic WinScan uses for fear-mongering. Similarly, WinScan will also block programs from being run, especially in the case of security-related products. WinScan may generate several messages when blocking a program in an attempt to cover its tracks:

Windows cannot find (your application here). Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.
Windows detected a hard drive problem.
Scanning for hard drive errors...
Hard drive scan helps to detect and resolve hard drive problems and system performance issues.
Windows detected a hard drive problem.
A hard drive error occurred while starting the application.

WinScan will then prompt you to let it scan, which isn't anything you should force yourself to endure. WinScan's fake scans will always turn up some problem or other that requires an additional download or other self-destructive action on your part. WinScan's scans are as fake as its messages, and as a rule of thumb, you should always do the opposite of what WinScan recommends. On the bright side, WinScan has been reported to be inconsistent in blocking programs. If you attempt to access a program repeatedly, WinScan may eventually let you execute it.

WinScan's 'The Sky is Falling' Routine

WinScan uses a combination of fake scan results and fake desktop alerts to continue its reign of terror. Common desktop messages are as follows:

Activation Reminder
Win Scan Activation
Advanced module activation required to fix detected errors and performance issues. Please purchase Advanced Module license to activate this software and enable all features.
Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.
Critical Error!
Damaged hard drive clusters detected. Private data is at risk

Critical Error
Hard Drive not found. Missing hard drive.
Critical Error
Windows can't find hard disk space. Hard drive error
Critical Error
RAM memory usage is critically high. RAM memory failure.
Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.
Low Disk Space
You are running very low disk space on Local Disk (C:).
System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.
Windows - No Disk
Exception Processing Message 0x0000013

Since these pop-ups appear no matter what state of health your computer is in, you shouldn't trouble yourself over WinScan's opinions. The WinScan rogue anti-virus application will also show off various dramatically negative scan results:

Drive C initializing error
Registry Error - Critical Error
32% of HDD space is unreadable
Data Safety Problem. System integrity is at risk.
Hard drive doesn't respond to system commands
Read time of hard drive clusters less than 500 ms
Bad sectors on hard drive or damaged file allocation table
Ram Temperature is 83 C. Optimization is required for normal operation.
Requested registry access is not allowed. Registry defragmentation required
GPU RAM temperature is critically high. Urgent RAM memory optimization is required to prevent system crash

Overall, WinScan offers enough irritating false positives to mandate removal on the basis of that behavior alone. The fact that WinScan is also a very real security hazard for any infected machine makes deleting WinScan very much a favor you should do to yourself - not to mention your poor computer.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%ALLUSERSPROFILE%\Application Data\VcGKZzKOUBEBN2j0.exe

File name: VcGKZzKOUBEBN2j0.exe
Size: 672.76 KB (672768 bytes)
MD5: fc7499bc1417b380871b2d1b4614e6b2
Detection count: 49
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Application Data
Group: Malware file
Last Updated: January 8, 2020