While Rogues detect fake infections on a clean system and display alerts message, WinCoDecPRO displays fake codec error, redirecting infected user to WinCoDecPRO web site.
When Trying to run Windows Media Player, the malware closes it and displays a messagebox, choosing the text in a hardcoded list:
It also display regularly popups alerts:
The modified wallpaper:
