A brand new fake AV program Virus Protector is doing the rounds.
Hopefully by now you'll know never to install or run (or click) anything that pops up on your screen telling you there's a problem
File Changes:
RegistryEntries
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Value: Shell
Data: C:\WINDOWS\system32\agaz17mgx.exe
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Value: Shell
Data: C:\WINDOWS\system32\agaz17mgx.exe