Fake Windows Security Center 'scareware'

15 years ago

Win XP, IE 8.0

MS Security Essentials

I just had this 'scareware' come through my computer. Something about it made me think it was fake even though it is a good Windows look-a-like.

It ran a fake scan and returned with the 'results' that I had 5 viruses. The window gave me a highlighted button to 'Start Protection' which I did click on (duh). Then a 'run' or 'save as' box came up to download a program to rid me of the nasty beast. That's where I sort of figured it out and closed everything. I did an MS Security Essentials scan and it found nothing.

So now, I am wondering if I went to far by clicking 'start protection'. Do I trust MSSE that I am okay or is there something nasty lurking inside my system?

Anyone had this experience?

TIA Judy

Here is a link that might be useful: Fake Windows Security Alert

Sort by:Oldest

Comments (15)

ravencajun Zone 8b TX
15 years ago
you need to run an updated malwarebytes scan immediately. Clicking anything on those equals an install command which is why I have said so many times never click anything on them go to control alt delete and shut down your browser or just shut down your pc. Any click anywhere is coded as an install command.

Malwarebytes' Anti-Malware (Win) - Detecting and Removing Malware

please let us know what it finds.
ravencajun Zone 8b TX
15 years ago
if it will not allow you to download update or run malwarebytes then go right to this help forum, register there and post a NEW thread there telling exactly what you told us here and that it will not allow you to run Malwarebytes.
Analysis and Malware Removal

you will be helped by the team there to run some special scans which can clean your machine. Do not follow directions from any other thread only directions give for you and your infection.
Related Discussions
Windows Security Alert Icon
Q
Comments (11)
the fake antivirus infections do indeed put a shield in your taskbar that look quite similar to the real windows shield and some legit AV programs shields. I would recommend going to this other forum and tell them exactly what you have told us here and they will help you run some other scans to see what is still lurking, it is rare to get rid of these infections easily. You will need to register then start a thread in the area I link you to, it would be helpful if you then put a link from this thread in your post there so everything is in one post. Analysis and Malware Removal If you need help there just let me know I am there also and can help you with your post.
...See More
Home Security Systems?
Q
Comments (24)
We, too, have had an ADT system for about 17 of the 20 years we've lived here. It is monitored 24/7, but not by the police -- it's monitored by the ADT folks. I don't know how much it costs per month because Hubs pays that bill, but I know it's not bad. (Of course, peace of mind and security are worth any price they'd charge.) As for keeping windows open -- the way that a window is monitored is that there is a contact point on the inside of the frame, and a corresponding contact point on the part of the window that moves. When the two points are in contact with each other, everything is fine. When they lose contact with each other, it sets off the alarm. So, if you want to have a window open, the alarm installer can put the inside-the-frame contact point high enough to allow the window to be open enough to allow air/breezes in, but not high enough that someone could crawl through the space and into your home. Motion detectors can also be set so that the beam is low enough to catch a human going, for example, up the stairs, but high enough that your animals can roam through the house without being caught by the motion detector's beam. As Lynn just mentioned, if for some reason our alarm goes off (say, for example, Hubs opens the door from the breakfast nook to the back deck, but forgets to turn off the alarm), and we enter the proper code to turn off the alarm, all is well. If the wrong code is entered, ADT will immediately call us and ask for a preestablished code word. If we say the right word, all is well. If not, the police/sheriff are notified. If we don't answer the home phone, ADT will call our cell phones. We have two control pads for the system -- one is near the front door, and the other is upstairs in the master bedroom. When you enter the house when the alarm is on, you have a preset amount of time to enter the code to turn it off. We have plenty of time to come into the house from the garage and get to the keypad by the front door. We wanted the extra keypad in the master bedroom in case, Heaven forbid, we thought someone was attempting to break into the house during the night. We don't want to have to go downstairs to enter panic codes into the system. We live in an unincorporated area of Sacramento County, so in our case, the Sheriff's Office would be notified. And, we have to pay $75 to them every other year for an "alarm permit."
...See More
Shutters should cover the windows? Really?
Q
Comments (56)
There is probably a certain amount of engineering that takes place for water management with drains and internal gutters and scuppers and such. The series of four attached houses, one of which I live in, have roofs like this and the houses have large drains that run through the house, gutters and scuppers, and we've had problems twice: once when there was an ice dam that caused water to back up and it leaked around another roof penetration, and once when renters had been drinking on the roof >:-(, and left a beer cup up there that basically suction cupped over one of the drains causing a water backup. (Maybe a foot of water trapped in the valley) Most of the time it works really well and this is an older roof that should probably be replaced soon. With newer roofing membranes and such it should be even better. If you notice his houses tend to have no visible gutters or soffits or anything, so all of the functions related to that stuff must be heavily designed to be nearly invisible.
...See More
Also, what in the heck do I do with this window?
Q
Comments (21)
I love that arched window and the two flanking the fireplace. I would never close it up. I am a window person and have installed windows in every nook and cranny I could. We do stained glass. so I would stain glass it, or as oceanna did the fauz stained glass is lovely as well. Another idea would be to find the perfect vase or bowl (either ceramic or glass) and do a dynamic silk flower arrangement in it with a lot of gnarly branches in the arrangement. Make it eye catching, a little over the top... You can always change it and make it seasonal. With the back light from the window it would be lovely. Please post some photos when it's done. Joann I do mean a little outrageous, I did this for fall, I bought 6 silk poinsettia this week, after Thanksgiving the cranberry sunflowers will come out and the poinsettias will go in. btw, the fish was a gift from our son, from one of his travels, It has been swimming around my house in several different areas, before I just gave in and put it in the dining room, even thought the colors are not quite right. I posted this as an example of what I mean, by jazzing it up a notch or two!
...See More
User
Original Author
15 years ago
Download successful-1 infection in registry-removed.

Shame on me for not keeping this program on my computer. I relied totally on MSSE. (duh again)

Great advice ravencajun. Thanks so much for the push to get MBAM.

I will bookmark your other link.
ravencajun Zone 8b TX
15 years ago
please open malwarebytes and click on the tab LOGS and post here the contents of the log so I can see what the infection was please so I know if you need more help cleaning out leftovers.
User
Original Author
15 years ago
Here you are. tell me some good news please!

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5520

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/14/2011 3:25:11 PM
mbam-log-2011-01-14 (15-25-11).txt

Scan type: Full scan (C:\:)
Objects scanned: 216564
Time elapsed: 58 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
ravencajun Zone 8b TX
15 years ago
you should be ok

run an updated malwarebytes scan every day for a few days to see if anything shows up.
owbist
15 years ago
Judy did you check that MS Security Essentials was up to date and running? I suspect somehow it got turned off and you did not notice.

There is very little wrong with that program but one should take the precaution of checking that it is actually working occasionally.

You should check that your firewall is turned on too.
DA_Mccoy
15 years ago
If you are feeling still vulnerable SAS (Super AntiSpyware) may assist you. A new version was released today.

SAS is regularly recommended along with MWB by some here including myself.

DA
User
Original Author
15 years ago
ravencajun:
thanks for all your help. for sure I will be scanning with MBAM regularly.

owbist:
my firewall was turned as was MSSE, and up to date. it's kind of scary to know MSSE missed this.

damccoy:
i will bookmark SAS for future reference. it's been awhile since you have lended me your support. nice to see you again and thanks.
DA_Mccoy
15 years ago
As always glad to help you Judy. When I have time I lurk, and when necessary post on selected issues. As in the past, I have no need to make a comment on every thread.

My e-mail address is still good so feel free to write if you need something.

Tip an Export for me when you have time. I haven't had one in a while.

DA
User
Original Author
15 years ago
Yes, I lurk too. I try to give back when I can, but unless I have actually experienced the posters problem, I wait for those who know to help out.

I miss the old regulars. I think the forum changed after we lost our leader, dreamweaver. I think of her often.

I'll have that brew and toast you as I do.
Cheers
User
Original Author
15 years ago
I just bought the license for Malwarebytes for 'real-time protection'.

Fifteen minutes in and already getting pop-ups.....while navigating this site.

Here is my log.

10:46:44 Judy *****MESSAGE Protection started successfully
10:46:49 Judy MESSAGE IP Protection started successfully
10:48:07 Judy MESSAGE Scheduled update executed successfully
10:48:08 Judy MESSAGE IP Protection stopped
10:48:13 Judy MESSAGE Database updated successfully
10:48:15 Judy MESSAGE IP Protection started successfully
11:02:34 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:02:37 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:02:43 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:03:10 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:03:13 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:03:19 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:03:41 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:03:44 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:03:50 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:04:29 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:04:32 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:04:38 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:09:22 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:09:25 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)
11:09:31 Judy IP-BLOCK 208.87.149.250 (Type: outgoing)

I guess it's good to have the real time protection, but I'd like to hear other people experience with this.
Anyone else have the licensed version?
Will this slow down my computer at all.
User
Original Author
15 years ago
Update:

I've been successful in accessing most sites, so my fears of this real time protection slowing down my computer are gone.

Now I find it's this site, and all THS forums that prompts the following pop up balloon and slows download of the page to a crawl.

"Malewarebytes Anti-Malware:
Successfully blocked access to a potentially malicious website.
208.87.149.250
Type: Outgoing"

Is this happening because of the trouble they are having with this site I wonder. I will try to contact them regarding this.
zep516
15 years ago
Hi judys ont,

When you ask your browser to connect to a website, Windows uses DNS or the HOSTS file (depending on configuration), to convert that domain name into it's corresponding IP address. MBAM intercepts the packet communications, to determine whether or not the IP address is known for malicious activity, and if so, blocks the communication. I suggest read up on that at the provided link to get a better understanding of what's going on, false positives etc....

Did you uninstall Microsoft Security Essentials? Or are you running then both together? I'm not sure what is recommend here exactly. I do know Malwarebytes is a Anti Malware scanner not so much a virus scanner.

I strongly suggest you start a topic on the Malwarebytes forum. They will hopefully give you some clear answers.

Here is a link that might be useful: malwarebytes.org
ravencajun Zone 8b TX
15 years ago
I agree their forum is wonderful and they are quick to check things out so when you have any issues with any site or any pop ups from malwarebytes just go there and ask or you may find the question already there and answered.
the full pay version is an excellent program it may slow you down some but the benefit is that it will stop an infection before it gets onto your pc, the free version helps to remove the infection once it is already on the pc so as you can see it would be beneficial to stop it prior to infecting your pc.
Some antivirus programs have a bit of a problem running with the pay version of MBAM because you have 2 scanners running at the same time, if that happens the forum is where to go for that concern too.

Fake Windows Security Center 'scareware'

Comments (15)

ravencajun Zone 8b TX

ravencajun Zone 8b TX

Related Discussions

User
Original Author

ravencajun Zone 8b TX

User
Original Author

ravencajun Zone 8b TX

owbist

DA_Mccoy

User
Original Author

DA_Mccoy

User
Original Author

User
Original Author

User
Original Author

zep516

ravencajun Zone 8b TX

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Fake Windows Security Center 'scareware'

Comments (15)

Related Discussions

UserOriginal Author

UserOriginal Author

UserOriginal Author

UserOriginal Author

UserOriginal Author

UserOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

User
Original Author

User
Original Author

User
Original Author

User
Original Author

User
Original Author

User
Original Author