Beware of FAKE Microsoft virus message

13 years ago

My browser suddenly shut down this afternoon, and a message popped up from Microsoft (or so it seemed) telling me a Trojan virus had been detected. Turned out it was not from Microsoft at all. It's promoting a program called ThinkPoint, again said to be from Microsoft. ThinkPoint is actually malware, and even though I didn't agree to download it, it now appears to be on my computer. I'm using my other computer to research and hopefully fix the problem, but wanted to issue a warning to my fellow KTers in case something similar happens to you.

Susan

Sort by:Oldest

Comments (14)

Jasdip
13 years ago
Susan do you have Malwarebytes installed? It's an anti-malware program. (free)
country_bumpkin_al
13 years ago
Thanks for the warning!!!
Related Discussions
why do i keep getting this virus?? help!
Q
Comments (8)
Name: jucheck Filename: jucheck.exe Command: C:\Windows\System32\dllcache\jucheck.exe Description: Added by the W32.Scrimge.O worm. W32.Scrimge.O is a worm that spreads through Microsoft instant messaging clients and opens a back door on the compromised computer. File Location: C:\Windows\System32\dllcache\jucheck.exe Startup Type: This startup entry is started automatically from a Run, RunOnce, RunServices, or RunServicesOnce entry in the registry. HijackThis Category: O4 Entry Discovered: September 28, 2007 Updated: September 28, 2007 5:22:51 PM Also Known As: W32/Sdbot-DHX [Sophos], W32/Sdbot-DJL [Sophos] Type: Worm Infection Length 76,288 bytes Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP Once executed, the worm copies itself as the following file: %System%\dllcache\jucheck.exe It then creates the following registry entries so that it starts when Windows runs: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"jucheck" = "%System%\dllcache\jucheck.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\"MSNPRC" = "[PATH TO WORM]" That's where it comes from the registry run key It also modifies the following registry entry to lower security settings: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Windir%\system32\dllcache\"jucheck.exe" = "%System%\dllcache\jucheck.exe:*:Enabled:Windows Sharing" The worm then connects to m.proxyisp.info on TCP port 21888 allowing unauthorized access to perform the following actions: Update itself Download additional files Spread using Microsoft instant messaging clients Delete itself The worm checks the the locale settings of the compromised computer and then spreads through Microsoft instant messaging clients by sending a zipped file attachment of itself along with a message composed of some of the following text: @ZHE SHI WO DE LUOZHAO :O QING BU YAO FA GEI BIEREN !!. YI ZHANG WO GEN WO PENGYOU ZUI HAO DE ZHAOPIAN :S !!. JIESHOU WO DE ZHAO PIAN :> !!. KAN WO DE ZHAOPIAN :D. NI HE WO !!! .... QING KAN :D. kAN BA LI XI ER DUN JIN JIANYU HOU SHI DUO ME QIAOCUI :<.> VOC TEM QUE VER ESTE RETRATO DE MIM
...See More
Messages telling me I need Flash & Java - I already have them.
Q
Comments (15)
Oh RavenCajun, I'm trying to stay calm but hubby is going to freak if I have to tell him I got Trojans on a practically new computer. *taking deep breaths* You're right (again! lol)....some of these programs seem to automatically download things I didn't want. In the Remove programs area I found things that I knew could be included with other items I downloaded but I never wanted them, but there they were! Examples: Open Office, Google Toolbar, Yahoo Toolbar, Webshots something-or-other, etc. I promise to be much more careful in the future by making sure to inspect for something that is checked as if I want it, but don't. Even though I "Remove Selected" on everything, this info below shows "no action taken". This is the log that Popped Up Automatically when I clicked "Remove Selected": Malwarebytes' Anti-Malware 1.30 Database version: 1328 Windows 6.0.6001 Service Pack 1 10/27/2008 12:15:08 PM mbam-log-2008-10-27 (12-14-53).txt Scan type: Quick Scan Objects scanned: 43155 Time elapsed: 4 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 6 Registry Data Items Infected: 14 Folders Infected: 1 Files Infected: 9 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(030a0f33-5b99-482e-83f5-2eeb8457878b) (Trojan.BHO) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(9034a523-d068-4be8-a284-9df278be776e) (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(144a6b24-0ebc-4d89-bf09-a06a718e57b5) (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\(daed9266-8c28-4c1c-8b58-5c66eff1d302) (Search.Hijack) -> No action taken. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\(144a6b24-0ebc-4d89-bf09-a06a718e57b5) (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wblogon (Trojan.Zlob) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\start (Trojan.Zlob) -> No action taken. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=(searchTerms)) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=(searchTerms)) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> No action taken. Folders Infected: C:\Windows\System32\675873 (Trojan.BHO) -> No action taken. Files Infected: C:\Users\Lady\My Documents\My Music\My Music.url (Trojan.Zlob) -> No action taken. C:\Users\Lady\My Documents\My Pictures\My Pictures.url (Trojan.Zlob) -> No action taken. C:\Users\Lady\My Documents\My Videos\My Video.url (Trojan.Zlob) -> No action taken. C:\Users\Lady\My Documents\My Documents.url (Trojan.Zlob) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Antivirus Scan.url (Trojan.Zlob) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Online Spyware Test.url (Trojan.Zlob) -> No action taken. C:\Users\Public\Desktop\Antivirus Scan.url (Rogue.Link) -> No action taken. C:\Users\Public\Desktop\Online Spyware Test.url (Rogue.Link) -> No action taken. C:\Users\Lady\Favorites\Antivirus Scan.url (Rogue.Link) -> No action taken. Also, before reading your post I hand-copied some things that showed up in my Free AVG when it automatically scanned in the wee hours of this morning. Trojan Fake Alfert - IEBT " Media-Codec " Media-Codec/V4 " SmitFraudVariant/IE Anti-Spyware " Unclassified/ALGG " Unclassified-Packed/Suspicious " Downloader ZLOB_r.DE " " " " DO " " " " DF " Generic7.BDKJ Adware Media-Codec/ZLOB And even though I thought the bad stuff was gone and I've started with a fresh reboot, when I am in IE7, it freezes and I get one of two messages: APPCRASH or APPHANGB1 Of course I went to WebShots and sure 'nuff, there was the big box with the message "This page will not function properly without enabling Java". gggrrrrr!
...See More
virus advice for everyone just in case
Q
Comments (24)
we have been dealing with this nasty thing daily here on the computer help forum and on many other tech help forums I work on. It is on many legit sites, it gets into the website through a "hole" and even the website owner has no idea it is on their site infecting their visitors. There are 2 very good free programs that so far have been getting rid of it completely. I will provide the links here for you, if you have any problem with this thing head over to the computer help area here and we will help you with it. Also I will give a link here that is excellent in explaining just how this thing works. these 2 free programs are ones you can install and use weekly to make sure your pc is staying clean, but always update them before running a scan. SUPERAntiSpyware Malwarebytes' Anti-Malware here are the directions for this one # Double-click mbam-setup.exe and follow the prompts to install the program. # At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. # If an update is found, it will download and install the latest version. # Once the program has loaded, select Perform full scan, then click Scan. # When the scan is complete, click OK, then Show Results to view the results. # Be sure that everything is checked, and click Remove Selected. this is the article Anatomy of a Malware Scam http://www.theregister.co.uk/2008/08/22/anatomy_of_a_hack/print.html very good advice there. stay safe!
...See More
Explain Microsoft Scam Calls
Q
Comments (50)
They almost got me today! I was just online doing my usual when this page came up, and this voice told me I needed to call immediately. They wanted my password and I was worried. DH is fishing, couldn't find our IT guys number, so I called the number they gave. They were busy. "Call back later." I COULDN'T DO ONE THING ON MY COMPUTER. THEY HAD ME LOCKED!! Now I do control, alt delete, and manage to close all windows and restart. First thing I did was run my malware program. They found nothing. Same with my security software. Nothing. Then I get the call. They are calling me back. I said "If you are Microsoft, what is my name?" They didn't know. I said a few choice words and hung up. BUT I have my screenshot. I did crop it for public display, but I've got the full thing with the address bar to show to the REAL microsoft techs IF I need to contact them from their bonifide website contact info. They have many tricks up their sleeves. Do not be fooled!
...See More
jannie
13 years ago
My DH fell foe soething like that. Cost us plenty. First, the fake Microsoft website asked us for $50, which DH allowed. Next day, after he discovered the virus, our bank refused to stop the payment since he had agreed to it. econd, we had to pay Geekquad $160 to revove the firus and get our computer running properly, plus we were without our computer for 2-3 days while Geek squad worked on it. Luckily, they did pick up and deiver the CPU, which is quite heavy and difficult.
alisande
Original Author
13 years ago
Jasdip, I have Malwarebytes installed on the computer I'm using to write this (thanks to you!), but not on the other one. :-(

It's at a standstill now; I can't even open the Task Manager. All I get is the ThinkPoint screen.
juellie1962
13 years ago
I fell for something similar at work. Luckily we needed some work done on the computer anyway; but I felt like an idiot.
alisande
Original Author
13 years ago
Well, I'm happy to report my computer is all better. I followed instructions I found from a couple of sources online, and I think we're in good shape. And I installed Malwarebytes, too.
Jasdip
13 years ago
Oh what a relief Alisande! I'm so glad you didn't have to take it in.
Kudos for working through it yourself. If you couldn't even get past the ThinkPoint, I can't imagine how to fix it.

Unfortunately we only have the 1 laptop here, so if this happens to use, we're pooched. I'd have to take it to my parents or somewhere to research the fix. Hmmmm that's a good idea. My first instinct would be to take it to the shop, but if it could be fixed manually that's fantastic.
minnie_tx
13 years ago
Thanks for the heads up!!!!
alisande
Original Author
13 years ago
Yes, thank heavens I have two computers. The University of Delaware has instructions on how to start the computer in Safe Mode With Networking, and from there I followed other instructions on disabling ThinkPoint via the Task Manager. After that I went back to the U of D instructions (I had printed them out) and followed them to install Malwarebytes. The program found a couple more files left behind by the beast. Whew!!

When my DS arrived to see what he could do, it was all fixed. It's not often I get to impress my son (who has a bachelor's degree in Information Sciences & Technology) with my computer skills. LOL

At least I hope it's all fixed. I'm watching a message I left on the Landzdown Forum to see if there's anything further I need to do.
ravencajun Zone 8b TX
13 years ago
just to help you realize how many of these fake Antivirus programs are around look at this blog which keeps tabs of them as they hit, and see how real they look.

Please if any of you see these pop up on your computer do not click on anything!! instead do a control+alt+delete to get your task manager open and end task on your browser whether it be IE or firefox or what ever or just hit the shut down on the pc and restart it.
If you did fall prey and gave them a credit card, immediately contact the credit bureaus and put a fraud alert on your card and notify the card company also, usually best to kill that card, that is after all what they are really after.

the way these things work even hitting the x to close it will actually trigger the install of it. The scan they show that says you are infected is totally fake it is not real, it is not of your pc at all, everyone sees the same picture and that is what it really is, a picture. they are a bear to clean. If you find you need help please head over to the Computer help forum here, I am there daily helping and can lead to other sites to help you get cleaned up. Come see us (lots of good helpful folks there)before you spend money taking it somewhere we may well be able to get it straightened out.
Here is that blog.

Here is a link that might be useful: blog
jannie
13 years ago
Whenever I have trouble with my computer or starting up, I follow the instructions in my Windows XP book to do a "System restore."
ravencajun Zone 8b TX
13 years ago
the problem is most of these infections block the use of most windows functions including system restore.

system restore is a great feature and well worth trying in many cases, however for an infection it will not remove it and may make things worse, and infections often times will reside in restore points which is why when doing a full clean up of an infection it is beneficial to have a support forum help you determine if your restore points are clean or need to be cleared. But do not clear or turn off restore points till the full clean up has been completed, sometimes even an infected restore point is better than nothing when you can not get the pc to work.
rosemaryt
13 years ago
I don't know what's going on, but for the first time in my life, my brand new laptop has been hit with THREE trojan viruses that wreaked havoc, despite an up-to-date Norton Anti-virus program.

Today, my facebook account was hacked into, putting up a URL that sent people to a phishing site and last week, my hotmail was hacked into and sent out a malicious email.

I feel like I spend most of my time changing passwords and fixing things. Are the hackers getting better or are there just more of them?

My router was installed by a well-credentialed computer programmer and my laptop is kept in good order by a top-notch repair firm. I'm doing all I can to keep things secure.

Lesson learned: Change all passwords every 30 days.
ravencajun Zone 8b TX
13 years ago
most of the antivirus programs are not able to handle some of the trojan/malware infections out there, Good antimalware programs are a must have and need to be updated and run weekly. The very best free one is malwarebytes and a close second is superantispyware, both can be put on any windows pc and used weekly they do not interfere with your AV program since you run them on demand. Here are some links for them.
I put these 2 programs on every pc that comes in to me.
Downloading and installing Malwarebytes' Anti-Malware on a Windows computer

SUPERAntiSpyware
just be sure you get the free version and always update it prior to running the full scan.

the other program I will not be with out is spywareblaster also free, no scans to run just open it weekly hit the update button then the enable all protection so the shield on it turns green.
SpywareBlaster

Many of these infections get on our computers when we have not been updating all the programs on it with the latest updates and patches, not just windows updates but things like Java, Adobe, Flash etc. Using a scanner like the Secunia one will tell you what needs updating on the pc.
Secunia Online Software Inspector (OSI)

and it goes with out saying the windows updates are a must.

Beware of FAKE Microsoft virus message

Comments (14)

Jasdip

country_bumpkin_al

Related Discussions

jannie

alisande
Original Author

juellie1962

alisande
Original Author

Jasdip

minnie_tx

alisande
Original Author

ravencajun Zone 8b TX

jannie

ravencajun Zone 8b TX

rosemaryt

ravencajun Zone 8b TX

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Beware of FAKE Microsoft virus message

Comments (14)

Related Discussions

alisandeOriginal Author

alisandeOriginal Author

alisandeOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

alisande
Original Author

alisande
Original Author

alisande
Original Author