How to remove fake virus alert jamming my computer?

10 years ago

I'm pretty sure we recently had a message thread about the phony "Microsoft" alert that stops your Internet browsing and tells you to call a certain number to have a Microsoft technician walk you through the steps to get it off your computer.

Obviously, I'm not calling the number. But I thought someone (Raven, perhaps?) had posted instructions on removing the problem, or a link to the instructions. I've been searching, but I don't see it. My computer got hit last night. It is presently shut down, but I worry about any damage that might be done.

I Googled the problem. Lots of websites offer instructions (usually involving acquiring 4 or 5 anti-malware programs), but I can't tell which sites are legit.

Any idea how these slimebuckets get into our computers? I use the Internet a lot, but don't usually go beyond my "old reliable" websites.

Featured Answer

socks

10 years ago

I had that same event recently right in the middle of filling out online health data form. I had to shut the computer down which messed up the whole effort to sign up for a medical test. After rebooting the computer, the window blocked me from entering the internet.

I took it to the local independent computer store, and he fixed it in about 15 minutes. No charge. If they take it in the back and spend more time on it, then they charge. (Talk about building goodwill!)

Landzdown could probably help you (highly recommended by ravencajun) if you don't mind jumping through a few hoops. I've used them before, and they are patient, knowledgeable.

You are right: DO NOT CALL!

Sort by:Oldest

Comments (26)

ravencajun Zone 8b TX
10 years ago
Alisande I recommend going to the Landzdown forum, register it's free and ask Corrine for assistance to check your computer and let her know what happened. Let me know if you need help

www.landzdown.com
Alisande thanked ravencajun Zone 8b TX
Related Discussions
Hiloti Trojan - watch out for fake emails from UPS or Fedex
Q
Comments (2)
never never never open a pdf in your email or in a browser window, instead always save it to your hard drive and scan it with everything you have before you open it, this is one of the ways they are spreading some of the very bad infections these days. I have a great add-on in my firefox that always pops up and asks me what I want to do with a pdf should I happen to click on one accidentally or go to a site that wants to try to open one automatically. PDF Download :: Add-ons for Firefox Keep running your malwarebytes updated full scan for a few days to make sure you have all the remnants, usually they leave bits behind. As to the conflict with trend and malwarebytes please go here to the malwarebytes forum and read item F in the list. Common Issues, Questions, and their Solutions if that does not help please log on the malwarebytes forum and post there asking for assistance.
...See More
Computer security hi-jacked - WARNING!!
Q
Comments (18)
DDS.txt . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by DK at 18:12:58 on 2012-06-12 Microsoft� Windows Vista� Home Premium 6.0.6002.2.1252.1.1033.18.3062.1241 [GMT -4:00] . AV: Microsoft Security Essentials *Enabled/Updated* (9765EA51-0D3C-7DFB-6091-10E4E1F341F6) SP: Windows Defender *Disabled/Updated* (D68DDC3A-831F-4fae-9E44-DA132C1ACF46) SP: Microsoft Security Essentials *Enabled/Updated* (2C040BB5-2B06-7275-5A21-2B969A740B4B) . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\SUPERAntiSpyware\SASCORE.EXE C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\hkcmd.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\rundll32.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Windows\system32\svchost.exe -k SDRSVC C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Link Helper: (18df081c-e8ad-4283-a596-fa578c2ebdc3) - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: (53707962-6f74-2d53-2644-206d7942484f) - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Groove GFS Browser Helper: (72853161-30c5-4d22-b7f9-0bbc1d38a37e) - c:\progra~1\micros~2\office14\GROOVEEX.DLL BHO: Java(tm) Plug-In SSV Helper: (761497bb-d6f0-462c-b6eb-d4daf1d92d43) - c:\program files\java\jre6\bin\ssv.dll BHO: Office Document Cache Handler: (b4f3a835-0e21-4959-ba22-42b3008e02ff) - c:\progra~1\micros~2\office14\URLREDIR.DLL BHO: Java(tm) Plug-In 2 SSV Helper: (dbc80044-a445-435b-bc74-9c25c1c588a9) - c:\program files\java\jre6\bin\jp2ssv.dll TB: (7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA) - No File TB: (2318C2B1-4965-11D4-9B18-009027A5CD4F) - No File uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey uPolicies-explorer: HideSCAHealth = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105 IE: (2670000A-7350-4f3c-8081-5663EE0C6C49) - (48E73304-E1D6-4330-914C-F5F514E3486C) - c:\program files\microsoft office\office14\ONBttnIE.dll IE: (789FE86F-6FC4-46A1-9849-EDE0DB0C95CA) - (FFFDC614-B694-4AE6-AB38-5D6374584B52) - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll DPF: (8AD9C840-044E-11D1-B3E9-00805F499D93) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (E2883E8F-472F-4FB0-9522-AC9BF37916A7) - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.1 71.242.0.12 TCP: Interfaces\(331C4984-7B67-4895-92BF-FBD07719C629) : DhcpNameServer = 192.168.1.1 71.242.0.12 Filter: text/xml - (807573E5-5146-11D5-A672-00B0D022E945) - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: intu-help-qb5 - (867FCB77-9823-4cd6-8210-D85F968D466F) - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll Handler: qbwc - (FC598A64-626C-4447-85B8-53150405FD57) - c:\windows\system32\mscoree.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: igfxcui - igfxdev.dll SEH: Groove GFS Stub Execution Hook: (b5a7f190-dda6-4420-b3ba-52453494e6cd) - c:\progra~1\micros~2\office14\GROOVEEX.DLL SEH: SABShellExecuteHook Class: (5ae067d3-9afb-48e0-853a-ebb7f4a000da) - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 171064] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664] R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-5-4 116608] R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\verizon\iha_messagecenter\bin\Verizon_IHAMessageCenter.exe [2011-7-1 290832] R2 QBVSS;QBIDPService;c:\program files\common files\intuit\dataprotect\QBIDPService.exe [2011-8-19 1248256] R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-10 4640000] R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2011-6-14 281088] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-18 257696] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880] S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 74112] S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-3-26 214952] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2012-06-12 20:05:54 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(c63b0218-fda0-4f49-a66a-fbbac2d29431)\offreg.dll 2012-06-12 14:38:15 713784 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll 2012-06-12 14:38:15 713784 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(94e954c4-9303-4459-aace-f4d82ef5da4b)\gapaengine.dll 2012-06-12 14:36:16 6737808 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(c63b0218-fda0-4f49-a66a-fbbac2d29431)\mpengine.dll 2012-06-12 01:09:54 6737808 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2012-05-16 22:05:38 677136 ----a-w- c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll . ==================== Find3M ==================== . 2012-05-04 17:57:10 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-05-04 17:57:09 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-04 19:56:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-04-03 08:16:12 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-03 08:16:11 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-04-02 13:36:21 2044928 ----a-w- c:\windows\system32\win32k.sys 2012-03-30 12:39:11 914304 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-03-29 13:39:19 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2012-03-25 17:34:20 472808 ----a-w- c:\windows\system32\deployJava1.dll 2012-03-21 00:44:12 74112 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys 2012-03-21 00:44:12 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys 2012-03-20 23:28:50 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys . ============= FINISH: 18:13:49.82 =============== Attach.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft� Windows Vista� Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 6/14/2011 9:30:53 PM System Uptime: 6/12/2012 4:29:45 PM (2 hours ago) . Motherboard: Gateway : : Processor: Intel(R) Pentium(R) Dual CPU T2370 @ 1.73GHz : U2E1 : 1333/mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 298 GiB total, 207.691 GiB free. D: is CDROM () E: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP405: 5/23/2012 11:07:30 AM - Windows Update RP406: 5/24/2012 1:57:24 PM - Windows Update RP407: 5/25/2012 5:02:37 PM - Windows Update RP408: 5/26/2012 5:59:33 PM - Windows Update RP409: 5/27/2012 6:32:30 PM - Windows Update RP410: 5/28/2012 7:53:40 PM - Windows Update RP411: 5/29/2012 11:27:49 AM - Windows Update RP412: 5/30/2012 12:05:57 PM - Windows Update RP413: 5/31/2012 12:35:48 PM - Windows Update RP414: 6/1/2012 5:13:40 PM - Windows Update RP415: 6/2/2012 10:49:47 AM - Windows Update RP416: 6/3/2012 6:47:47 PM - Windows Update RP417: 6/4/2012 11:25:04 AM - Windows Update RP418: 6/4/2012 10:49:10 PM - Windows Update RP419: 6/5/2012 4:54:34 PM - Windows Update RP420: 6/6/2012 9:34:37 AM - Scheduled Checkpoint RP421: 6/6/2012 11:11:02 AM - Windows Update RP422: 6/7/2012 10:32:10 AM - Scheduled Checkpoint RP423: 6/7/2012 12:15:48 PM - Windows Update RP425: 6/7/2012 10:23:25 PM - Microsoft Antimalware Checkpoint RP426: 6/8/2012 4:39:47 PM - Windows Update RP427: 6/9/2012 4:43:40 PM - Windows Update RP428: 6/10/2012 7:42:19 PM - Windows Update RP429: 6/11/2012 9:08:02 PM - Windows Update RP430: 6/12/2012 10:34:30 AM - Windows Update RP432: 6/12/2012 11:29:23 AM - Microsoft Antimalware Checkpoint RP433: 6/12/2012 5:35:38 PM - Windows Backup . ==== Installed Programs ====================== . Adobe AIR Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Default Language CS3 Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe Flash Player 11 ActiveX Adobe Fonts All Adobe Help Viewer CS3 Adobe Linguistics CS3 Adobe PDF Library Files Adobe Photoshop CS3 Adobe Reader X (10.1.3) Adobe Setup Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS3 Brother MFL-Pro Suite MFC-490CW Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition Google Chrome Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) IHA_MessageCenter Intel(R) Graphics Media Accelerator Driver Intel(R) Matrix Storage Manager Java Auto Updater Java(TM) 6 Update 31 Malwarebytes Anti-Malware version 1.61.0.1400 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Application Error Reporting Microsoft IntelliPoint 8.1 Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Security Client Microsoft Security Essentials Microsoft SQL Server Compact 3.5 SP1 English Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Word 2002 Microsoft Works 2002 Setup Launcher Microsoft Works 6.0 Microsoft Works Suite Add-in for Microsoft Word MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK PaperPort Image Printer PDF-XChange Viewer PDF Settings PHOTOfunSTUDIO 5.0 QuickBooks QuickBooks Pro 2012 REALTEK RTL8187SE Wireless LAN Driver REALTEK USB Wireless LAN Driver Samsung Kies SAMSUNG USB Driver for Mobile Phones ScanSoft PaperPort 11 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition Spybot - Search & Destroy 1.4 SUPERAntiSpyware SupportSoft Assisted Service Synaptics Pointing Device Driver Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) Update for Microsoft Office 2010 (KB2494150) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Vz In Home Agent WhoCrashed 3.04 WinRAR 4.01 (32-bit) Works Suite OS Pack Works Synchronization . ==== Event Viewer Messages From Past Week ======== . 6/6/2012 11:19:35 AM, Error: Microsoft-Windows-PrintSpooler [6161] - The document CMO signed.pdf, owned by EC, failed to print on printer Brother MFC-490CW Printer. Try to print the document again, or restart the print spooler. Data type: NT EMF 1.008. Size of the spool file in bytes: 4007636. Number of bytes printed: 3175820. Total number of pages in the document: 3. Number of pages printed: 0. Client computer: \\DK-PC. Win32 error code returned by the print processor: 87. The parameter is incorrect. 6/12/2012 3:48:39 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 6/12/2012 2:45:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: (E60687F7-01A1-40AA-86AC-DB1CBF673334) 6/12/2012 2:25:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: (145B4335-FE2A-4927-A040-7C35AD3180EF) 6/12/2012 2:20:45 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter SASDIFSV SASKUTIL spldr Wanarpv6 6/12/2012 2:20:45 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 6/12/2012 2:19:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: (9E175B6D-F52A-11D8-B9A5-505054503030) 6/12/2012 2:19:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: (1BE1F766-5536-11D1-B726-00C04FB926AF) 6/12/2012 2:19:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: (DD522ACC-F821-461A-A407-50B198B896DC) . ==== End Of File ===========================
...See More
viruses on my computer
Q
Comments (7)
Kaths you have been infected by the antivirus xp virus this is a very nasty one and takes several steps to clean it, you will need to get these 3 programs and run each of them do not stop with one if it seems better do all of them. If you find you are not able to go to these sites to download the programs that means you have a more aggressive type and you will need to come back here and tell me that then I can lead you to another forum where we can help you with that clean up. for now go ahead and get these programs and run them they are all free. ATF-Cleaner.exe be sure you follow the directions as they apply to each type of browser you have. SUPERAntiSpyware Free Edition install it hit the update button tell it to scan your entire drive and allow it to clean anything it finds. Malwarebytes' Anti-Malware Please download Malwarebytes' Anti-Malware to your desktop. * Double-click mbam-setup.exe and follow the prompts to install the program. * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. * If an update is found, it will download and install the latest version. * Once the program has loaded, select Perform full scan, then click Scan. * When the scan is complete, click OK, then Show Results to view the results. * Be sure that everything is checked, and click Remove Selected. * When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt when you are done let me know how it is doing then we can go from there. Here is info on your infection. http://www.theregister.co.uk/2008/08/22/anatomy_of_a_hack/print.html
...See More
Beware of FAKE Microsoft virus message
Q
Comments (14)
just to help you realize how many of these fake Antivirus programs are around look at this blog which keeps tabs of them as they hit, and see how real they look. Please if any of you see these pop up on your computer do not click on anything!! instead do a control+alt+delete to get your task manager open and end task on your browser whether it be IE or firefox or what ever or just hit the shut down on the pc and restart it. If you did fall prey and gave them a credit card, immediately contact the credit bureaus and put a fraud alert on your card and notify the card company also, usually best to kill that card, that is after all what they are really after. the way these things work even hitting the x to close it will actually trigger the install of it. The scan they show that says you are infected is totally fake it is not real, it is not of your pc at all, everyone sees the same picture and that is what it really is, a picture. they are a bear to clean. If you find you need help please head over to the Computer help forum here, I am there daily helping and can lead to other sites to help you get cleaned up. Come see us (lots of good helpful folks there)before you spend money taking it somewhere we may well be able to get it straightened out. Here is that blog. Here is a link that might be useful: blog
...See More
User
10 years ago
I would try a reboot.

Often, a virus is contained in a link. To avoid those types of viruses, do not open links.

Someone sends you an email that contains a link, or you read something on gardenweb, and there is a link...do not open that link. Most of the time, that link is ok, but one time the link will contain a virus.

There are many companies selling anti virus protection.

Try rebooting.
Alisande thanked User
Vertise
10 years ago
Malwarebytes and ESET have free online scanners.
Alisande thanked Vertise
Alisande
Original Author
10 years ago
Thanks, all! I'll try Landzdown. I rebooted last night, but it didn't do anything.

I've been on the Internet since the 1980s, and am very cautious about clicking on unknown links. I don't know how this sneaked in.
Elmer J Fudd
10 years ago
I guided a friend through something like this, it wasn't too hard but what you have may be different.

First, clear the cache and all other history in the browser

Second, start the Task Manager and close the browser

Reboot, that may be enough.

What virus/security software are you using? It let you down, you should try another. Good luck.
Alisande thanked Elmer J Fudd
Sherry8aNorthAL
10 years ago
I run McAfee anti virus and I haven't had any problems clicking on anything. Every once in a great while, I will get a red screen that says "whoa you don't want to go there". That is the anti virus kicking in. One time it showed up and you couldn't close it, so I turned off the computer without shutting down and then restarted it. The anti virus kept it from reloading. You won't hurt these new systems by shutting off the power before closing down.
Alisande thanked Sherry8aNorthAL
ravencajun Zone 8b TX
10 years ago
This one many times is through a not updated Adobe product or Java If you have them on the computer they must be kept updated, Java, flash and Adobe. Just visiting a compromised website with these unpatched can allow automatic code runs. Usually the website doesn't even know.
Alisande thanked ravencajun Zone 8b TX
ghoghunter
10 years ago
I had it happen to my computer and the Geek squad fixed in in about 10 minutes. The Geek guy said it is a Browser virus and almost impossible to prevent. I don't know exactly how he fixed it but it took no time at all. Just rebooting doesn't do it.
Alisande thanked ghoghunter
lily316
10 years ago
I clicked on a link on FB. It was one of those below a major story. And this immediately happened to me. I was alone late at night, so I just shut down the computer immediately, waited , rebooted and it was fine.
Alisande thanked lily316
Sherry8aNorthAL
10 years ago
Don't click on any news story on Facebook. 99% are scams. clickbait. If you want to read one, go out to google or safari and search. Example: Cher gone at 70. FAKE. When I googled it, came up as a scam. ANYONE or ANYTHING can pay to put a "news" story on Facebook.
Alisande thanked Sherry8aNorthAL
socks
10 years ago
last modified: 10 years ago
For me, rebooting did not help, nor did task manager or Malwarebytes.
Alisande thanked socks
raee_gw zone 5b-6a Ohio
10 years ago
I had that happen once; I think that I rebooted in safe mode then ran avast to clear it.

Please come back and tell us the outcome!
Alisande thanked raee_gw zone 5b-6a Ohio
Cherryfizz
10 years ago
I think that was me that asked about it here. I followed Elmer's instructions, but had to reboot a few times. before it disappeared

There was nothing on any scans.
Alisande thanked Cherryfizz
fiveholetarget
10 years ago
last modified: 10 years ago
This works for me everytime when I get one of those messages.

I press Alt Control Delete keys at the same time.

Then I select Start Task Manager.

Select the Applications Tab.

Click on the browser that you are using from the list.

Select End Task at the bottom of the window box.

Then reopen your browser and make sure that you do not pick out setting that you want them to be restored to settings that were there before you forced close the browser.

This has worked for me every time.
Alisande thanked fiveholetarget
petalique
10 years ago
I've done what Elmer suggested. Be sure to delete history and cookies. Good luck.
Alisande thanked petalique
Alisande
Original Author
10 years ago
Fiveholetarget (what does your name mean?), I tried that when it first happened, but nothing changed.

I'm using only Microsoft Security Essentials on that computer. When I got the computer, my son (who works in IT) advised me not to load the Avast and other anti-virus, anti-malware programs I've used in the past--and that I still have on the computer I'm using to type this.

I won't have a chance to address the problem until tomorrow. I'm hoping by then it will have been solved using the Patient Mother Method. (That is, my hope is that my son will come over and fix it for me.) :-)

Many thanks for all your suggestions!
Elmer J Fudd
10 years ago
last modified: 10 years ago
Mothers are often bound to their son's advice, but I think there are many better choices than Microsoft Security Essentials. It's not highly regarded. A good program works in real time to monitor activity and intercepts undesired traffic, dangerous downloads, etc., in addition to simply scanning drives for known problems

If you want to restrict your choices to free ones, any of the "A's" - Avast, AVG, Avira - should all work fine for you. Here's an independent review from a respected source

Free Security programs

Others are very capable and offer wider services. Most can be obtained for less money than shown, and many ISPs provide a quality product for free. I get Norton free from Comcast

Not free security programs
Alisande thanked Elmer J Fudd
Alisande
Original Author
10 years ago
Well, the Patient Mother Method worked--sort of. I came home from a jazz concert to find my computer up and running and problem-free. I called my son to thank him, and learned that he found nothing wrong. The fake alert had gone away, and web browsing was normal. Maybe shutting it down that long did the trick?
petalique
10 years ago
last modified: 10 years ago
Good! I thought that is was pretty much designed to get a user to click on the link and or dial the proffered phone number. If a user calls that number they are instructed to go to a site and download ... In other words, get infected.

SOCKS, Is your white pup dog a Westie? Adorable! Pics?
Alisande thanked petalique
socks
10 years ago
Great, Alisande. Maybe the baddies lost interest in you because you didn't follow instructions and call!

Petalique, yes, he's a Westie. I'll post a pic over on today's photos.
Alisande thanked socks
Elmer J Fudd
10 years ago
Shutting a PC off for 5 minutes and then restarting it is the same as shutting it down for 5 days before restarting it. I'm sure there are things for which your patient mother approach can work but I don't think this is one.

I'm glad the problem went away (although it could come back). Don't forget to upgrade your security software.
Alisande thanked Elmer J Fudd
Alisande
Original Author
10 years ago
Well, my son discovered that this computer has not been updating automatically. In fact, my last update was in March! This could explain how the malware could take hold. I need to run a Windows Defender scan, but not until I've received all the updates. I downloaded and ran Windows Update Troubleshooter, which said the source of the problem was Service Registration is Missing or Corrupt. The troubleshooter couldn't fix it automatically, so I need to find out how to do it another way. Mañana, as I'm tired tonight.
Vertise
10 years ago
'Some virus and malware software can disable the Automatic Updates Service and cause this issue. To resolve this issue, use the following methods ... '

http://answers.microsoft.com/en-us/windows/forum/windows_other-update/automatic-updates-have-been-disabled-on-my/6103ebd7-f39c-4230-8cb3-18658d5e738a
PKponder TX Z7B
10 years ago
last modified: 10 years ago
Back up your data to a flash drive and repair your operating system or return it to system defaults. There is probably a recovery partition available if you press the correct function key at startup. You'll need all of your licensed software keys or license numbers before you start so that they can be downloaded and reinstalled afterward. This process sounds harder than it really is. Let me know the model number and OS of the computer if you'd like details or a walk-through.
Alisande
Original Author
10 years ago
Update: All is well, as far as I can tell. I discovered that my computer was set to never look for updates. I don't know how that happened, but there it was. Once I changed it, there was a lot of looking for updates, and a lot of downloading and installing--a couple of days worth.

The updates solved my Adobe Flash issue. Flash had disappeared, and Adobe said it installs and updates in Chrome automatically. Well, not if your computer is told not to look for updates. Now Flash is back. :-)

How to remove fake virus alert jamming my computer?

socks

Comments (26)

ravencajun Zone 8b TX

Related Discussions

User

Vertise

Alisande
Original Author

Elmer J Fudd

Sherry8aNorthAL

ravencajun Zone 8b TX

ghoghunter

lily316

Sherry8aNorthAL

socks

raee_gw zone 5b-6a Ohio

Cherryfizz

fiveholetarget

petalique

Alisande
Original Author

Elmer J Fudd

Alisande
Original Author

petalique

socks

Elmer J Fudd

Alisande
Original Author

Vertise

PKponder TX Z7B

Alisande
Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

How to remove fake virus alert jamming my computer?

Comments (26)

Related Discussions

AlisandeOriginal Author

AlisandeOriginal Author

AlisandeOriginal Author

AlisandeOriginal Author

AlisandeOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Alisande
Original Author

Alisande
Original Author

Alisande
Original Author

Alisande
Original Author

Alisande
Original Author