Fake Microsoft alert

Avast Free Antivirus / Premium Security
1

I just received a full screen fake alert claiming to be from Microsoft, which I couldn’t shut down for a while:

Incorrectly claimed the software was pirated. It is not, was activated on the phone by Microsoft.

“This computer is blocked” “Do not close this window and restart your computer” “Your computer’s registration key is blocked”

Telling me to call a given number.

XP SP3 / Avast Free Antivirus 18.5.2342 / Virus definitions version: 181210-6 / CryptoPrevent

I plan to run Malwarebytes + Avast scans. Please advise. I cannot update the operating system.

Afraid to turn the computer off in case it doesn’t restart!

2

Sounds like one of the typical fake scam alerts that pop up time to time on certain webpages, once they block the browser from closing it’s generally easier to use Task Manager to end the Browser process and clean out Browser temp files with CCleaner or similar.

3

I see. Thank you for helping CraigB.

I couldn’t shut it down with Task Manager either for a while, but did eventually.

It alarmed me - thought that was the end!

About to run Malwarebytes.

4

Update: Malwarebytes long scan result including rootkits - No malware found.

Wasn’t sure what I was dealing with at the time…a friend lost her computer to ransomeware.

5

As CraigB eluded too, the issue would be in your Browser, not your OS.
Try following his instruction in the post and clean up your Browser. :slight_smile:

6

Thank you for further putting my mind at rest schmidthouse…I will follow CraigB’s instruction and clean up my browser. :slight_smile:

7

You’re welcome. :slight_smile:

8

Something has been done to the os.

I just had a “The system has recovered from a serious error” notification after turning off and restarting my computer.

Believe it blue screened and restarted while I was out of the room.

9

I wouldn’t worry to much if the system is working fine now, there could have been a small incompatibility of Malwarebytes or some other running program.

10

Thanks for answering CraigB

Since the incident the right hand side of the screen / any window I open quivers / moves rapidly left to right? Never seen this before.

Not had a BSOD for a long time - computer was running well.

11

Alicia, if having further issues you may wish to visit the Viruses and Worms board, read through the Logs to assist with cleaning topic at the top of the board and supply the required logs for one of the Malware team to look over for you.

12

Definitely do what CraigB ^ recommends first and do nothing else to try and fix it yourself until someone there helps. But if they find nothing untoward and the trouble persists:-

Do you have a pre-incident restore point? Might be worth trying to see if it fixes the described problem. It can always be undone.

Whether it does fix the trouble or not I’d also put in a restore point and then run System File Checker ie. Run > sfc /scannow. That can fix corrupted systems files which maybe what the symptoms described are being caused by. It should not do any harm and, again, with the restore point you can always go back.

13

As CraigB suggested, FIRST go here and follow instructions and one of our malware experts will assist.
https://forum.avast.com/index.php?topic=194892.0

14

Thank you all, your help is much appreciated. I have already carried out a System Restore back to the 11th December and intended to carry out sfc / scannow, but will seek help first as soon as I have time.

Screen / windows are still shaking slightly.

Written on the malicious screen, along with what I already mentioned…

“Virus alert”

For several reasons - I do not have Behavio(u)r Shield turned on…perhaps that would have stopped it?

15
For several reasons - I do not have Behavio(u)r Shield turned on.......................[b]perhaps that would have stopped it?[/b]
No, it is just a FakeAlert on a website

A ton of screenshots here:

https://www.google.com/search?q=microsoft+fake+alert&rlz=1C1JZAP_noNO713NO713&source=lnms&tbm=isch&sa=X&ved=0ahUKEwj7z93R453fAhXisYsKHfDVBhAQ_AUIDigB&biw=1600&bih=758

16

Thank you for answering my question Pondus…

Wondering why I had the BSOD on reboot and now have a shaking screen??

17

Follow instructions / link posted by @schmidthouse in reply #12
attach the requested logs and a expert will take a look

18

Hi alicia.rose,
I would like to ask you for MEMORY.DMP to find out which driver caused your BSOD.

Some information from the picture you attached :
Bug Check 0x50: PAGE_FAULT_IN_NONPAGED_AREA
Referenced address : 0xe27ac000
Module address: 0xf52625b0
It means that a driver (0xf52625b0) tried to read from memory 0xe27ac000.

1)Locate a dump file :
The default location of the dump file is %SystemRoot%\memory.dmp i.e C:\Windows\memory.dmp if C: is the system drive. Windows can also capture small memory dumps which occupy less space. These dumps are created at %SystemRoot%\Minidump.dmp (C:\Window\Minidump.dump if C: is the system drive)
2) Zip it as alicia_rose_bsod_12_2018.zip
3) Upload the zip file to ftp://ftp.avast.com/incoming

Thank you !

19

Hello kwiq,

Thank you very much for helping me.

I have the Minidump / zip file, but cannot click anywhere on the page you asked me to upload it to other than ‘Up to higher level directory’?

Thank you Pondus.

20

Uploading files to the Avast FTP server >> https://support.avast.com/en-ww/article/FTP-file-upload