Fake MSE-alert

[mdcyclist]

Good morning,

Yesterday I received a security alert from MSE. Unfortunately I ended up downloading something named Antispy Safeguard. It claims to be the world's leading security solution. And now it has taken over my startup. It also stops me from loading Microsoft Explorer until I download its' heuristics module. In order for me to continue the Antispy program is trying to extort $70 for a year's support. I have found no way around this devil. Can you assist?

 

[hackerman1]

hi !

that security alert was NOT from MSE !

it sound like a false antivirus (rogue) that pretends to be MSE.
there are som nasty rogues nowadays.

i suggest you create a NEW thread, and ask for support.
a tip: as subject write "Fake MSE-alert" or similar so you get attention....

 

[mdcyclist]

thank you. sorry to have disturbed you.

 

[z3r010]

Moved to own thread.

 

[sygnus21]

Good morning,

Yesterday I received a security alert from MSE. Unfortunately I ended up downloading something named Antispy Safeguard. It claims to be the world's leading security solution. And now it has taken over my startup. It also stops me from loading Microsoft Explorer until I download its' heuristics module. In order for me to continue the Antispy program is trying to extort $70 for a year's support. I have found no way around this devil. Can you assist?

Hi mdcyclist, Welcome to seven forums.

Read/Try this - AntiSpy Safeguard - how to remove

 

[thathagat]

try this first-d/l mbam and hitman pro and scan

 

[Richy1204]

It seems like I've got the same virus

When booting into windows i get a black screen with a pop up box showing this Antispy Safeguard it tells me to scan etc,,,

Trying to remove it now with with antivirus software I'll see how it goes :sarc:

 

[Teerex]

If these infections appear out of thin air (as opposed to clicking on something or opening a downloaded file of any kind), people should consider (at the earliest possible date) saving their data & settings with Easy Transfer Wizard, deleting all partitions, repartitioning the disk and reinstalling Windows. More and more rootkits (deep infections) try to monetize their control over your system by downloading and installing ransom schemes like these. However, even if you remove these adiitional malware infestations, the rootkit is still in control of your system and you can consider none of your passwords and presonal details safe any more.

 

[Lemur]

If these infections appear out of thin air (as opposed to clicking on something or opening a downloaded file of any kind), people should consider (at the earliest possible date) saving their data & settings with Easy Transfer Wizard, deleting all partitions, repartitioning the disk and reinstalling Windows. More and more rootkits (deep infections) try to monetize their control over your system by downloading and installing ransom schemes like these. However, even if you remove these adiitional malware infestations, the rootkit is still in control of your system and you can consider none of your passwords and presonal details safe any more.

Nope, these are a result of social engineering. It fools the user into thinking they must click on something. In the case of the rogue MSE, even savvy users might be tempted to click on the "x" to close it out. But that will also install the virus or malware.

 

[Layback Bear]

I try to teach people don't touch anything in the pop up. Don't even have your cursor over it. Shut your computer down. Start it up again and scan with your security systems.

 

[Teerex]

If these infections appear out of thin air (as opposed to clicking on something or opening a downloaded file of any kind), people should consider (at the earliest possible date) saving their data & settings with Easy Transfer Wizard, deleting all partitions, repartitioning the disk and reinstalling Windows. More and more rootkits (deep infections) try to monetize their control over your system by downloading and installing ransom schemes like these. However, even if you remove these adiitional malware infestations, the rootkit is still in control of your system and you can consider none of your passwords and presonal details safe any more.

Nope, these are a result of social engineering. It fools the user into thinking they must click on something. In the case of the rogue MSE, even savvy users might be tempted to click on the "x" to close it out. But that will also install the virus or malware.

Well, as I said.. Only if 'out of thin air'. If it's not too much trouble, even in cases like these.

Here be fresh blogpost, with screencaps, in French.

 

[sygnus21]

Nope, these are a result of social engineering. It fools the user into thinking they must click on something. In the case of the rogue MSE, even savvy users might be tempted to click on the "x" to close it out. But that will also install the virus or malware.

Nice point. That's why it's also equally important not to just arbitrarily click "OK" on things, even if you think it's safe, it doesn't hurt to have a second look before that final click.

I tend to scan stuff I download before installing, even though it has been scanned during the download process. You never know. And as pointed out, even savvy users can get got.

 

[Thorsen]

I saw something similar to this. I was browsing Google Images for *Nix desktops and one of the pages was a re-direct. It ran an animated gif that looked exactly like MSE and threw up a pop-up prompting me to download a scanner for my computer. I have delt with these in the past so I knew it was a scam. I force-closed all windows and scanned with Malware-Bytes and MSE and found nothing. I am glad I didn't click on it.

All from just browsing google images.....

Be careful out there friends!

And good luck to you mdcyclist and Richy1204.

I always have two programs hotkeyed and ready for use. They are not for removal of malware, but can free up resources quickly or stop programs from running while trying to get rid of the threat.

Autoruns (for list of all programs and files running at startup):
Autoruns for Windows


Process Explorer (for list of all programs and files currently running in realtime):
Process Explorer

 

[Corrine]

The instructions at Bleeping Computer work for the Fake MSE. See Remove the Fake Microsoft Security Essentials Alert Trojan and AntiSpySafeguard.