Suspicious AntiVirus Alert Popped Up on Web Page

Anonymous

I am suspicious about messages that popped up when I went to a web page I'd never been to before. First a message popped up stating "Microsoft Antivirus has found critical process activity on your PC. You need to clean your computer to prevent system breakage." And then right afterwards another message appeared -- I might have pressed okay -- in a rectangular box with a thick red stripe across the top that read "Potential Threat Details," and then below "Microsoft Security Essentials detected potential threats that might compromise your privacy or damage your computer. You need to clean your computer immediately to prevent the system crash." But I noticed that "might" was spelled "mihgt." Then below that it listed the threats as:

Trojan PSW.Win32Launch

HackTool:Win32/Welevate.A

Adward.Win32Fraud

It said each of the three was "critical" and "active" and recommended I "remove" them.

Then below all this was a box I could check that said "clean computer."

Now aside from the misspelling of "might," I do not have Microsoft Security Essentials; I have Windows Defender, so I'm pretty sure this is a fake alert.

And I didn't press "clean computer." But I'm wondering what would have happened if I had; would I have gotten a virus, or a sales pitch to buy more antivirus software? But mostly I want to know what really will happen when my antivirus program -- which, again, is Windows Defender for Windows 8 -- does detect a real virus. It hasn't happened yet so I don't know, and I also would like to be able to distinguish the real alerts from the fake ones, especially if the fake ones do not have misspelled words as a telling sign.

Thanks

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

It is a fake alert and creater of that alert can enter as many virus names as he/she can, don't worry about that alert. Just practice safe browsing, do not click on Ads (specially of unknown source), always use original software and download them from their genuine sites only. Run scans from the tools you downloaded, and use free version only (neither Pro nor Trial).

About Trojan in quarantine-

Items in quarantine are neutral and cannot harm your PC, just like criminals in jail. There is no need to delete items in quarantine. You can also run a full scan of your PC to ensure no virus is lurking in your PC.

0 comments

Answer accepted by question author

Anonymous

As per your description above, except for the part... "it said it couldn't do much with that"... (Don't know what you mean by this?)

When someone tries to close AdwCleaner after clicking on 'Search' button then AdwCleaner alerts that it has only scanned for Adwares, not removed them and asks to click on 'Delete' button to complete removal. This is what he is trying to say.

0 comments

71 additional answers

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more
Anonymous

2013-05-12T18:50:41+00:00

Rick CP,

Aha, now this was interesting -- at least to me -- and I now realize what I did.

I initially pressed the link (Adwcleaner) PrashantKumar96 kindly supplied, which I'm sure was safe, and it took me to bleepingcomputer.com, where I saw the author was Xplode for AdwCleaner. Then I pressed where it said "Download Now" while noticing there was another "Download Now" for a Zip Drive in the banner above. When I got to the next page, which I thought was for AdwCleaner, I instead pushed what was on top of it again, which this time was Reimage, which I'm also sure was from BleepingComputer.com, a respectable site, so I was not worried about being infected.

I did some reading afterwards. and apparently a lot of alternative downloads are put in the banner strip above the original download the person came to the site for. I'm not sure why that is.

Anyway, the Reimage did not give me C:\AdwCleaner[S1].txt, but I soon uninstalled it -- that was what charged $69 -- and went back for Xplode's original AdwCleaner and saw the .txt log file after downloaded it. (Uh oh, while I'm writing this I'm repeating the steps I did yesterday and now a warning showed up that said the "publisher of this file cannot be verified" -- I don't remember that from yesterday, but I'm repeating exactly what I did then.

So I'm going to stop with the entire reenactment now, but if I remember correctly, AdwCleaner showed up in a rectangular box with different options. First I pressed "Search," and it said it couldn't do much with that, so then I pressed "delete" and something ran and then it asked me to restart my computer, and then a list came up with what it deleted. But I do remember the .txt file was on this page.

However, afterwards things were a bit different on my computer -- but nothing I got too concerned over: the background color changed a little, I had to reinstall Google Chrome (but I'm not sure that wasn't due to something else I installed yesterday), and View Point Media Player (AOL based) kept popping up with a message asking to be installed. I'm assuming it had been deleted.

So I went back into Add/Remover programs to remove the AdwCleaner but it wasn't there, and it's still not. That's a concern because I thought I had downloaded it, and now it's double a concern because I just saw (2 minutes ago) that the publisher isn't verifiable -- yet this was all on bleepingcomputer.com, which I think is reputable, and all from the link I originally pressed here.

I'm not sure what to do now. I also don't know how to find the .txt log file -- I saw it only on the page that popped up about the deletes after the restart. And I keep putting it in Search on the Start Menu, but nothing shows up.

Should I be concerned that I can't find AdwCleaner in the program list, especially when it said it was downloading yesterday?

Thanks for your help.
Was this answer helpful?

0 comments No comments
Anonymous

2013-05-12T18:13:41+00:00

Thanks again for your comprehensive reply. I still hadn't gotten to the article

Windows Defender on Windows 8 - Introduction and Frequently Asked Questions

because I was reading the others, which were all excellent. Yesterday, I removed AVG and its accessories because I'm used to Windows Defender, but it was a good learning experience.
Was this answer helpful?

0 comments No comments