Unsolved
This post is more than 5 years old
1.1K Posts
0
25835
The following purport to be from "Microsoft Security Essentials" I think, What do you feel?
While my wife was on e-bay site shopping-rather browsing, the following screen suddenly pop up.. Thankfully she did not click on the request, but left all opened screens remain as they are until my arrival from work (she stopped the surfing)
All on face value look authentic & genuine. I did not click on the link with the warning to remove the pending threat as suggested but open the Microsoft Security Essential to run a scan. This scan did not find any pending threat that need the removal.
I then run my free Malwarebytes Anti Malware and this did not find any threat either.
My suspicion is the authentic looking screen removal request was something else masquerading as Microsoft Security Essentials. Few days back on the patch Tuesday I installed the MSE 4.4.304.0 (kb 2902885) the latest version became available from Microsoft.
Can some one tell me if any threat is possibly lingering on the background? What is your opinion.
Regards
ky331
3 Apprentice
3 Apprentice
•
15.2K Posts
0
November 14th, 2013 06:00
The word "might" was misspelled (as "migth"), which is a subtle hint that something was amiss.
I'm surprised that MBAM didn't pick-up anything... assuming the threat-screen was still open/"running" at the time of the MBAM scan.
snowshine
1.1K Posts
0
November 14th, 2013 06:00
Thank you Joe & ky331.
@Joe-My Wife is chuffed with your remark!! [I am jealous Ha Ha}:emotion-2:. Thank you for that link.
@ky331-You have hawk-eye. I looked for any such spelling mistakes and did not identify the one you've spotted. By the time I ran Malwarebytes, the browser screen was shut. That would explain why it did not detect. I prior to run the Malwarebytes, update to the latest by the way.
We keep our fingers crossed and watch for next few hours !1
Thank you both of you. It is something if you already do not know : It is so greatly appreciated and very thankful to your time.
Regards
joe53
1 Rookie
1 Rookie
•
5.8K Posts
0
November 14th, 2013 06:00
snowshine:
See this:
http://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/mse-alert-potential-threat-details-trojan/5850842b-e754-45bd-875f-87f185222890
Your wife was smart in taking no action!
joe53
1 Rookie
1 Rookie
•
5.8K Posts
0
November 14th, 2013 11:00
Snow:
(Although I'm familiar with most British terms, I must confess I was worried about "chuffed" til I looked up its meaning! But I digress ...)
Your original question raises a good point however - how does one distinguish between a true AV alert and a well-crafted imposter alert? I confess I missed the spelling error of "might" as well. Another clue was that MSE alert levels are Low, Medium, High, and Severe. But never "Critical". Also there was no "Details" button, which specifies the file path to the infected object. Otherwise that bogus alert looked pretty convincing.
To be honest, I not sure what the valid alert popup in the current version of MSE even looks like. I don't think I ever got one while browsing with earlier versions of MSE. Your instincts were good to just close it, which is what I always do with unexpected popups. Even doing this can be hazardous if you just click on the x in the upper right corner: some are crafted to trick you into downloading malware this way. I always close popups using the Alt-F4 key combo, or close the browser via Task Manager, before running a scan or 2.
snowshine
1.1K Posts
0
November 14th, 2013 12:00
Hi JOE,
Those are excellent points. Those will help anybody novice like ourselves.
We tend to browse the web pretty carefully & follow basic safety suggestions that learnt from individuals like yourself. Despite our effort to avoid any eventuality, my wife had a shock to see the above today and was in a state of panic when arrived. Anxious moments did not end in her clicking on the suggestion. However alls well that end well
I was a little concerned when I read the information on your link, in that I did not shut down my browser -popup through Alt-F4. That for future I will definitely follow. My computer behaving normally I have done the MSE scan twice and no threats were identified.
Thanking you again