Webroot scan did not find malware. However I got a message from microsoft security essentials alert that
my computer has adware, trojan and hack tool that should be removed.
I suggest webroot users use "Microsfot Safety Scanner" to check for malware.
Scanner is temporary.
I have Windows 7 home
Solved
check for malware
Best answer by EamonF
Hi Renie67,
You have most likely seen a fake Windows Security alert that is quite common at the moment from multiple different sources. These are websites that prompts you to download a malicious file to your computer by faking the look of a legitimate Microsoft application. This fake antivirus called Microsoft Security Essentials can be seen below:
It is always advised to forced close your browser (via Task Manager or Close Button) if this occurs and report the URL in the address bar to ourselves so we can block it for all users. I would also recommend making sure your Adobe Flash and Java is up to date and that you use a more secure web browser such as Google Chrome or Mozilla Firefox.
View originalYou have most likely seen a fake Windows Security alert that is quite common at the moment from multiple different sources. These are websites that prompts you to download a malicious file to your computer by faking the look of a legitimate Microsoft application. This fake antivirus called Microsoft Security Essentials can be seen below:
It is always advised to forced close your browser (via Task Manager or Close Button) if this occurs and report the URL in the address bar to ourselves so we can block it for all users. I would also recommend making sure your Adobe Flash and Java is up to date and that you use a more secure web browser such as Google Chrome or Mozilla Firefox.
If you think your computer is infected, please Open a Support Ticket so that we can get you in touch with one of our support technicians. Our advanced malware removal is free, and it is better to be safe than sorry if you think for any reason you may be infected.
Even if Webroot misses a threat, we have advanced rollback and remediation technology that journals all of the actions of unknown programs/files which we can then revert and remediate.
Even if Webroot misses a threat, we have advanced rollback and remediation technology that journals all of the actions of unknown programs/files which we can then revert and remediate.
Mike R Social Media Manager
Without looking at the logs I am guessing thats its the fake Microsoft Safety Scanner that is doing the rounds at the moment. The removal tool is actually an infection that WSA always catches. It will be called "Security Scanner[1].exe" and you should see it in the scan logs of Webroot if you tried to save it. If you submit a log I can confirm this. In anycase I would not visit that site anymore as its either infected or has a malicious link in it.
I agree with Mike. Not to worry. WSA has rollback and remediation tech. And moreover the support team offers free malware removal. Those are at the top of the reasons why I love WSA so much.:)
- OpenText Employee
- 69 replies
- Answer
Hi Renie67,
You have most likely seen a fake Windows Security alert that is quite common at the moment from multiple different sources. These are websites that prompts you to download a malicious file to your computer by faking the look of a legitimate Microsoft application. This fake antivirus called Microsoft Security Essentials can be seen below:
It is always advised to forced close your browser (via Task Manager or Close Button) if this occurs and report the URL in the address bar to ourselves so we can block it for all users. I would also recommend making sure your Adobe Flash and Java is up to date and that you use a more secure web browser such as Google Chrome or Mozilla Firefox.
You have most likely seen a fake Windows Security alert that is quite common at the moment from multiple different sources. These are websites that prompts you to download a malicious file to your computer by faking the look of a legitimate Microsoft application. This fake antivirus called Microsoft Security Essentials can be seen below:
It is always advised to forced close your browser (via Task Manager or Close Button) if this occurs and report the URL in the address bar to ourselves so we can block it for all users. I would also recommend making sure your Adobe Flash and Java is up to date and that you use a more secure web browser such as Google Chrome or Mozilla Firefox.
Hi Renie67,
To add to Eamon's and Rakanisheu's points, we've actually posted about this type of scan very recently on our Webroot Threat Blog. It's an informative and interesting read that helps you avoid these fake AV scams and stay protected should you encounter one.
To add to Eamon's and Rakanisheu's points, we've actually posted about this type of scan very recently on our Webroot Threat Blog. It's an informative and interesting read that helps you avoid these fake AV scams and stay protected should you encounter one.
+56Hello EamonF and Welcome to the Webroot Community Forums.
Nice to see more Threat Researcher's on the Forums! ;)
Cheers,
Daniel
Nice to see more Threat Researcher's on the Forums! ;)
Cheers,
Daniel
Hello EamonF! Welcome to the Community, I hope we continue to see you on here!
I've noticed renie67 has WSA and the allegedly fake MS scanner. The fake AV is causing the prob.
WSA will remove the fake AV once it's blacklisted and rollback the changes. If the fake AV has already been known to exist for sometime and WSA team is aware and have probably blacklisted why did WSA not catch the AV? So if I happen to get the fake AV by mistake do I have to contact support to remove it? Will WSA not prevent it or detect it after a scan and remove it?
WSA will remove the fake AV once it's blacklisted and rollback the changes. If the fake AV has already been known to exist for sometime and WSA team is aware and have probably blacklisted why did WSA not catch the AV? So if I happen to get the fake AV by mistake do I have to contact support to remove it? Will WSA not prevent it or detect it after a scan and remove it?
You dont have to contact support to remove it, normally we automatically catch these Fake AV`s. You can always use the manual removal option or use the block option in detection configuration. You also have to remember that although it may look the same it may be a completely different infection. Some of these Fake AV`s can be custom built very easily where you can just pick a displayed image and payload.
Hello EamonF, Welcome to the Webroot Community Forum. :D
Happy to see another Threat Researcher here on the forum. 😉
Happy to see another Threat Researcher here on the forum. 😉
Late 2015 ~ 5K ~ 27 inch iMac ~ macOS Catalina 10.15.7 ~ Clone & Backup with: SuperDuper - Time Machine & iCloud. PWM: RoboForm. 👁¿👁 Spam Annihilater 👁¿👁
1 person likes this
Reply
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.