FAQ > Questions > Beware of the Fake Microsoft Essentials Security Trojan

Search the FAQ for entries containing:

What this infection does:

The fake Microsoft Security Essentials Alert is a Trojan that attempts to trick you into thinking you are infected so that you will then install and purchase one of 5 rogue anti-virus programs that it is distributing. When the Trojan is run it will masquerade as an alert from the legitimate Windows Microsoft Security Essentials Program anti-virus program. This alert will be titled Microsoft Security Essentials Alert and states that a Trojan was detected on your computer. It will list this Trojan as Unknown Win32/Trojanand state that it is a severe infection. It will then prompt you to clean your computer using the program in order to remove it. When you click on the Clean Computer or Apply actions button, it will state that it was unable to remove it and then prompt you to scan online. If you click on the Scan Online button it will list 35 different anti-virus programs, 30 of which are legitimate anti-virus programs and 5 that are rogues that the Trojan is distributing. These five rogue programs are:

  • Red Cross Antivirus
  • Peak Protection 2010
  • Pest Detector 4.1
  • Major Defense Kit
  • ThinkPoint
  • AntiSpySafeguard or AntiSpy Safeguard

During this fake online scan only the 5 fake anti-virus programs listed above will state that this supposed Trojan is an infection. It does this to scare you into clicking the Free Install button next to them that will install the rogue program onto your computer and then reboot your computer. It should be noted that Red Cross Antivirus, Peak Protection 2010, Pest Detector 4.1, Major Defense Kit, AntiSpySafeguard, ThinkPoint, and AntiSpy Safeguard that this Trojan is distributing are exactly the same. They just have different names and different graphical user interfaces. You can see images of each of the above rogues below.

 

After your computer is rebooted, the rogue that was selected will automatically start and perform a fake scan on your computer. When it has finished it will state that it was able to clean numerous files, but was not able to clean some files, such as iexplore.exe, until the program is purchased. While running, this program will also terminate many programs when you attempt to run them and display a message stating that they are infected. This message is:

 

  • The application taskmgr.exe was launched successfully but it was forced to shut down due to security reasons.
  • This happened because the application was infected by a malicious program which might pose a threat for the OS.
  • It is highly recommended to install the necessary heuristic module and perform a full scan of your computer to exterminate malicious programs from it.

 

Furthermore, these rogues will also display security alerts from your Windows taskbar that display messages such as:

Warning! Database updated failed!
Database update failed!
Outdated viruses database are not effective can't guarantee adequate protection and security for your PC! Click here to get the full version of the product and update the database!

Warning! Running trial version! The security of your computer has been compromised! Now running trial version of the software! Click here to purchase the full version of the software and get full protection for your PC!

All of these security alerts, like the scan results, are fake and should be ignored.

As you can see, this Trojan was created to trick you into thinking that you are infected so that you will then download and install one of its rogue anti-virus programs. If you have been tricked by this Trojan and installed Red Cross Antivirus, Peak Protection 2010, Pest Detector 4.1, Major Defense Kit, ThinkPoint, AntiSpySafeguard, or AntiSpy Safeguard then do not purchase it for any reason. If you have already purchased one of these programs, then I strongly suggest you contact your credit card company dispute the charges stating that it is a scam and a computer virus. Finally, to remove the fake Microsoft Security Essentials Alert and the related rogues, please use the removal guide below.

 

Last updated on October 29, 2010 by CompuTrain User