FAKE BSOD - Windows 10 x64

Win10 Puzzled · Aug 12, 2015

This is the original message I submitted to the Windows Secrets Lounge:
____________________
"Blue screen requesting to contact Microsoft Technician

I switched to Win 10 in the hope that I could eliminate some security issues.

First, I got infected with a browser hijacker under Win 8.1 that sent my default browser addresses in Chrome and Internet Explorer to:
http://usa-aa.s3-website-us-east-1.a...ws.com/?grp=10, by attaching itself to the end of the default address, like this:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" http://usa-aa.s3-website-us-east-1.a...ws.com/?grp=10.

I found out how to eliminate the added address and go back to my defaults, however I just could not stop this from reoccurring.

Second, I also was infected by a message that I felt was a scam. It opens a blue screen with several lines of text indicating that:

“A problem has been detected and your PC has been stopped to prevent damage.
0x00009af8 DRIVER_IRQL PENDING OPERATION
COMPUTER HEALTH IS CRITICAL
DO NOT RESTART
. . . . .ETC”

And ends by making a request to contact a Microsoft Certified Technician and a toll free number.

I didn’t heed the request and restarted. The process repeated itself several times and I could not find any other solution than restarting, until I found that by using the Sign Out option in the CTRL + ALT + DEL call for Task Manager, I could go back to the screen prior to the message and continue working.

After any of the two occurrences I would run Malwarebytes Anti-Malware, Spybot and ADW Cleaner, plus CCleaner, although the first two are scheduled to run periodically.

Once I switched to Win 10, the hijackers apparently stopped, but the blue screen is back again, which has given me the reason to send this message to seek some help.

Thanks."

__________________

Later on I found out that the message itself provides a way out by means of the ESC key, which I had not seen before.

Member 'satrow' suggested I contacted you, which is what I am doing with this message.

In regards Point 5 BSOD Posting Instructions, here are some answers:

· OS - Windows 10
· x86 - x64
· Originally came with Windows 7 OEM. I replaced it with Retail Win 8 and later upgraded to Win 8.1
· Age of system (hardware) - 3 years
· Age of OS installation - I re-installed the OS in March 2014
· System Manufacturer - HP
· Exact model number - g7 1070us
· Laptop or Desktop? - Laptop

I have an older HP dv9005us laptop that I am still using with Win 7, waiting to resolve this issue to upgrade it to WIn 10.

Thank you very much for your assistance.

Jared · Aug 12, 2015

Could you take a picture of this fake BSOD?

There are no dump files, so it doesn't look like anything happened in terms of a crash.
We've had a couple of these things recently. Malware related.

Win10 Puzzled · Aug 13, 2015

Jared said:
Could you take a picture of this fake BSOD?

There are no dump files, so it doesn't look like anything happened in terms of a crash.
We've had a couple of these things recently. Malware related.

Thanks for your answer. Attached is a pic of the message

Tekno Venus · Aug 15, 2015

Hi,

This is almost certainly malware. Please create a thread in the Security Arena and follow the posting instructions to gather the required logs: https://www.sysnative.com/forums/security-arena/2507-malware-removal-posting-instructions.html

Stephen

Search

Search

FAKE BSOD - Windows 10 x64

Win10 Puzzled

Member

Attachments

Jared

Sysnative Staff, BSOD Kernel Dump Expert

Win10 Puzzled

Member

Attachments

Tekno Venus

Senior Administrator, Developer