Windows Legacy OS forum

General discussion

I keep getting a Pop Up saying "Windows Security Alert"

by sshaver / September 4, 2007 10:17 AM PDT

I am running Windows XP on a Compaqnc6000 - Every 5 minutes a pop up keeps showing up saying "Windows Security Alert" Then in the Body it says "Warning Potential Spyware Operation! Your computer is making unauthorized copies of your system and internetfiles. Run full scan now to pervent any unauthirised access to your files! Click YES to download spyware remover" All of this is even with the misspelling - Does anyone know how I can stop that from popping up?

Discussion is locked
You are posting a reply to: I keep getting a Pop Up saying "Windows Security Alert"
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: I keep getting a Pop Up saying "Windows Security Alert"
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
by caktus / September 4, 2007 1:10 PM PDT

Don't "Click YES to download spyware remover"

In the messages you are receiving, do any refer to a web page, URL, or anything about the product other than "spyware remover"?

Are you getting any related notices in the Task bar next to the clock?

Go to Start > Run > type "msconfig" w/o the quotes and click OK. Click on the Startup tab and see if any items in the list seem suspicious or relate to the problem? If so, uncheck it/them and click Apply > OK > restart the computer.

Also, go to Start Control Panel > Add or Remove programs and do the same.

Also, go to Start > All Programs and do the same.

If you are unsure as to rather you should remove anything, then don't. And post them here in the forum.

Have you run any Anti-virus/spyware programs? If not, it certanly would not hurt to do so.


Collapse -
scuriy alert pop uo
by christina4835 / August 16, 2008 12:45 PM PDT
In reply to: reply


Collapse -
Windows Security alert
by neubroch / April 5, 2009 6:18 AM PDT
In reply to: reply

Spybot removed popup. Thank you.

Collapse -
Windows Security Alert
by wcern / April 12, 2010 12:25 PM PDT
In reply to: reply

When following the directions how do I know what to delete?
Everything for the command is C:\programs or C:\windows. But there are four items that are different, example Start up item: RECGUARD, command %WINDIR%\SMINST\.....
Any ideas please?
thank you

Collapse -
security alert
by magickcat / April 21, 2010 12:08 AM PDT
In reply to: reply

I am having the same problem as the oroginal poster, but I can't open anything. Spybot, adaware, nothing. I did the "msconfig" thing you mentioned.. well, I tried to... and it won't let me.

Collapse -
Re: security alert
by Tufenuf / April 21, 2010 1:01 AM PDT
In reply to: security alert

magickcat, Follow the instructions under:

Automated Removal Instructions for XP Security Tool 2010, XP Defender Pro, Vista Security Tool 2010, and Vista Defender Pro using Malwarebytes' Anti-Malware:

1.For the first part of this removal guide you will need to use a different computer than the infected one. This is also a tricky rogue to remove, so please follow the instructions carefully. If you are concerned about whether or not you can do this, do not be, as I have made these instructions easy to follow for people of any computer expertise.

2.From another computer, please download Malwarebytes' Anti-Malware, or MBAM, and the reg files from the following locations and save it to an external media such as an external hard drive or a USB flash drive. We will then use the external drive or flash drive to to transfer these files to your infected computer. If you do not own a USB flash drive, you can get one from any local or online computer store for a small price. Some examples of good and cheap ones can be found at Newegg and Best Buy. The files that you should download onto this device are:

Malwarebytes' Anti-Malware Download Link - Everyone should download this

FixExe.reg - Everyone should download this

at the link below. Instructions 1 & 2 are very important.


Collapse -
by Jackson Douglas / September 4, 2007 1:47 PM PDT

You are officially smarter than probably the majority of people who come here for spotting the misspelling and thinking that it means something is wrong. Not that occasional misspellings don't creep into commercial products, but nothing quite that bad.

I would run the usual assortment of malware removers, and if you're using Internet Explorer and/or Outlook/Outlook Express, seek alternatives immediately. Any program that is in no way based on any of those programs would be a considerably safer bet.

Collapse -
These Drive-By Download Attempts are all the Rage.....
by tobeach / September 4, 2007 4:39 PM PDT

You're right not to click on pop-up as it'll download even more problems.
Sounds like Smit Fraud or Vundo type attack.
You could try a free malicious malware remover program like below in link which will go after about 300 of these devils:

If that doesn't get it then the more complicated method may be needed.
Following has link to Siri's Free Smitfraud Fix Program along with instructions on use:

Hope this helps! Grin

Collapse -
by KandiGurl / December 16, 2007 12:00 PM PST

I DL the rogueremover and it detected and deleted the spammed pop-ups that I was getting every 5 seconds....just wanted to say THANKS for the link!

Collapse -
Well it sounds to me like the Messenger service.
by Me, Myself and You / September 5, 2007 4:20 AM PDT

Disable "Messenger" with the Services Applet in Computer Management and it should stop these popups.

Collapse -
I Agree That Messenger IS Most Likely Entry...
by tobeach / September 5, 2007 2:57 PM PDT

path. There is also a backdoor channel hiding in Outlook Express which can be used for same. Adaware SE1.06 had free add-ons to block both Messenger & OE backdoor but they claim aren't needed/won't work on new AAW 2007 as those blocking functions are included in the program itself now.
Unfortunately since the trojan has already landed and downloads more, I still suspect removal will be required. Hope this helps! Happy

Collapse -
Fake Windows Security Alert - I have it too - Please help!
by Maui Guy / September 25, 2007 6:04 PM PDT

I too have just picked up the fake Windows Security Alert popup that says, "Your computer is making unauthorized copies of your system and internet files. Run full scan now", etc. ect. I apparently got it while searching for car parts, and opened a page (and subsequent pages) that was a listing of search engines, each performing the search that I had put into Google.

I ran Adaware, which removed 31 cookies and a bunch of misdirected files or something. And about every 10 minutes I get a Symantec Antivirus popup (a real one) that states it found a Downloader threat. It says the file is C:\WINDOWS\explore.exe It further says that Clean failed, that Quarantine failed, but that "Delete succeeded: Access denied" It seems puzzling that this keeps popping up, as though it continues to delete the same file. When I look in the Windows folder, I do not see this file. It has blocked my access to the "Add and Remove Programs" in the Control Panel. I do not see anything suspicious in the startup programs.

Any suggestions on how to get rid of this thing?

Collapse -
Things to try for a delete.
by Kees Bakker / September 25, 2007 7:12 PM PDT

File might be system or hidden. Set Folder Options to show all files.
Or see if it's listed in commmand prompt by attrib *.exe. If necessary, clear all attributes you see.

Then once you see it, to remove it try respectively:
1. Safe Mode
2. Moveoboot (free download)
3. Recovery console

Hope this helps.


Collapse -
File Recovery - I could use some help please!
by Maui Guy / October 2, 2007 5:04 PM PDT

Well, I think I've gotten rid of the spyware/virus - whatever it/they was/were. It deleted my Adaware program, locked me out of my control program, and "deleted" all of my documents. I had to do a restore from the CD that came with the computer. I'm runing Windows XP, Service Pack 2, with all updates.

How do I get my documents back? The folder claims to be empty, but from the used disk space that is clearly not the case. I guess it's a missing index file or something??? (You can see I'm not very knowledgeable here.) I have a recent backup on an external hard drive, but the same problem exists with the Documents folder there - it does not allow me access and says that it is empty.

I ran a freebie File Recovery program, which located 25,000+ missing clusters or something, but when I saved them to another drive they all had 0 bytes. Another problem is that after my external drive runs for 20 minutes or so I begin to get an error message "Windows - Delayed Write Failed. Windows was unable to save all data for the file G:\$Mft. etc. etc." It does this for each of the external drive partitions I access.

About that time the external drive stops running. The light is still on, but the drive is not spinning.

Any suggestions as to what to try next to recover the files? Or a cheap-but-good place to send the external for recovery?

Thanks for any ideas!

Collapse -
Another fake "Windows Security Alert" Question
by ou12345 / October 25, 2007 12:39 PM PDT

I keep getting a fake Pop Up saying "Windows Security Alert" also on my Windows 2000. Unfortunately, my child clicked on yes to "download spyware removal" which took us to this website:
--- I bought the AVG 7.5 Internet Security and it seems to have found the problems and corrected them, but I'm still getting the pop up and my Control Panel has disappeared. How do I get my Control Panel back? I tried your suggestion to go to Start > Run > type msconfig, but it pops up "Cannot find the file 'msconfig' (or one of its components)..." Any other suggestions?

Collapse -
Re: Another fake "Windows Security Alert" question
by Maui Guy / October 26, 2007 4:45 PM PDT

In my case, I had to reinstall Windows XP from the CD that came with my computer. First I did the less destructive reinstall - I think it was called "repair" when I popped the CD in. It put all my files and programs into a backup folder before reinstalling Windows. But I could not get into my files, as noted in my original post. Also, things continued to work strangely, and about 10 days later my Norton Antivirus picked up another virus that I think had just been downloaded (thanks to a still infected computer). So I did a complete restore from the CD, which starts from scratch by wiping everything off the computer. You lose the virus(es), but you also lose all your files and programs, so have a backup first. In my case I had the backup on an external drive, but the virus had denied me access to the files. I finally had to start up in Safe Mode, then reset the permissions to the folders and the contents. I forget the exact steps, but it was a pain in the neck. Virus creators should be tarred and feathered, followed by slow dismemberment (all on U-Tube, for others to learn the lesson).

Collapse -
Got everything back
by sshaver / October 30, 2007 1:21 PM PDT

I want to thank everyone - I finally was able to get back to full operations....I got the Control Panel back and everything Happy I did

Scan for spyware using spybot
To download the application, please visit the website below:

Please Note: The third-party product discussed here is manufactured by a company that is independent of Microsoft. We make no warranty, implied or otherwise, regarding this product's performance or reliability.

Please back up the Registry before installing this program. To back up the Registry, please follow the steps below:

1. Click Start, click Run, type "REGEDIT" (without the quotation marks), and click OK.
2. Click Export under the File menu, choose All under Export range, type a filename for this backup registry, and click Save.

Please double-click to install the program. After installing successfully, please check and recover the problems using Spybot.

After that, please test the issue.

If persist, I would appreciate your help to collect the HiJackThis.log for further research. I will check it for you to check if there is still any malicious virus on the computer then we can remove it manually.

Collet the HiJackThis log
1. Please download the Internet Explorer analyzer HijackThis from the following link:

Please Note: The third-party product discussed here is manufactured by a company that is independent of Microsoft. We make no warranty, implied or otherwise, regarding this product's performance or reliability.

2. Save the zip file to your Desktop.
3. Right-click the zip file, choose "Extract All", select the path to save the file (you may leave it as the default value), and then you will receive the extracted file.
4. Double click the extracted file to run HiJackThis. (Note: If there is a notification message, please click OK.)

5. In the HijackThis window, click "Doa a system scan and save a log file". (Note: If there is a notification message, please click OK.)

6. HijackThis will scan the system and generate a log file in Notepad.
7. On the log file menu, please click File and choose Save As. Please save the file to the Desktop.

Collapse -
"windows security alert!"
by HHank / November 7, 2007 2:35 AM PST
In reply to: Got everything back

Does anyone here know of a company that knows how to fix this problem? I do not have the "expertise" that many of you have.Spybot restored my security system and control panel until I "updated" it, now it does'nt work anymore! Anyone?

Thanx, HHank

Collapse -
Lots Of Expensive Techs Out There...But You CAN Do This..
by Grif Thomas Forum moderator / November 7, 2007 5:14 AM PST
Collapse -
i have that problem too
by David_1235 / December 27, 2007 3:30 AM PST

yes i have that pop up from windows security alert but there is another "little" problem : when i connect my PC to internet he restarts so i cant download any anti-virus HELP PLEASE!!

Collapse -
Totalsecure2009..Help w/Smitfraudfix in startup mode..

Hello, please help me. I am infected with Totalsecure2009 and am trying to get it off my computer with your suggestions. I am now in safemode on my desktop computer and have left clicked and opened Smitfraudfix in safe mode. The instruction says to click any key to continue...the problem is that I have pressed keys until I am almost blue in the face,but nothing happens. I printed out the instructions before I started this, but I do not know what to do now...please email me and let me know how to get this program to start....Thanks so much, I am not very computer literate when it comes to things like this...

Collapse -
New Tools To Use..
by Grif Thomas Forum moderator / October 2, 2008 4:04 AM PDT

First, follow the instructions below:

Please download Malwarebytes' Anti-Malware from the link below:

Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

And IF you are not able to download these tools on your machine, please use a friend or family member's computer and download the Malwarebytes tool and it's manual update from the link below.. Once downloaded, rename the program installer "mbam-setup.exe" file to something else like "Gogetum.exe", then copy the installer file and the update file to a CD or flash drive.. Transfer the file to the problem machine, then install the "Gogetum.exe" file, then run the update to get the program current.. After that, run a full system scan and delete anything it finds.

Malwarebytes Download Link (Clicking on the links below will immediately start the download dialogue window.)

Malwarebytes Manual Updater link

After doing that, then download the free tool from the link below, install it, update it, then run a full system scan:

SUPERAntispyware Removal Tool

Hope this helps.


Collapse -
Totalsecure2009 removal...
by rodsanlsutigerfan / October 2, 2008 7:58 AM PDT
In reply to: New Tools To Use..

Grif Thomas, your suggestion in what to do has appeares to have worked....I think that Totalsecure2009 has now been removed from my desktop computer...Grif, you are the best....Thanks, you have saved me from having to reformat my desktop.......Rodsanlsutigerfan

Collapse -
by akermoury / October 4, 2008 8:53 AM PDT
In reply to: New Tools To Use..


You have saved my day, got a new pc today and it got infected. used your tip for the new tools and got rid of it all.

again, thank you so much.


Collapse -
by mikeyp102 / July 13, 2010 6:53 AM PDT
In reply to: New Tools To Use..


I'm a new user to this site and have just read (and followed) your advice re the malware. Having run the scan and deleted the trojans, it seems as if security requests have stopped and the computer is safe again, so thank you.

However, it now seems I cannot access the internet. When I try to get on it says that Internet Explorer cannot display the webpage. I view the connections in the internet tool bar and it says that I am already connected to the Internet. My computer is saying that my wireless has strong signal strength, but I still can't get on. Any idea why this is and what I can do to rectify the situation?

Collapse -
Try this
by MarkFlax Forum moderator / July 13, 2010 9:13 PM PDT
In reply to: Re:

Open Internet Explorer and goto Tools > Internet Options, then the Connections tab.

In that tab click the LAN Settings button. If there is any 'Proxy server' settings selected, delete that information and remove that tick/selection. Click OK/Apply/OK, then close down IE and try again.

Does that help?


Collapse -
by mikeyp102 / July 14, 2010 3:02 AM PDT
In reply to: Try this

Thats brilliant

Thank You

Collapse -
Re: connections
by Kees Bakker / July 13, 2010 9:20 PM PDT
In reply to: Re:

- What exactly do you mean with "the connections in the internet tool bar"? And what exactly does this toolbar 'say'?
- Strong signal strength is one thing. But that can very well be combined with 'limited or no connectivity'. Do you see such a message on the wireless icon in the System tray (bottom right)?
- Does it work wired? That's easy to try.
- Can you ping a site or an url-address from the command prompt? That's a more basic operation than browsing.


Collapse -
Worked for me!!!
by Ike389 / December 4, 2009 10:51 AM PST

I used Post 20 of 62 and it worked awesome.


Collapse -
"Windows Security Alert" Vicious spyware invasion
by HHank / November 4, 2007 1:30 AM PDT

Yes, I too had the same problem! Pop-ups very 3-5 mins, loss of control panel, and add/remove program. I ran Norton and Adaware but they failed to help. It seems that this spyware problem keeps reproducing itself "overnight!". I would run adaware before going to bed and remove about 100 (or so) "hostile misdirected" somethings only to find them back again in the morning! I did what one of our members here suggested and that was to download "spybot". I ran this program for about two days before it got my control panel, security center, and add/remove programs back. I still get the "pop-up" but maybe that too will go as "spybot continues to locate this hostile invader. you can also find it at has anyone here found out how to get rid of the "pop-up?" Also, what in the control panel might this spyware be called, so that once we get there we can delete it?


Popular Forums
Computer Help 49,613 discussions
Computer Newbies 10,349 discussions
Laptops 19,436 discussions
Security 30,426 discussions
TVs & Home Theaters 20,308 discussions
Windows 10 360 discussions
Phones 15,802 discussions
Windows 7 7,351 discussions
Networking & Wireless 14,641 discussions

Coming soon

Get behind the wheel with Roadshow

Love cars? Climb into the driver's seat for the latest videos, reviews, shopping advice and picks by our editors delivered to your inbox every week.