What is Windows Games TSS?
The Malwarebytes research team has determined that Windows Games TSS is a Tech Support Scam. These so-called "Tech Support Scammers" try to trick you into calling their phone number for various reasons, all of which turn out to be fraudulent in the end.
This particular one uses a continuously refershing window to block the user from the use of his system.
How do I know if my computer is affected by Windows Games TSS?
This is one of the warnings displayed during install:
You may see this window that covers your whole screen after logging on:
and these windows while trying to get out of the locked screen:
How did Windows Games TSS get on my computer?
Tech Support Scammers use different methods for distributing themselves. This particular one was installed by a trojan.
How do I remove Windows Games TSS?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.
But due to the behaviour of the program you will have to reboot into Safe Mode with Networking first.
Alternatively you can try to get out of the lockscreen by typing "closecloseclosecloseclose" in the main form and click on the "Activate" button. You will get a confirmation prompt. Close that prompt and you will be sent back to your desktop.
After following either method continue with the instructions below.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to:
Launch Malwarebytes Anti-Malware - Then click Finish.
- Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
- If an update is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes' Anti-Malware removes Windows Games TSS completely.
We hope our application and this guide have helped you eradicate this Tech Support Scam.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Tech Supprt Scam.
Technical details for experts
You may see these entries in FRST logs:
HKCU\...\Run: [NewWindowActivation] => C:\Program Files\Microsoft Games\Windows Games\NewWindowActivation.exe [648512 2016-07-26] (Microsoft) C:\Program Files\Microsoft GamesAlterations made by the installer:
File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files\Microsoft Games\Windows Games Adds the file NewWindowActivation.exe"="7/26/2016 9:49 PM, 648512 bytes, A Adds the file test1.bat"="7/19/2016 10:56 PM, 590 bytes, A Adds the folder C:\Program Files (x86)\Microsoft\Windows Games Adds the file myTP.exe"="7/29/2016 5:24 PM, 61952 bytes, A Adds the file Windows Games.exe"="7/28/2016 12:18 AM, 2310032 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Speech\Files\UserLexicons Adds the file SP_86C9F42BC988495188D431A2C246FFF5.dat"="8/9/2016 8:43 AM, 940 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows Games 1.0.0.1\install\A63CEE2 Adds the folder C:\Windows\Installer\{034F626D-06B1-40B7-81CA-2B926A63CEE2} Adds the file Windows10logo_1.exe"="8/9/2016 8:39 AM, 370070 bytes, RA Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\4C770621CB220AE418F93890344C0297] "AdvertiseFlags"="REG_DWORD", 388 "Assignment"="REG_DWORD", 1 "AuthorizedLUAApp"="REG_DWORD", 0 "Clients"="REG_MULTI_SZ, ": " "DeploymentFlags"="REG_DWORD", 3 "InstanceType"="REG_DWORD", 0 "Language"="REG_DWORD", 1033 "PackageCode"="REG_SZ", "460A7E668DC17764C96D01255D06F89F" "ProductIcon"="REG_SZ", "C:\Windows\Installer\{126077C4-22BC-4EA0-819F-830943C42079}\favicon.exe" "ProductName"="REG_SZ", "Windows Games" "Version"="REG_DWORD", 33554432 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\4C770621CB220AE418F93890344C0297\SourceList] "LastUsedSource"="REG_EXPAND_SZ, "n;1;C:\Users\{username}\AppData\Roaming\Microsoft Games\Windows Games 2.0.0.1\install\" "PackageName"="REG_SZ", "Windows Games.x64.msi" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\D626F4301B607B0418ACB229A636EC2E] "AdvertiseFlags"="REG_DWORD", 388 "Assignment"="REG_DWORD", 1 "AuthorizedLUAApp"="REG_DWORD", 0 "Clients"="REG_MULTI_SZ, ": " "DeploymentFlags"="REG_DWORD", 3 "InstanceType"="REG_DWORD", 0 "Language"="REG_DWORD", 1033 "PackageCode"="REG_SZ", "AD7BFD8BE497716428877EDA23DC3BB3" "ProductIcon"="REG_SZ", "C:\Windows\Installer\{034F626D-06B1-40B7-81CA-2B926A63CEE2}\Windows10logo_1.exe" "ProductName"="REG_SZ", "Windows Games" "Version"="REG_DWORD", 16777216 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{126077C4-22BC-4EA0-819F-830943C42079}] "AuthorizedCDFPrefix"="REG_SZ", "" "Comments"="REG_SZ", "This installer database contains the logic and data required to install Windows Games." "Contact"="REG_SZ", "" "DisplayName"="REG_SZ", "Windows Games" "DisplayVersion"="REG_SZ", "2.0.0.1" "EstimatedSize"="REG_DWORD", 618 "HelpLink"="REG_SZ", "" "HelpTelephone"="REG_SZ", "" "InstallDate"="REG_SZ", "20160809" "InstallLocation"="REG_SZ", "C:\Program Files\Microsoft Games\Windows Games\" "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Microsoft Games\Windows Games 2.0.0.1\install\" "Language"="REG_DWORD", 1033 "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /X{126077C4-22BC-4EA0-819F-830943C42079}" "NoModify"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "Publisher"="REG_SZ", "Microsoft Games" "Readme"="REG_SZ", "" "Size"="REG_SZ", "" "SystemComponent"="REG_DWORD", 1 "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /X{126077C4-22BC-4EA0-819F-830943C42079}" "URLInfoAbout"="REG_SZ", "" "URLUpdateInfo"="REG_SZ", "" "Version"="REG_DWORD", 33554432 "VersionMajor"="REG_DWORD", 2 "VersionMinor"="REG_DWORD", 0 "WindowsInstaller"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{034F626D-06B1-40B7-81CA-2B926A63CEE2}] "AuthorizedCDFPrefix"="REG_SZ", "" "Comments"="REG_SZ", "This installer database contains the logic and data required to install Windows Games." "Contact"="REG_SZ", "" "DisplayName"="REG_SZ", "Windows Games" "DisplayVersion"="REG_SZ", "1.0.0.1" "EstimatedSize"="REG_DWORD", 2300 "HelpLink"="REG_SZ", "" "HelpTelephone"="REG_SZ", "" "InstallDate"="REG_SZ", "20160809" "InstallLocation"="REG_SZ", "C:\Program Files (x86)\Microsoft\Windows Games\" "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Microsoft\Windows Games 1.0.0.1\install\A63CEE2\" "Language"="REG_DWORD", 1033 "NoModify"="REG_DWORD", 1 "NoRemove"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "Publisher"="REG_SZ", "Microsoft" "Readme"="REG_SZ", "" "Size"="REG_SZ", "" "SystemComponent"="REG_DWORD", 1 "URLInfoAbout"="REG_SZ", "" "URLUpdateInfo"="REG_SZ", "" "Version"="REG_DWORD", 16777216 "VersionMajor"="REG_DWORD", 1 "VersionMinor"="REG_DWORD", 0 "WindowsInstaller"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Games] "Path"="REG_SZ", "C:\Program Files (x86)\Microsoft\Windows Games\" "Version"="REG_SZ", "1.0.0.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft Games\Windows Games] "Path"="REG_SZ", "C:\Program Files\Microsoft Games\Windows Games\" "Version"="REG_SZ", "2.0.0.1" [HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] "NewWindowActivation"="C:\Program Files\Microsoft Games\Windows Games\NewWindowActivation.exe"Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 8/9/2016 Scan Time: 10:25 AM Logfile: mbamPublisher.txt Administrator: Yes Version: 2.2.1.1043 Malware Database: v2016.08.09.04 Rootkit Database: v2016.05.27.01 License: Premium Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Enabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {username} Scan Type: Threat Scan Result: Completed Objects Scanned: 317083 Time Elapsed: 8 min, 51 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 1 Rogue.TechSupportScam, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|NewWindowActivation, C:\Program Files\Microsoft Games\Windows Games\NewWindowActivation.exe, Quarantined, [6a9e5aefa1f99f97677423a52dd79d63] Registry Data: 0 (No malicious items detected) Folders: 1 Rogue.TechSupportScam, C:\Program Files\Microsoft Games\Windows Games, Quarantined, [6a9e5aefa1f99f97677423a52dd79d63], Files: 3 Rogue.TechSupportScam, C:\Users\{username}\Desktop\Publisher.exe, Quarantined, [6f995fea59412016914627a1eb1906fa], Rogue.TechSupportScam, C:\Program Files\Microsoft Games\Windows Games\test1.bat, Quarantined, [6a9e5aefa1f99f97677423a52dd79d63], Rogue.TechSupportScam, C:\Program Files\Microsoft Games\Windows Games\NewWindowActivation.exe, Quarantined, [6a9e5aefa1f99f97677423a52dd79d63], Physical Sectors: 0 (No malicious items detected) (end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention