Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Windows Games TSS

- - - - -

  • Please log in to reply
No replies to this topic

#1
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Windows Games TSS?

The Malwarebytes research team has determined that Windows Games TSS is a Tech Support Scam. These so-called "Tech Support Scammers" try to trick you into calling their phone number for various reasons, all of which turn out to be fraudulent in the end.
This particular one uses a continuously refershing window to block the user from the use of his system.

How do I know if my computer is affected by Windows Games TSS?

This is one of the warnings displayed during install:

warning1.png

You may see this window that covers your whole screen after logging on:

main.png

and these windows while trying to get out of the locked screen:

warning2.png

warning3.png

How did Windows Games TSS get on my computer?

Tech Support Scammers use different methods for distributing themselves. This particular one was installed by a trojan.

How do I remove Windows Games TSS?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.
But due to the behaviour of the program you will have to reboot into Safe Mode with Networking first.

Alternatively you can try to get out of the lockscreen by typing "closecloseclosecloseclose" in the main form and click on the "Activate" button. You will get a confirmation prompt. Close that prompt and you will be sent back to your desktop.

After following either method continue with the instructions below.
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to:
    Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
  • If an update is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Windows Games TSS?
  • No, Malwarebytes' Anti-Malware removes Windows Games TSS completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this Tech Support Scam.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Tech Supprt Scam.

protection1.png


Technical details for experts

You may see these entries in FRST logs:

 HKCU\...\Run: [NewWindowActivation] => C:\Program Files\Microsoft Games\Windows Games\NewWindowActivation.exe [648512 2016-07-26] (Microsoft)
 C:\Program Files\Microsoft Games
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files\Microsoft Games\Windows Games
       Adds the file NewWindowActivation.exe"="7/26/2016 9:49 PM, 648512 bytes, A
       Adds the file test1.bat"="7/19/2016 10:56 PM, 590 bytes, A
    Adds the folder C:\Program Files (x86)\Microsoft\Windows Games
       Adds the file myTP.exe"="7/29/2016 5:24 PM, 61952 bytes, A
       Adds the file Windows Games.exe"="7/28/2016 12:18 AM, 2310032 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Speech\Files\UserLexicons
       Adds the file SP_86C9F42BC988495188D431A2C246FFF5.dat"="8/9/2016 8:43 AM, 940 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows Games 1.0.0.1\install\A63CEE2
    Adds the folder C:\Windows\Installer\{034F626D-06B1-40B7-81CA-2B926A63CEE2}
       Adds the file Windows10logo_1.exe"="8/9/2016 8:39 AM, 370070 bytes, RA

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\4C770621CB220AE418F93890344C0297]
       "AdvertiseFlags"="REG_DWORD", 388
       "Assignment"="REG_DWORD", 1
       "AuthorizedLUAApp"="REG_DWORD", 0
       "Clients"="REG_MULTI_SZ, ": "
       "DeploymentFlags"="REG_DWORD", 3
       "InstanceType"="REG_DWORD", 0
       "Language"="REG_DWORD", 1033
       "PackageCode"="REG_SZ", "460A7E668DC17764C96D01255D06F89F"
       "ProductIcon"="REG_SZ", "C:\Windows\Installer\{126077C4-22BC-4EA0-819F-830943C42079}\favicon.exe"
       "ProductName"="REG_SZ", "Windows Games"
       "Version"="REG_DWORD", 33554432
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\4C770621CB220AE418F93890344C0297\SourceList]
       "LastUsedSource"="REG_EXPAND_SZ, "n;1;C:\Users\{username}\AppData\Roaming\Microsoft Games\Windows Games 2.0.0.1\install\"
       "PackageName"="REG_SZ", "Windows Games.x64.msi"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\D626F4301B607B0418ACB229A636EC2E]
       "AdvertiseFlags"="REG_DWORD", 388
       "Assignment"="REG_DWORD", 1
       "AuthorizedLUAApp"="REG_DWORD", 0
       "Clients"="REG_MULTI_SZ, ": "
       "DeploymentFlags"="REG_DWORD", 3
       "InstanceType"="REG_DWORD", 0
       "Language"="REG_DWORD", 1033
       "PackageCode"="REG_SZ", "AD7BFD8BE497716428877EDA23DC3BB3"
       "ProductIcon"="REG_SZ", "C:\Windows\Installer\{034F626D-06B1-40B7-81CA-2B926A63CEE2}\Windows10logo_1.exe"
       "ProductName"="REG_SZ", "Windows Games"
       "Version"="REG_DWORD", 16777216
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{126077C4-22BC-4EA0-819F-830943C42079}]
       "AuthorizedCDFPrefix"="REG_SZ", ""
       "Comments"="REG_SZ", "This installer database contains the logic and data required to install Windows Games."
       "Contact"="REG_SZ", ""
       "DisplayName"="REG_SZ", "Windows Games"
       "DisplayVersion"="REG_SZ", "2.0.0.1"
       "EstimatedSize"="REG_DWORD", 618
       "HelpLink"="REG_SZ", ""
       "HelpTelephone"="REG_SZ", ""
       "InstallDate"="REG_SZ", "20160809"
       "InstallLocation"="REG_SZ", "C:\Program Files\Microsoft Games\Windows Games\"
       "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Microsoft Games\Windows Games 2.0.0.1\install\"
       "Language"="REG_DWORD", 1033
       "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /X{126077C4-22BC-4EA0-819F-830943C42079}"
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Microsoft Games"
       "Readme"="REG_SZ", ""
       "Size"="REG_SZ", ""
       "SystemComponent"="REG_DWORD", 1
       "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /X{126077C4-22BC-4EA0-819F-830943C42079}"
       "URLInfoAbout"="REG_SZ", ""
       "URLUpdateInfo"="REG_SZ", ""
       "Version"="REG_DWORD", 33554432
       "VersionMajor"="REG_DWORD", 2
       "VersionMinor"="REG_DWORD", 0
       "WindowsInstaller"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{034F626D-06B1-40B7-81CA-2B926A63CEE2}]
       "AuthorizedCDFPrefix"="REG_SZ", ""
       "Comments"="REG_SZ", "This installer database contains the logic and data required to install Windows Games."
       "Contact"="REG_SZ", ""
       "DisplayName"="REG_SZ", "Windows Games"
       "DisplayVersion"="REG_SZ", "1.0.0.1"
       "EstimatedSize"="REG_DWORD", 2300
       "HelpLink"="REG_SZ", ""
       "HelpTelephone"="REG_SZ", ""
       "InstallDate"="REG_SZ", "20160809"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\Microsoft\Windows Games\"
       "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Microsoft\Windows Games 1.0.0.1\install\A63CEE2\"
       "Language"="REG_DWORD", 1033
       "NoModify"="REG_DWORD", 1
       "NoRemove"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Microsoft"
       "Readme"="REG_SZ", ""
       "Size"="REG_SZ", ""
       "SystemComponent"="REG_DWORD", 1
       "URLInfoAbout"="REG_SZ", ""
       "URLUpdateInfo"="REG_SZ", ""
       "Version"="REG_DWORD", 16777216
       "VersionMajor"="REG_DWORD", 1
       "VersionMinor"="REG_DWORD", 0
       "WindowsInstaller"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Games]
       "Path"="REG_SZ", "C:\Program Files (x86)\Microsoft\Windows Games\"
       "Version"="REG_SZ", "1.0.0.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft Games\Windows Games]
       "Path"="REG_SZ", "C:\Program Files\Microsoft Games\Windows Games\"
       "Version"="REG_SZ", "2.0.0.1"
    [HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]
       "NewWindowActivation"="C:\Program Files\Microsoft Games\Windows Games\NewWindowActivation.exe"
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/9/2016
Scan Time: 10:25 AM
Logfile: mbamPublisher.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.08.09.04
Rootkit Database: v2016.05.27.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 317083
Time Elapsed: 8 min, 51 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 1
Rogue.TechSupportScam, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|NewWindowActivation, C:\Program Files\Microsoft Games\Windows Games\NewWindowActivation.exe, Quarantined, [6a9e5aefa1f99f97677423a52dd79d63]

Registry Data: 0
(No malicious items detected)

Folders: 1
Rogue.TechSupportScam, C:\Program Files\Microsoft Games\Windows Games, Quarantined, [6a9e5aefa1f99f97677423a52dd79d63], 

Files: 3
Rogue.TechSupportScam, C:\Users\{username}\Desktop\Publisher.exe, Quarantined, [6f995fea59412016914627a1eb1906fa], 
Rogue.TechSupportScam, C:\Program Files\Microsoft Games\Windows Games\test1.bat, Quarantined, [6a9e5aefa1f99f97677423a52dd79d63], 
Rogue.TechSupportScam, C:\Program Files\Microsoft Games\Windows Games\NewWindowActivation.exe, Quarantined, [6a9e5aefa1f99f97677423a52dd79d63], 

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.