I have been using Windows 8.1 on a brand new computer for about a month. Since yesterday, about every half hour or so, a web page pops up saying:

=======================

Message from webpage

Microsoft Real Time Web Monitor has detected Liam.x on the system Due to Unsafe Browsing.

Its (sic) strongly adviced (sic!) to contact Windows Online Support to have the virus removed as it can cause a system failure.

Please Call Microsoft Windows Support Helpline for Assistance.

TOLL FREE: 0-800-078-6078

=======================

Win 8.1 inbuilt Defender program doesn't detect this virus (even after a full scan). Nor does Malwarebytes.

Is there a recommended way of removing this virus? I just did a System Restore to about two weeks ago but the virus is still there.

• Edited by Bertram12 Tuesday, July 07, 2015 2:14 PM

Hi,

Firstly, you can contact Microsoft Malware Center for further assistance with this problem:

https://www.microsoft.com/security/portal/mmpc/

Secondly, you can access to the link below to download and install Malicious Software Removal Tool for test:

https://www.microsoft.com/en-us/download/virus-malware.aspx

Thanks for the advice. I have now run Defender, Malwarebytes, Malicious Software Removal Tool and Microsoft Safety Scanner. Unfortunately, none of them was able to detect Liam.x.

So, having wasted a couple of days on this, this afternoon I decided to reinstall Windows 8 from scratch. My installation CD only contains 8.0 which meant, after installing it, a rather boring afternoon watching 150 or so Windows updates coming down the wire before Windows will let me download and install 8.1.

Fair enough but, annoyingly, the reinstall of Windows 8 has NOT created a new Registry from scratch. For example, it has remembered my login picture from the previous Install - even though I had removed the JPG file from the hard disk. I can tell that other settings have been remembered as well.

The question is, if Windows can't detect the Liam.x virus, will it have left the virus in the registry as well? We will see. I do think the Windows installation process should ask whether one wants a new Registry to be created from scratch - which is what I wanted !!

BTW, does anyone know where the author of Liam.x lives? I rather fancy popping round to have a chat with him !!;

You probably resigned in with your MS account and the account pictures, settings etc came back since they are synced with one drive.

That is reassuring. My login to this forum was also remembered.

Let's hope the virus wasn't sync'd with One Drive as well:-)

It shouldn't have been sync'd to one drive since it only auto backups documents folder.  But if for any reason it does we will figure it out.

I'm about to wander off topic now - but how on earth does one get the free Windows 8.1 upgrade to install? As I mentioned earlier, I've already sat watching 150 Windows 8 updates come down the wire. A message said they were needed before I could install the Windows 8.1 upgrade.

Anyway, they finished so I went again to install Windows 8.1 - but there was no sign of progress. The horizontal progress bar in Windows Update remained at 0%. I left the PC for the whole morning but, after 4 hours, the download was still stuck at 0%.

So I had a look at the Windows Update screen again (via PC settings) and saw that 25 other updates were waiting to be installed. A message said they will be installed during scheduled PC maintenance.

I'm getting desperate now. I haven't scheduled any PC maintenance (I don't even know how to in Windows 8). What is scheduled PC maintenance? When is it? Who decided?

SO, I clicked to install the 25 updates NOW. But, all that happened was that the "downloading" horizontal progress bar appeared but, as before, remained stuck on 0.

I have used pretty well every version of Windows since 3.1. I have built PCs from scratch. I recently migrated a complete business office from XP to Win 7. I know Windows Server and have even set up WSUS.

But Microsoft seem to have removed all the system feedback from Windows 8. Is there somewhere which will show me what is going on? All I am trying to do is a clean install of W8 followed by the free upgrade to 8.1. There must be a simple reason why NO UPDATES whatsoever will even start to download - even though the first 150 of the blighters did.

Yours in desperation.

Success. Windows 8.1 is installed.

Downloads were getting stuck because of a nasty default setting in Windows 8.0.  Under Settings / Change PC Settings was a tab called "Sync Your Settings". This tab isn't present in 8.1 but was there in 8.0. In it was a setting called "Sync over metered connection". Windows 8.0 had turned this on by default. As soon as I turned it off, Downloads (which had been stuck for hours) immediately started.

Unfortunately, the Liam.x virus has returned !!!!

Within a few hours of the above clean re-install of WIndows 8 and then 8.1, the same old message is popping up:

=======================

Message from webpage

Microsoft Real Time Web Monitor has detected Liam.x on the system Due to Unsafe Browsing.

Its (sic) strongly adviced (sic!) to contact Windows Online Support to have the virus removed as it can cause a system failure.

Please Call Microsoft Windows Support Helpline for Assistance.

TOLL FREE: 0-800-078-6078

=======================

All I have done in the last couple of days is:

1. Reinstall Windows 8.0 from scratch

2. Download & install a huge number of Windows updates

3. Download & install Windows 8.1

4. Download & install numerous more Windows updates

5. Install my fully licensed Office 2010 Pro

6. Download & install numerous more Windows (and now Office) updates.

How is this virus getting onto my computer? I used Windows 7 Pro for years without any viruses. Before that, I used Windows XP without any viruses. And, pretty well the only web sites I've visited in the last couple of days belong to Microsoft.

BTW, I did download a freeware game from the Microsoft Store - "Magic Puzzles". It's a nicely crafted on-line jogsaw game. Is the virus tucked away in there perhaps?

I cannot believe, after all these days of pain and wasted time, that the Liam.x virus has sneaked onto my computer again. Despite what the above message says, I have NOT been doing any unsafe browsing.

Any ideas would be greatly appreciated.

It is either in the game (most likely) or in office.  You did not get it from WU,

I have just uninstalled the game (Magic Puzzles).

Yes, the virus has disappeared.

I'm new to Windows 8.1 - is there a list of which games in Microsoft Store are infected?

Oh dear. The virus is still there.

Time to give up. I shall wipe Windows 8.1 and go back to Windows 7.

That means it's probably a setting attached to your MS account and internet explorer.  Do me a favor before you remove it and download auto runs https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx?f=255&MSPPError=-2147217396

Share with me the snap shot of it

Sorry, I have already installed Windows 7 SP-1 (a painless process happily).

However, I did take a screen shot of the virus screen before wiping Win 8.1. I'll upload it here shortly.

1. This is phone scam. Never ever call these numbers. Never provide credit card numbers when they want you to do so.

2. If you receive something like this and if you like to be sure, then you can backup data and restore clean installation from reliable backup and restore data afre restore clean install. (You have good backukup I hope.)

3. If you feel like IT expert, then you can do analysis to find which process(es) is(are) causing troubles (with Sysinternals tools), dig into these processes, kill them and remove.

4. Never use more AV at the same time, unless you are certain that these are not interfering with each other. Keep AV database up to date.

5. Be very cautious about where you "travel" on internet. Clean IE cache, search what has Internet added, never save password,... Use special computer for dangerous experiments if you are doing something like this and avoid doing this on computer that host important data (workor personal).

Regards

Milos

Hi Milos,

Thanks for the advice but, as you will see from my previous posts, I never had a virus with either Windows XP or Windows 7. The mystery is why it got onto my PC after I installed Windows 8.1 - twice !!

Anyway, I have scrapped Windows 8.1 and am now happily virus-free once again on Windows 7.

I only used Windows 8.1 for a short time so don't have any useful knowledge about its security weaknesses.

Did you reload the game, or go back to the same sites?

1. This is phone scam. Never ever call these numbers. Never provide credit card numbers when they want you to do so.

2. If you receive something like this and if you like to be sure, then you can backup data and restore clean installation from reliable backup and restore data afre restore clean install. (You have good backukup I hope.)

3. If you feel like IT expert, then you can do analysis to find which process(es) is(are) causing troubles (with Sysinternals tools), dig into these processes, kill them and remove.

4. Never use more AV at the same time, unless you are certain that these are not interfering with each other. Keep AV database up to date.

5. Be very cautious about where you "travel" on internet. Clean IE cache, search what has Internet added, never save password,... Use special computer for dangerous experiments if you are doing something like this and avoid doing this on computer that host important data (workor personal).

Regards

Milos

• Marked as answer by Bruce WoodingModerator Tuesday, July 21, 2015 9:28 PM

Same issue here. Also using Magic Puzzles.

No AV solution or Malwarebytes detects it.

MS - this is YOUR app store - people purchase items though it, via your secure system which means it is down to you to fix the infected applications.

Sort this out!

Thanks SimBear. It would be good if MS could refute your accusation - which personally I think explains what most likely happened.

I only used Win 8.1 for a short amount of time but was disturbed by the huge number of adverts that kept popping up. If MS isn't in control of its own Store, then this could explain how the virus got through.

Since reverting to Windows 7, I haven't experienced a single issue.

Same issue here. Also using Magic Puzzles.

No AV solution or Malwarebytes detects it.

MS - this is YOUR app store - people purchase items though it, via your secure system which means it is down to you to fix the infected applications.

Sort this out!

• Marked as answer by Bruce WoodingModerator Tuesday, July 21, 2015 9:28 PM

Same issue here. Also using Magic Puzzles.

No AV solution or Malwarebytes detects it.

MS - this is YOUR app store - people purchase items though it, via your secure system which means it is down to you to fix the infected applications.

Sort this out!

• Marked as answer by Bruce WoodingModerator Tuesday, July 21, 2015 9:28 PM
• Unmarked as answer by Bruce WoodingModerator 19 hours 6 minutes ago

Same issue here. Also using Magic Puzzles.

No AV solution or Malwarebytes detects it.

MS - this is YOUR app store - people purchase items though it, via your secure system which means it is down to you to fix the infected applications.

Sort this out!

• Marked as answer by Bruce WoodingModerator Tuesday, July 21, 2015 9:28 PM
• Unmarked as answer by Bruce WoodingModerator Saturday, July 25, 2015 12:15 PM

Someone has posted an excellent video of the "Magic Puzzles" infection on youtube.

https://www.youtube.com/watch?v=c6xecPomi_g

Bertram12 and SimBear, we have been working to replicate your scenario here in the lab and we have yet to experience the pop-up that you have described or that is shown in the provided video. We have several Windows 8.1 environments on which we have installed Magic Jigsaw Puzzles from the Windows Store and which we have used extensively, but still we have not seen the pop-up.

Could you supply us with more information as we try to replicate your scenario?
Did the pop-ups appear immediately after you installed Magic Jigsaw Puzzles?
Did you install Magic Jigsaw Puzzles directly from the Windows Store?
Did the pop-ups appear after installing another application or change?
Are you running any security software other than Windows Defender?
Are UAC, Windows Firewall, SmartScan, and Windows Defender enabled and up-to-date?
Did you click any of the ads in Magic Jigsaw Puzzles?

In the meantime while we try to replicate your situation, if you feel that the app Magic Jigsaw Puzzles is responsible for these pop-ups you can report it in the Windows Store. Simply search the store for Magic Jigsaw Puzzles and select it, then scroll down to the Additional Information and select Report This App to Microsoft.

Liam.X Virus & Windows Defender

Lou979,

We have received some reports from other users that they received the Liam.X pop up when using a Windows Store app, specifically Magic Jigsaw Puzzles. Can you tell us if you are using the same app or if the pop-up occurs when you are using a Windows Store app.

Reference use only.

Hi Bruce,

I am impressed by your efforts. Unfortunately, I went back to Windows 7 a fortnight ago, so the trail (on my PC at least) is now cold. It is hard now to answer your questions but here is a go:

Q. Did the pop-ups appear immediately after you installed Magic Jigsaw Puzzles?

A. Certainly after, but I couldn't say how long after as I was spending most of my time finding my way around Windows 8 and installing a massive backlog of Windows Updates.

Q. Did you install Magic Jigsaw Puzzles directly from the Windows Store?

A. Yes.

Q. Did the pop-ups appear after installing another application or change?

A. No. I am pretty sure I had only installed Windows 8, then 8.1, Office 2010 and Magic Puzzles. I did install one or two other games from the Microsoft Store (e.g. card games Ok, I'm easily pleased :-)) but it was only while running Magic Puzzles that the Liam.x virus kept popping up.

Q. Are you running any security software other than Windows Defender?

A. No.

Q. Are UAC, Windows Firewall, SmartScan, and Windows Defender enabled and up-to-date?

A. I couldn't tell you about SmartScan as I don't know what it is. As for the rest, whenever I build or rebuild a computer, setting up security, anti-virus and downloading the hundreds of Windows Updates is always top priority. My computer was fully up to date in all these respects.

Q. Did you click any of the ads in Magic Jigsaw Puzzles?

A. Hmmm. Difficult to say. As a rule, I NEVER click on adverts but Windows 8.1 was a completely new interface - and extremely difficult to find ones way around initially. I can't promise you I didn't click on an advert.

Bruce, as for your final point, i.e. if you feel that the app Magic Jigsaw Puzzles is responsible for these pop-ups you can report it in the Windows Store."

My answer to that is as follows: - Magic Jigsaw Puzzles is such a beautifully crafted game, I cannot believe its designer would spend all that time and then hide a virus in it. All I can say is that the Liam.X virus popped up after I installed Magic Jigsaw Puzzles. And, it was only when actually running Magic Jigsaw Puzzles that the virus kept popping up.

It is also worth pointing out that, after Liam.x first struck, I scrapped everything and reinstalled Windows 8 from scratch, followed by 8.1 Office 2010 and Magic Jigsaw puzzles - only to find that Liam.x had returned (or was still there).

I have been back on Windows 7 for the last fortnight and virus free.

Thanks for the reply. To answer your question: I didn't format the drive before reinstalling Windows 8. I just reinstalled Windows 8 from my licensed installation disk.

However, when I then went back to Windows 7, this was in fact a "restore to factory settings" using the recovery partition - which did completely wipe the previous contents of the whole disk.

If I see any further problems, I will report back. For now, I'm still on Windows 7.