07/24/2024
Some scams are REALLY good. Rather, really devious. Here's one we've seen three instances of in the last two weeks. A QuickBooks user gets this warning message, and the message is very persistant. The only way to get it to go away without popping back up is to close QuickBooks.
The scam is that the phone number shown? Not a legit phone number for contacting Intuit. After a very polite and empathetic conversation, the scammer reports that the only way to fix is if they are given access to your computer and first they must get a credit card from you to make a large payment for the support service. So many red flags.
To add more fuel, the error codes in the displayed message are legit! That is to say, there is an actual error that corresponds to those codes. That's not what is happening here, however!
The good news is that two solutions that Norton Street supports catch this bug and report it as malicious. They show not only the malicious process that is running (QBMakr.exe), but also its location on your computer. Deleting or renaming that directory and restarting your computer fixes the issue immediately.
If you browse to the directory in question, you'll see not only the .exe file, but also an .html file that consists of the warning message! It's a static image in that directory, which is a clear giveaway.
To read more about it, here is a Reddit post that got a lot of traffic 2 years ago.
https://www.reddit.com/r/QuickBooks/comments/wzzzg0/quickbooks_internal_pop_up_scam/
And that's the bad news. If indeed Intuit is aware of the scam, and it's been going on for 2 years or more, that is a sad state of affairs and speaks poorly of Intuit. We have more questions than answers about this one since it's not clear what the source is. We believe users are browsing to a malicious web site in search of information about QuickBooks, and then the malicious software is then downloaded from the site to the user's computer.
The good news is that our users did not get scammed because when they called the number in the message, and the person on the other end made what they felt was an exhorbitant ask for money to fix, they ended the call. $800 in one case, $1200 in another, and the third was asked for their credit card to make a $1500 payment to fix. Thankfully, the users hung up and called us immediately.
If you see this message, do give us a call at 919-688-1900, or send an email to [email protected]. We provide BEC and security awareness training in person and online. Call us to discuss how we can help improve your team's awareness.
