Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Respectfully, moderators need to be aware that this is NOT a QB company-file issue but an issue with other files that reside on the computer. Please get with an Intuit Costumer Account Protection / Security Ops team member to understand what is creating this specific issue.
I am having the exact same issue. It started on my old computer last week running Windows 10 with QB Desktop 21. I bought a new computer with Windows 11 and upgraded to QB Desktop Pro Plus 23 directly from the Intuit site . Same message on both computers. Have spent at least 12 hours on the phone with tech support and they haven't been able to help me. I cannot speak with or leave a message for anybody with any knowledge of this.
PLEASE HELP!
Try Chat Support again at another time and hopefully get a knowledgeable support person. In the meantime, look for the files like I mentioned earlier.
Good day, bwaim.
Let me route you to the right support that can help your fix the rebuilding issue in QuickBooks Desktop (QBDT).
Base on your given scenario, I suggest you get inn touch with our support to continue the troubleshooting. You can try our phone or chat support for further assistance.
Here's how:
To get our latest contact information, check out this article: Contact QuickBooks Desktop support.
Let me know how it goes. I want to make sure this is taken care of. Have a wonderful day ahead.
Hello there, cindyh05.
We want to ensure that our customers can use QuickBooks and complete their accounting tasks seamlessly. Please know that we will conduct a further investigation into the matter. Then someone will reach out to you to discuss the next steps.
For resources to help you handle any data issues or manage your accounting tasks, feel free to browse our self-help articles. Simply choose the topic that best fits your situation.
Let us know if there's anything else going on with your QuickBooks aside from the current issue. I'm here to help you the best that I can. Have a good one.
Found the files at:
C:\Users\Public\Documents\Windows
90s.rtf
err.html
IntuitDownloadManager.exe
msg.ini
Newtonsoft.Json.dll
QuickBooksDownloader.exe
Sv.ini
Win32_API.dll
Can't quite figure out how it got installed yet.
Using task manger with the "Command" column you can see the folder it is running out of.
It is the IntuitDownloadManager.exe that is running displaying the message.
I called Inuit Support and since I am on QB 2020 Pro I could not get support - version is too old.
I have done more digging into this.
There is a post on SpiceWorks about this as well.
It appears that I was infected on 10/20/2022 at 1:36PM.
Looking at my windows Installed Apps I did a QuickBooks update on that date.
I have a "QuickBooks Runtime Redistributable" update on 10/20/2022.
In addition to this folder there are 2 registry entries:
HKEY_CURRENT_USER\Run that need to be removed.
The first is "Intuit QuickBooks" and the second "QuickBooks Desktop".
You will see the paths to the bad location.
Next there are two Task Scheduler entries:
"Intuit QuickBooks"
"Intuit QuickBooks 11".
After killing any running processes you can rename/delete the folder.
I'm thinking that this was installed as part of a QB update I did.
I did file a C:\Windows\Intuit\{88C0857B-7734-4EA5-A7D9-636DF8622B63} with a timestamp of 10/20/2022 2:03PM.
the folder is now empty and shows the time correlation of this happening.
I came here to post this, so thanks for saving me the time. I'm an IT provider and was just called to find and fix this issue. The other thing I'll add is there are tasks in the task scheduler to run the exe in that folder. Since the exe has been deleted (if you delete those files in c:\users\public\documents\windows) it cannot call anything to run, but it is still best practice to delete those scheduled tasks.
Same message, called and they tried to sell me an "upgrade". They did a logmein session and said the only fix was to buy a 1,2,or 3 year plan. Wouldn't send me an invoice/terms via email. Shady from the get go.
What's Intuit doing about this? I cannot get rid of the message. Was able to temporarily get the message to go away by calling the "other" tech support number. Message keeps coming back intermittently.
Been using QB for decades (taught it as well) and never had anything this messed up.
They did a logmein session
1. Remove immediately the logmein program or any other program they have installed
2. Do you run endpoint security on your machine? Run a full scan to be sure.
3. Chat Intuit Support and ask them to remove malicious files. If they can't help or understand your problem, contact me in private for assistance.
This thread has many suggested solutions to this error. After experiencing this yesterday, I spent many hours trying to reach Quicken support. First their call back was not working, then the agent I finally reached refused to help me because they claim my version is no longer supported (Desktop Pro 2021, definitely STILL under support). I finally found someone to help... I had to do a program update (Help > Update QuickBooks Desktop). I believe Intuit knew that their last update was flawed (either on purpose or accidently infected) and now requires anyone with this issue to call for help. Also, interesting that they insisted on giving me the spiel about the "new" subscription service (which I was told would have avoided this issue/call). Anyone with this problem should first try to do an update, which may fix the issue. Shame on Intuit for this entire episode!
I am sorry. This is unacceptable. It is now very obvious to me that this is a known exploit, specifically if they know how to fix it, but still almost nothing is being said or actively done to prevent a exploit like this.
Here is the facts. I told Intuit about what I suspected to be a scam because the number came back as a known QB scam number. Nothing else was listed. I also told them that their "fix" made it worse when I was told to remove completely the program and all folders associated with it. When I reinstalled instead of it only affecting one user it affected all users. AND it prevents you from using the QB desktop.
SO I dug. Found that in the Public user profile there is a folder in the documents called Windows(it is hidden fyi). SO C:/users/public/public documents/windows
There are 6-10 files. If you delete everything in that folder that you can the error goes away but there will be three files left. Intuitdownloadmanager, newonsoft.json.dll and win32_api.dll
These files need to go away too.
here is another more precise explanation on reddit of all places.
https://www.reddit.com/r/QuickBooks/comments/wzzzg0/quickbooks_internal_pop_up_scam/
assuming the link is allowed.
Once those are removed you will want to check the start up items and look at their properties or file location, one of the Quickbooks items in start up points at that downloadmanager.exe so disable that, now you can remove the other files that were previously prevented. you may have to stop any running instances of that download manager.
Now you have removed the entire "Windows" folder that contained those pesky devils. NOW check your scheduled tasks. Disable any task relating to that path.
I had 11 of them.
This should be about as thorough of a clean up as possible without a reinstallation of windows.
This just happened to me. Where would these files be located .?
Welcome to the Community, Rola02.
Since you're receiving a Warning message advising that Quickbooks found some problems with your data file, I'd recommend troubleshooting initially with your Verify Data utility. This identifies known issues within company files and informs users if their Rebuild Data option needs to be utilized afterwards.
Here's how it's used:
In the event its results show a "Your data has lost integrity," message, this indicates there's damage in your file. You can use the Rebuild Data utility to fix it. For specific errors, there may already be a resource for them on our support site.
If it displays a "QuickBooks detected no problems with your data," notification, or you've searched our help articles and didn't find any existing resources about the specific error it displayed, you can move on to troubleshooting with our QuickBooks Tool Hub.
Here's how:
In the event you continue receiving the Warning message, you'll want to get in touch with our Customer Care team. They'll be able to pull up your account in a secure environment, conduct further research with you, and create an investigation ticket if necessary.
If there's any additional questions, I'm just a post away. Have a lovely day!
Rola02, the explanation provided above by jumper-d-1981 is a pretty thorough review of how to address the issue involving a corrupted Intuit installation in which you get a pop-up advising you of a company file issue, with a number to contact Intuit support. It is a scam, but the fix is relatively simple. You can also go through the time and pain of contacting the legitimate Quicken Support folks but it will lead to the same outcome (delete the files in the referenced directory and restart QuickBooks).
Good Luck.
Here is the correct Path/location of the said files I just deleted all of them.
C:\Users\Public\Libraries
Unfortunately our accounting person, actually called the number and also let this person make a copy of our data file, "fix" it, and gave it back to us to use. They now have all of our accounting information, bank account information, does anyone know what we should do? I'm worried that they added something to our data file to gather bank or financial information before giving it back to us.
The security of your account is one of our top priorities, @SJ47. I appreciate you for providing us with in-depth details of your concern.
At Inuit, we build privacy and security into everything we do. We know your information is valuable, and you can’t afford to take any risks with it. To keep your account secure and ensure we protect your financial information from any breaches with the number you called in, I'd suggest contacting our Customer Support Team. They have the tools that can check your account securely and provide some tips to make sure your data will be safe.
To reach them, follow the steps below:
For more details, open this article: QuickBooks Support Team.
I'm adding these articles that you can read through for tips to keep your account secure and how we protect your financial information:
I'm always here whenever you need assistance with QuickBooks in the future. You can tag my name if you want. I'm happy to provide the details you need. Take care.
I'm having the same experience with the pop-up message and fraudulent tech support number. Fortunately I did not go as far as purchasing the service. Now I get the pop-up message every minute when logged into QB. How do I get rid of the message?
Take a look at the post by jumper-d-1981 from January. It has a description of which files need to be deleted to fix this issue. You might also reinstall QB from the legitimate source, but just deleting the files should work (just reinstalling will not work, the files will persist and also need to be deleted)
I've had qb tech on numberous times and they have no clue how to remove was there someone you talked to
Thank you for adding a screenshot, Ginesis. It gives me a visual representation of your concern.
I appreciate your time and effort in contacting our phone support and isolating the root cause of the issue. I can see the inconvenience this recurring issue has caused you.
Have you tried the verify and rebuild steps? I suggest giving it a try to help resolve the error you encountered. If the same issue persists, I suggest reaching out to our engineering team so we can create an urgent investigation about this error.
Moreover, feel free to pin these articles as your guide in ensuring the security of QuickBooks files:
You can always post in the forum whenever you have concerns about your QuickBooks program.
You have clicked a link to a site outside of the QuickBooks or ProFile Communities. By clicking "Continue", you will leave the community and be taken to that site instead.
For more information visit our Security Center or to report suspicious websites you can contact us here