Fake Virus Alerts, Browser Hijacking (Firefox and IE11) Using Windows 7

Anonymous

Hi, All. I'm trying to resolve a problem on a computer used in our senior group. Something called "Fireball" showed up on this machine. One of the other "lab rats" deleted it--I don't know exactly how they did it. What's been occurring since is this: several different kinds of fake virus alerts (to call a phone number for help--some say "Microsoft") which can be closed using Task Manager; apparent browser hijacking, because a second tab immediately opens and I can see numerous website names rotating through (google-mirror.com, ww11.home.google-mirror..., park.above.com, clicksads.club, one that says ALERT and covers the screen with **** behind a Zeus Virus alert (****.com shows in the lower left corner), with RDN/YahLover.worm... in front of it! I restricted cookies, and there are tons of pop-ups asking to save cookies: tawk.to, securityupdate9900x112.com, utm.z3wl.com, shoppons.site, scorecardresearch.com, hom.google-miriror.com, inclk.com, wkee.reddhon.com, rainbow-networks.com, com-safety-jx30.club, google.co.in, and instantcasualconnections.com (so far). There are no weird programs on the computer--that show up.

Task Manager closes these alert pop-ups and the computer is usable, but we found that every 24 hours it starts all over again. Is this some kind of Scheduled Task??

I believe the virus alerts are fake. I'm assuming someone downloaded something that was bundled with crapware. I've checked the toolbars and extensions--nothing seems wrong there. No add-ons show. I've run Malwarebytes, Adwcleaner, and CCleaner, in addition to regular scans by Defender. I have reset IE to default settings, deleted cookies, history. I've tried using SysInternals Process Explorer and Autoruns--but I don't really know what I'm looking for. I figure something weird, but I've read malware can be hidden pretty much everywhere these days. The Registry seems okay--but same story: nothing jumps out at me.

I did a system restore today, but it only went back a month, and the weirdness was still there after restart. Tomorrow I plan to run sfc /scannow and the MS System Update Readiness Tool. Will that be a waste of time? Should I just reinstall the OS?? I wonder if deleting the user accounts would get rid of any junk??

I'm out of ideas. I enjoy a challenge, but come on!! This stuff is so devious! Any thoughts would be much appreciated. I've gotten great help here with past problems... Thanks for listening...

Chris

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

44 answers

Anonymous

2017-05-27T19:13:50+00:00

Hi Chris,

Since you've done a lot of troubleshooting steps, we suggest performing SFC and DISM. If the issue still persists, we recommend resetting your PC.

We'll keep an eye out on your response.
Was this answer helpful?

4 people found this answer helpful.

0 comments No comments
Anonymous

2017-05-28T06:16:33+00:00

It sounded to me like something more may be going on besides the fake tech scam. I don't s'pose you have time to post this issue on a malware support forum? They may have seen similar cases. There could be quite a wait, so it's up to you. MalwareBytes and Bleeping Computer are a couple.

How about your browser extensions. Have you checked to see whether there's anything installed, in either FF or IE, that you don't recognize and looks suspect? Just a thought, since you're being redirected.

Edit: I wonder if this is the 'fireball' you ref'd to. Trojan: Win32/Fireball

MS page says, "This threat can perform a number of actions of a malicious hacker's choice on your PC."
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Anonymous

2017-05-27T21:56:18+00:00

You might also install Hitman Pro Trial, step 3. Also, be sure to update Malwarebytes and run another full system scan.

Remove Tech Support Scam pop-up virus (Call For Support – Scam)

Use a Hosts file. Blocking Unwanted Connections with a Hosts File Down the page a ways is a link to Hostman. a small app for managing your hosts file. You can download updated hosts files with it.
Was this answer helpful?

0 comments No comments
Anonymous

2017-05-27T21:54:10+00:00

Those popups are not malware. See the links at the bottom.

It's a common scam. Click the OK button at the bottom of the popup. You should then see a box Do not allow this site to create new messages. Check it and then close the window.

If that does not resolve it, use the Task Manager to exit the browser. Reboot and see if the pop-up goes away.

How to Use the New Task Manager.

http://www.wikihow.com/Open-Windows-Task-Manager

If the problem persists, for any browser:

Remove Tech Support Scam pop-up (Call For Support Scam)

http://malwaretips.com/blogs/remove-tech-support-scam-popups/

Please read:

PSA: Tech Support Scams Pop-Ups on the Rise

https://blog.malwarebytes.org/fraud-scam/2014/11/psa-tech-support-scams-pop-ups-on-the-rise/

Breaking down a notably sophisticated tech support scam M.O.

https://blogs.technet.microsoft.com/mmpc/2017/03/02/breaking-down-a-notably-sophisticated-tech-support-scam-m-o/

For more information, see this post by GreginMich

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/1-888-2361-scam/0990122e-61a9-431b-947e-a904c202fa7c?msgId=8d26f1a8-041a-4351-9c24-a222fb305cbd
Was this answer helpful?

0 comments No comments
Anonymous

2017-05-27T21:36:54+00:00

Try some of these steps that you haven't already tried.

To remove Zeus Trojan virus, follow these steps More info here TDSSKiller Download

ZEMANA ANTIMALWARE PORTABLE DOWNLOAD LINK

How to remove RDN/YahLover.worm!055BCCAC9FEC pop-ups (Removal Guide)

Important: Do NOT use IE, as it's a malware magnet. Firefox is the best and most secure browser out there. Use the Popup blocker option. You won't miss anything.
Was this answer helpful?

0 comments No comments