Fake Virus Alerts, Browser Hijacking (Firefox and IE11) Using Windows 7

Anonymous
2017-05-27T01:58:55+00:00

Hi, All.   I'm trying to resolve a problem on a computer used in our senior group. Something called "Fireball" showed up on this machine. One of the other "lab rats" deleted it--I don't know exactly how they did it. What's been occurring since is this: several different kinds of fake virus alerts (to call a phone number for help--some say "Microsoft") which can be closed using Task Manager; apparent browser hijacking, because a second tab immediately opens and I can see numerous website names rotating through (google-mirror.com, ww11.home.google-mirror..., park.above.com, clicksads.club, one that says ALERT and covers the screen with **** behind a Zeus Virus alert (****.com shows in the lower left corner), with RDN/YahLover.worm... in front of it! I restricted cookies, and there are tons of pop-ups asking to save cookies: tawk.to, securityupdate9900x112.com, utm.z3wl.com, shoppons.site, scorecardresearch.com, hom.google-miriror.com, inclk.com, wkee.reddhon.com, rainbow-networks.com, com-safety-jx30.club, google.co.in, and instantcasualconnections.com (so far). There are no weird programs on the computer--that show up.

Task Manager closes these alert pop-ups and the computer is usable, but we found that every 24 hours it starts all over again. Is this some kind of Scheduled Task??

I believe the virus alerts are fake. I'm assuming someone downloaded something that was bundled with crapware. I've checked the toolbars and extensions--nothing seems wrong there. No add-ons show. I've run Malwarebytes, Adwcleaner, and CCleaner, in addition to regular scans by Defender. I have reset IE to default settings, deleted cookies, history. I've tried using SysInternals Process Explorer and Autoruns--but I don't really know what I'm looking for. I figure something weird, but I've read malware can be hidden pretty much everywhere these days. The Registry seems okay--but same story: nothing jumps out at me.

I did a system restore today, but it only went back a month, and the weirdness was still there after restart. Tomorrow I plan to run sfc /scannow and the MS System Update Readiness Tool. Will that be a waste of time? Should I just reinstall the OS?? I wonder if deleting the user accounts would get rid of any junk??

I'm out of ideas. I enjoy a challenge, but come on!! This stuff is so devious! Any thoughts would be much appreciated. I've gotten great help here with past problems... Thanks for listening...

Chris

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

44 answers

Sort by: Newest
  1. Anonymous
    2017-06-01T20:14:51+00:00

    So I confirmed it's Office 2010--yay. Checked for updates, got 3 error messages (rats!!), but then started downloading 1 of 185. They've been installing now  for over 2 hours. Have 18 to go...

    I changed the update settings on two machines (#12 and the Instructor's) and will get input from the other folks regarding changing all of them. I believe we should...

    More work tomorrow...

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2017-06-01T19:46:36+00:00

    Thanks, Carol!! You and Rob were really so helpful through this! I decided, after reading his last reply, to change our Windows Update setting back to automatic. Folks here had decided to turn it off when we kept getting the GWX pop-up, but never turned it back on. We had been manually updating every Monday (or so), but I really don't like that. Makes me nervous. When we're all back in the lab next week, I'm going to have a sit-down with the "big guns," and discuss possible changes (improvements!) to the way we manage these machines. I'm armed and dangerous now! :)

    Thanks for the encouragement and "atta girl," Carol! Guess I'm not as dumb as I look! :)

    Yep, the puppet shows should be a good time... But I think I'd rather sit at a computer! :)

    Chris

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2017-06-01T08:29:12+00:00

    Rob, doesn't the SmartScreen just work with IE and Edge browsers?

    "Microsoft will know everything about what you run and install, make the SmartScreen filter less desirable for many users." http://winaero.com/blog/how-to-disable-windows-smartscreen-in-windows-10/

    I must comment on the HOSTS file topic again, only for clarification. It would serve no purpose at all, if it only blocked those static addresses. Don't you think those dynamic addresses are spawned from static addresses? In fact, I think it would prevent those tech support scam popups. Those are potential malware infections.

    And as I told Chris earlier on, the instr. say to Stop the DNS Client Service and set it to Manual or Disabled startup, so it doesn't slow down the system. (It's bloated programs like Adobe Reader that really bog down a system, AND thankfully, MS finally left it out of Win10! I had to perform exorcism to get it off my Win7.) Have you checked out this page? http://winhelp2002.mvps.org/HOSTS.HTM

    MVPS HOSTS now includes entries for most major parasites, hijackers and unwanted Adware/Spyware programs!

    Started providing a HOSTS file in 1998 ... and proudly still the #1 rated HOSTS file on Google ..

    Also, it's being maintained by the guy who created it. :) There's really nothing to keeping it updated, or even adding it your system. Download Hosts.zip. Unzip into a new folder on your desktop, for example. Run the batch file. Press any key. DONE. Delete folder.

    HostMan could be added to your taskbar or pinned to Start menu as a tile. Takes seconds to update, and to add in the first place. You can also disable HOSTS file temporarily, if you think you need to.

    Carol

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2017-06-01T08:00:09+00:00

    "What I was talking about is the direct integration of Internet Explorer into the operating system itself as a portion of the Windows Shell and other critical system components.  This is how earlier versions including Windows XP with IE6 were designed, which led to technical issues.."

    Rob, actually I was referring to integration into Windows. It's never occurred to me that "being part of Windows" could mean included, or bundled, with it. Interesting point! Not to drag this out, but I'm pretty sure it was still integrated until 10. I recall reading tidbits about this exciting new OS Microsoft was developing and reading the great news.. at last they were de-integrating ? it from Windows. I have 7 on my desktop and 10 on my notebook. I'm sure you've probably noticed, on Win10 start menu IE is now listed under Windows Accessories?

    I realize XP is history. I was using it as an example that the original installation hasn't always been the most secure. Thing is, the average user isn't going to bother to configure it to make it more secure. Win 7 and 10 are a great improvement, for sure.

    I do consider privacy as a type of security. I believe MS sold out our privacy to the Federal government. What reason would they have for snooping in our emails, personal folders, basically everything? DYK they also included a keylogger in 10? Hmmm..... Google doesn't do all that. Apple refused to create a backdoor for the feds, if I recall, or whatever it was. I realize it's a trade-off, but they could have found a way to make it opt-in rather than opt-out. When user goes to use Cortana's features, they could have put up a message... in order to use this feature, you must first.. such and such, by going into Privacy settings and turning on these features. Yes, that could be complicated for some average user but so are a lot of things they should be aware of.

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2017-06-01T07:12:57+00:00

    Chris,

    I don't really hate MS but have been known to curse them a lot. Haha.... Although, I never blame them for problems I encounter or cause. That's what many users do. If something doesn't work right, it's MS's fault not theirs!

    I'm comfortable with Windows too, simply because I've become very familiar with it. Exactly... Chromebook is a good choice for many people. Just keep it simple. No hassles.

    A puppet show? Well, that sounds like a lot of fun for both you and the kids. :)

    I can see you're all set up and ready to go again! Good job, girl. ;-)  

    You're welcome, Chris!

    Was this answer helpful?

    0 comments No comments