Fake Virus Alerts, Browser Hijacking (Firefox and IE11) Using Windows 7

Anonymous
2017-05-27T01:58:55+00:00

Hi, All.   I'm trying to resolve a problem on a computer used in our senior group. Something called "Fireball" showed up on this machine. One of the other "lab rats" deleted it--I don't know exactly how they did it. What's been occurring since is this: several different kinds of fake virus alerts (to call a phone number for help--some say "Microsoft") which can be closed using Task Manager; apparent browser hijacking, because a second tab immediately opens and I can see numerous website names rotating through (google-mirror.com, ww11.home.google-mirror..., park.above.com, clicksads.club, one that says ALERT and covers the screen with **** behind a Zeus Virus alert (****.com shows in the lower left corner), with RDN/YahLover.worm... in front of it! I restricted cookies, and there are tons of pop-ups asking to save cookies: tawk.to, securityupdate9900x112.com, utm.z3wl.com, shoppons.site, scorecardresearch.com, hom.google-miriror.com, inclk.com, wkee.reddhon.com, rainbow-networks.com, com-safety-jx30.club, google.co.in, and instantcasualconnections.com (so far). There are no weird programs on the computer--that show up.

Task Manager closes these alert pop-ups and the computer is usable, but we found that every 24 hours it starts all over again. Is this some kind of Scheduled Task??

I believe the virus alerts are fake. I'm assuming someone downloaded something that was bundled with crapware. I've checked the toolbars and extensions--nothing seems wrong there. No add-ons show. I've run Malwarebytes, Adwcleaner, and CCleaner, in addition to regular scans by Defender. I have reset IE to default settings, deleted cookies, history. I've tried using SysInternals Process Explorer and Autoruns--but I don't really know what I'm looking for. I figure something weird, but I've read malware can be hidden pretty much everywhere these days. The Registry seems okay--but same story: nothing jumps out at me.

I did a system restore today, but it only went back a month, and the weirdness was still there after restart. Tomorrow I plan to run sfc /scannow and the MS System Update Readiness Tool. Will that be a waste of time? Should I just reinstall the OS?? I wonder if deleting the user accounts would get rid of any junk??

I'm out of ideas. I enjoy a challenge, but come on!! This stuff is so devious! Any thoughts would be much appreciated. I've gotten great help here with past problems... Thanks for listening...

Chris

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

44 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2017-05-27T19:13:50+00:00

    Hi Chris,

    Since you've done a lot of troubleshooting steps, we suggest performing SFC and DISM. If the issue still persists, we recommend resetting your PC.

    We'll keep an eye out on your response.

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  2. Anonymous
    2017-05-27T21:36:54+00:00

    Try some of these steps that you haven't already tried.

    To remove Zeus Trojan virus, follow these steps More info here TDSSKiller Download

    ZEMANA ANTIMALWARE PORTABLE DOWNLOAD LINK

    How to remove RDN/YahLover.worm!055BCCAC9FEC pop-ups (Removal Guide)

    Important: Do NOT use IE, as it's a malware magnet. Firefox is the best and most secure browser out there. Use the Popup blocker option. You won't miss anything.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2017-05-27T21:54:10+00:00

    Those popups are not malware. See the links at the bottom.

    It's a common scam. Click the OK button at the bottom of the popup. You should then see a box Do not allow this site to create new messages. Check it and then close the window.

    If that does not resolve it, use the Task Manager to exit the browser. Reboot and see if the pop-up goes away.

    How to Use the New Task Manager.

    http://www.wikihow.com/Open-Windows-Task-Manager

    If the problem persists, for any browser:

    Remove Tech Support Scam pop-up (Call For Support Scam)

    http://malwaretips.com/blogs/remove-tech-support-scam-popups/

    Please read:

    PSA: Tech Support Scams Pop-Ups on the Rise

    https://blog.malwarebytes.org/fraud-scam/2014/11/psa-tech-support-scams-pop-ups-on-the-rise/

    Breaking down a notably sophisticated tech support scam M.O.

    https://blogs.technet.microsoft.com/mmpc/2017/03/02/breaking-down-a-notably-sophisticated-tech-support-scam-m-o/

    For more information, see this post by GreginMich

    https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/1-888-2361-scam/0990122e-61a9-431b-947e-a904c202fa7c?msgId=8d26f1a8-041a-4351-9c24-a222fb305cbd

    Was this answer helpful?

    0 comments
  4. Anonymous
    2017-05-27T21:56:18+00:00

    You might also install Hitman Pro Trial, step 3. Also, be sure to update Malwarebytes and run another full system scan.

    Remove Tech Support Scam pop-up virus (Call For Support – Scam)

    Use a Hosts file. Blocking Unwanted Connections with a Hosts File  Down the page a ways is a link to Hostman. a small app for managing your hosts file. You can download updated hosts files with it.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2017-05-28T02:41:24+00:00

    Hi, Justine. Thanks for responding. I performed SFC today and it found nothing. I skipped DISM (the MS article I read said for Win 7 to use the System Update Readiness Tool, which I skipped).

    Think I'm gonna have to go with reinstalling...

    Thanks, again.

    Was this answer helpful?

    0 comments