Fake Virus Alerts, Browser Hijacking (Firefox and IE11) Using Windows 7

Anonymous
2017-05-27T01:58:55+00:00

Hi, All.   I'm trying to resolve a problem on a computer used in our senior group. Something called "Fireball" showed up on this machine. One of the other "lab rats" deleted it--I don't know exactly how they did it. What's been occurring since is this: several different kinds of fake virus alerts (to call a phone number for help--some say "Microsoft") which can be closed using Task Manager; apparent browser hijacking, because a second tab immediately opens and I can see numerous website names rotating through (google-mirror.com, ww11.home.google-mirror..., park.above.com, clicksads.club, one that says ALERT and covers the screen with **** behind a Zeus Virus alert (****.com shows in the lower left corner), with RDN/YahLover.worm... in front of it! I restricted cookies, and there are tons of pop-ups asking to save cookies: tawk.to, securityupdate9900x112.com, utm.z3wl.com, shoppons.site, scorecardresearch.com, hom.google-miriror.com, inclk.com, wkee.reddhon.com, rainbow-networks.com, com-safety-jx30.club, google.co.in, and instantcasualconnections.com (so far). There are no weird programs on the computer--that show up.

Task Manager closes these alert pop-ups and the computer is usable, but we found that every 24 hours it starts all over again. Is this some kind of Scheduled Task??

I believe the virus alerts are fake. I'm assuming someone downloaded something that was bundled with crapware. I've checked the toolbars and extensions--nothing seems wrong there. No add-ons show. I've run Malwarebytes, Adwcleaner, and CCleaner, in addition to regular scans by Defender. I have reset IE to default settings, deleted cookies, history. I've tried using SysInternals Process Explorer and Autoruns--but I don't really know what I'm looking for. I figure something weird, but I've read malware can be hidden pretty much everywhere these days. The Registry seems okay--but same story: nothing jumps out at me.

I did a system restore today, but it only went back a month, and the weirdness was still there after restart. Tomorrow I plan to run sfc /scannow and the MS System Update Readiness Tool. Will that be a waste of time? Should I just reinstall the OS?? I wonder if deleting the user accounts would get rid of any junk??

I'm out of ideas. I enjoy a challenge, but come on!! This stuff is so devious! Any thoughts would be much appreciated. I've gotten great help here with past problems... Thanks for listening...

Chris

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

44 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2017-05-28T04:30:40+00:00

    Hey, Carol. I went to the link on the Hosts file, and if I understand it correctly, I can simply download the file (I see it's incredibly extensive) and it might contain the sites that are causing our problems. Is that right? I read in How to Geek that you can also make your own entry(ies) for websites you want to block access to, as well.

    Am I getting the concept? If you can give me more info, I'd appreciate it. This is a whole new tool for me.

    Thanks.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2017-05-28T03:20:44+00:00

    Hey, Bruce. Thanks for your response. I do use Task Manager to close these popups. I don't get that box to prevent creating new messages, though--maybe because it's Windows 7.

    I've read those articles and how-to guides on the Malwarebytes blog. None of the AV scans have found a thing.

    May just have to reinstall Win 7.

    Thanks, again.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2017-05-28T03:14:15+00:00

    Hi, Carol. Thanks for your reply. I'm not familiar with the Hosts file. It sounds like this action would fix the issue, but it sounds very involved. I'm unclear whether this is a permanent thing that you set up and then leave, or if it's temporary. I'll have to read about it to understand it...

    Thanks,

    Chris

    Was this answer helpful?

    0 comments
  4. Anonymous
    2017-05-28T02:54:58+00:00

    Thanks for your response, Carol. I actually ran Zemana. Apparently HitManPro had already been downloaded and the free trial period expired. I haven't run TDSSKiller. Today I ran a full MSE scan--nothing found. I was so hoping it would find a bunch of junk!!

    Might end up just reinstalling Win 7, but I sure hate to give up!

    I know IE is bad. I'll see if the lab group is willing to stop using it. Firefox was also affected, but not Chrome...

    Thanks, again.

    Chris

    Was this answer helpful?

    0 comments
  5. Anonymous
    2017-05-28T02:41:24+00:00

    Hi, Justine. Thanks for responding. I performed SFC today and it found nothing. I skipped DISM (the MS article I read said for Win 7 to use the System Update Readiness Tool, which I skipped).

    Think I'm gonna have to go with reinstalling...

    Thanks, again.

    Was this answer helpful?

    0 comments