Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Called Popup Number


  • Please log in to reply
4 replies to this topic

#1 YME2019

YME2019

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 28 July 2017 - 09:49 PM

Hi there! 

 

My sister came to me today and told me that she had called a support number that popped up on her computer and did what they told her to do. I believe it looked similar to this: (I didn't see it)

 

scanpc-link.jpg

 

I ran scans with Malwarebytes and Windows Defender. Both came up empty. I also ran rkill, and will post the log file.  Malwarebytes did not find anything post rkill, nor has Windows Defender.  I found the install file that she downloaded in downloads, but can't find a program by that name. It is "Advanced Identity Protector" by Systweak. They didn't ask for any credit card info or passwords, though they did take control of her screen and show her all the services that had stopped in Task Manager. I assume that there is some kind of malware on her computer, but I am not sure how to find them or if they are there. What can I do to make sure her system is not compromised? I am going to have her change all her passwords.

 

Additionally, could someone explain why these things keep popping up? As far as I can tell, I don't do anything to cause them to pop up. 

 

Thanks 

 

 

 

rkill log file

 

Rkill 2.9.1 by Lawrence Abrams (Grinler)
Copyright 2008-2017 BleepingComputer.com
More Information about Rkill can be found at this link:
 
Program started at: 07/28/2017 08:20:21 PM in x64 mode.
Windows Version: Windows 10 Pro 
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * No malware processes found to kill.
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * No issues found.
 
Searching for Missing Digital Signatures: 
 
 * No issues found.
 
Checking HOSTS File: 
 
 * No issues found.
 
Program finished at: 07/28/2017 08:22:00 PM
Execution time: 0 hours(s), 1 minute(s), and 38 seconds(s)
 


BC AdBot (Login to Remove)

 


#2 YME2019

YME2019
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 28 July 2017 - 11:02 PM

Windows Defender scan just completed. 

 

It found and removed SupportScam:JS/TechBrolo.AA

 

Did I get it all?



#3 buddy215

buddy215

  • Moderator
  • 13,255 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:11:36 PM

Posted 29 July 2017 - 10:46 AM

The reason for this scam is to make money. Hard to believe the criminals didn't sell her something....usually hundreds of dollars.

Does she do banking on her computer or maybe have a PayPal account the criminals could of accessed?

 

Is there an ad blocker installed in the browsers on this computer?

 

Use the programs below to clean, remove adware and remove malware. What Defender removed is interesting...hadn't seen that before.

Did Defender tell you where that file was located?

 

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

 

Download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
  • download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message

Edited by buddy215, 29 July 2017 - 11:01 AM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#4 YME2019

YME2019
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 29 July 2017 - 05:36 PM

Thanks for the reply! I ran everything that you told me to, and nothing was found. The programs I found in her program files folder had no "Uninstall" option, so I just deleted them. Is there anything else I should do?



#5 buddy215

buddy215

  • Moderator
  • 13,255 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:11:36 PM

Posted 29 July 2017 - 06:10 PM

Install Adblock Plus in the browsers. Sometimes those criminal ads slip by legit ad servers. Other times it is a compromised/ hacked website or

actually a website belonging to the criminals. Adblock Plus will stop the ads on legit ad servers. Once Adblock Plus is installed, click on its ABP icon

at the top of browsers and choose Filter Preferences. Then UNcheck the box next to Allow some non-intrusive advertisements.

Adblock Plus - Chrome Web Store  Adblock Plus :: Add-ons for Firefox  Adblock Plus for IE  Adblock Plus for Edge browser

 

Use CCleaner Tools to find the Advanced Identity Protector in Windows Startups and Scheduled Tasks. If found....click on each item and

choose Delete on the right. Or you can post those logs for my review if you like.

 

Post the three lists mentioned below using CCleaner.

Open CCleaner and click on Tools. Choose Startups. On that page you will see a list of Windows Startups and at the top tabs for each browser and Scheduled Tasks.

At the bottom right of that page you will see a button when clicked will allow you to Copy and Paste the list of Windows Startups and Scheduled Tasks into your next

post. Please do that.

 

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.


Edited by buddy215, 30 July 2017 - 04:25 AM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users