Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Copyright Violation Popups


  • Please log in to reply
9 replies to this topic

#1 Robert_IT

Robert_IT

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:20 PM

Posted 27 February 2018 - 09:59 AM

I am sure I am posting to the wrong forum, I have spent a great deal of time just getting this far...

 

I am getting this message on one of my users computers:

 

Potential Copyright Violation Detected. You are attempting to open this document from an unauhorized computer. If you feel you have received this message in error, please contact IHS Customer Care.

America 800-447-2273

http://www.ihs.com/Customercare

 

Thus far I have scanned with the following:

 

  • RKill
  • Vipre Rescue (safe mode, said it found infections)
  • MRT
  • Malwarebytes
  • TDSKiller
  • Malwarebytes Rootkit (says it found 6 infections)
  • Junkware Removal Tool
  • Adwcleaner
  • Webroot
  • SFC /Scannow

When I boot normally I am starting to see the normal popup windows missing parts of their graphics i.e. the yes and no buttons are just white boxes, etc...

 

What forum should I take this to?

 

Thanks,


Edited by Robert_IT, 27 February 2018 - 10:18 AM.


BC AdBot (Login to Remove)

 


#2 mikey11

mikey11

  • Members
  • 1,509 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Psychiatric Ward @ Beelitz-Heilstatten Hospital, Beelitz, Germany
  • Local time:03:20 AM

Posted 27 February 2018 - 10:07 AM

run the computer in safe mode for a bit.....do you still get it?



#3 Robert_IT

Robert_IT
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:20 PM

Posted 27 February 2018 - 10:41 AM

I could not get it out of the safe mode for a bit..., I use MSconfig to switch the system to boot safe, once in safe, I could not get the windows menu system to function, would not allow me to scroll or type in the search window, I was able to open File Explorer and go to windows\system and click on msconfig to switch off safe mode boot.

 

So I now have it booted back up normally.

 

Answering your question, I did not see popups in safe, but the system was clearly not operating normally.

 

While in the safe mode I was able to run Malwarebytes Rootkit Tool (w/o update - I unplugged the workstation from the network as a precaution), MB Rootkit tool found 6 infections, 



#4 mikey11

mikey11

  • Members
  • 1,509 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Psychiatric Ward @ Beelitz-Heilstatten Hospital, Beelitz, Germany
  • Local time:03:20 AM

Posted 27 February 2018 - 10:45 AM

when did this start happening?

 

try a system restore to a date BEFORE this problem began



#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,749 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:20 PM

Posted 27 February 2018 - 11:27 AM

Sounds like some type of scam. I will move your topic to a more appropriate forum so mikey11 can assist you from there.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 Robert_IT

Robert_IT
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:20 PM

Posted 06 March 2018 - 09:01 AM

I posted this last week, however my post was moved somewhere...  The navigation on these sites is very difficult to understand, I don't even understand if this is the proper forum on which to post this matter.

 

I have a Windows 10 Pro workstation that is showing "Potential Copyright Violation Detected" popups and the computer is running extremely slow. 

 

I have ran the following scans:

 

  • RKiller
  • SFC
  • Malwarebytes
  • Malware Rootkit tool
  • MRT
  • Superantispyware
  • ADWCleaner
  • JRT
  • Webroot
  • CCleaner

 

None of which have cleaned the malware from the machine.  Is this a re-format and re-install? I tried doing a Restore, however, there is only one restore point from 3 days ago, the problem has been on this workstation for over a week.

 

Like I said, I posted this earlier, but have no idea what happened to the post, 

 



#7 hamluis

hamluis

    Moderator


  • Moderator
  • 56,275 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:20 PM

Posted 06 March 2018 - 09:58 AM

Previous topic:  https://www.bleepingcomputer.com/forums/t/671900/copyright-violation-popups/

 

 

The topic was moved, as helper had indicated.

 

If you click on your profile...you can see the posts and topics you have previously made.

 

Merged with linked topic above.

 

Louis



#8 Robert_IT

Robert_IT
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:20 PM

Posted 06 March 2018 - 10:18 AM

I tried the Restore option, however, the only restore points I see are for 3/3/2018.

 

The "Potential Copyright Violation" popups are back with a vengeance.

 

I have checked Windows and all software to assure it is up to date.

 

When I run SFC it looks like there are a few files it is skipping.

 

 

 

 



#9 Robert_IT

Robert_IT
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:20 PM

Posted 06 March 2018 - 05:39 PM

Nevermind! I did some more research as another non-IT person asked: "What if it is legit...?" 

 

And it turns out that this software was legit. It was part of a plugin called FileOpen.  There was a free client plugin on one of our workstations, and apparently, a file was delivered to us (some time ago) that was encrypted with the Author's FileOpen program and there is now a problem with the Author's FileOpen license.  The error message I received stated that the document came from an "unauthorized computer".

 

I was approaching the problem from the standpoint that it was an unknown popup directing me to contact a phone number in the Middle East. As a system that is required to comply with a NIST security standard, when I see something that appears to be abnormal, it is lockdown and isolate time until I figure out what is happening. 

 

My bad, I assumed it was some form of malware when it turned out to be a legit warning from a legit software company. I deleted the encrypted files (obsolete data) and removed the "FileOpen" plugin.

 

Problem solved. Thank You for putting up with my false fire drill.



#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,749 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:20 PM

Posted 06 March 2018 - 05:49 PM

Glad to hear the issue has been resolved. Sometimes persistence pays off.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users