Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

www.coshoope11.club


  • Please log in to reply
5 replies to this topic

#1 guyl

guyl

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:04:07 AM

Posted 11 August 2018 - 01:18 PM

Hi, I'm running the latest version of Firefox on Windows 10 desktop.  I have several windows open at a time with several tabs open in each window.  All of a sudden this ransomware hits and locks up an entire window and all its tab plus all keys on that page.  The other tabs in the other windows operate fine but I have to turn the volume down because the ransomware keeps repeating over and over to call this phone number 888-728-6247.  The popup on the screen talks about all the normal stuff - asking for money, getting into Facebook, the pc being locked up, etc.

 

This has been going on for a month or so and I was able to get rid of it by shutting the pc down and re-starting it.  But, that no longer works.  I had AVG free virus protection but that didn't catch it.  I put on Ransom Helper (I think it's called) and that didn't work.  So, I then deleted AVG and put on the free version of Avast and ran a scan but that didn't pick up anything relating to this.

 

The background screen of this indicates it's Microsoft initiating this but obviously it's not.

 

I Googled this name but there is nothing there.  Not sure what to do next.

 

Thanks,

 

Guy



BC AdBot (Login to Remove)

 


#2 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,564 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:07 AM

Posted 11 August 2018 - 06:42 PM

It's not ransomware, which is why your "anti-ransomware" and antivirus wouldn't detect anything - there's nothing actually on your computer, it's just a web page. You likely stumbled upon it from a bad ad or search result. It's a typical tech support scam.

 

If you can post the link here (put brackets around any periods so it doesn't become a live link) and a screenshot, it may help in getting it reported. Nevermind, I just noticed the topic title works, lol. I've got it pulled up and tweeting it out now.

 

More info: https://www.bleepingcomputer.com/virus-removal/threat/tech-support-scams/


Edited by Demonslay335, 11 August 2018 - 06:45 PM.

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:07 AM

Posted 11 August 2018 - 06:52 PM

You may want to read: Beware of Phony Emails & Tech Support Scams for more information about how these scams work...there are suggestions near the bottom for dealing with scams and a list of security scanning tools to use in case the usual methods do not resolve the problem or you allowed remote access into your computer.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,564 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:07 AM

Posted 11 August 2018 - 06:54 PM

I've tweeted the site out and reported it to the host's (GoDaddy) abuse email... though they are notorious for ignoring abuse complaints... best if you can take a screenshot and send the info to them as well (abuse@godaddy.com).


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#5 guyl

guyl
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:04:07 AM

Posted 11 August 2018 - 09:56 PM

First of all thank you to both of you for responding so quickly.  I sent off the e-mail to goddaddy and received an acknowledgement that they had received it, so we'll see if anything comes of it.

Second, are you asking me to run all of these tools listed here......

To remove Tech Support Scam Popups, follow these steps

 



#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:07 AM

Posted 12 August 2018 - 07:51 PM

or if you want individual assistance with a possible malware infection, you should follow the instructions in the Malware Removal and Log Section Preparation Guide. When you have done that, start a new topic and post your logs in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team. If HelpBot replies to your topic, please follow Step One and CLICK the link so it will report your topic to the team members.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users