3rd ransom? attempt in a week

Slippery · 05 Jul 2019

So far, this seems to be coming from having Microsoft Solitaire game sitting open along with chrome on the Titan TV Guide page, until today when it was sitting on the forum. Helped me decide that it probably is microsoft server that it's coming from.
With extensive testing with several programs, I found nothing so, I wiped the drive the first 2 times.
This time, I just closed the game and browser and came here to report this. I don't have the guts to test if it is the real deal or not. My backup machine blew a capacitor on the X58 m/b. Don't have a clue what the wise poor man's solution is yet.
If you've seen this sing out please. It's aggravating me. Using the word "irrelevant" in the notification box seems to hint that it is a translation error because that word is out of context to the rest of the notification. Other than that I'm clueless. I guess I didn't say it but I did not click on anything, just shut down and booted to wipe from the bios and recover with reflect the first 2 times. This time I just closed the programs and went looking, finding nothing.

NMI · 05 Jul 2019

Link to successful removal steps here:

"firewall Has Defined That Your Windows Microsoft System Is Damaged And Irrelevant."

Slippery · 05 Jul 2019

Thanks @NMI, I read it and d/l hitman pro. I am running Malwarebytes Premium and have the browser plugin as well as windows defender and their plugin. Neither caught this in the browser and found nothing on scans. Ditto with hitman pro which is really just a pitch to sell the program. I've tried Kapersky's TDS killer and other Sophos all with nothing found. I think that whatever it is it's hidden on my machine. Still looking. Thanks anyway.

NMI · 05 Jul 2019

What about AdwCleaner though, which was Step 1 of 4?

Slippery · 05 Jul 2019

Yup. I also reset chrome and used it's clean up system too. nothing found. I had chrome set to empty cookies and other trash. I'm going to set that off. Then see if this is being placed in a cookie and thrown away when I close chrome and that's why nothing can find it. I'll do this then run scans if I get that popup again. No telling when or if it will happen again. So, I'll mark this as solved and resurrect it if my plan bears fruit. Thank @NMI.

Porthos · 06 Jul 2019

What you described is a browser displaying a scam - a tech support scam displayed on screen in a web browser.
It is a kind of malvertisement and does not come from your PC. It emanates from the Internet and exists as Browser based alert and not something from some thing on your computer. Malwarebytes won't "catch it" for that reason.
Browser lockers reside in the browser cache only, it does not involve actual malware on your computer.

Please keep in mind that the computer mouse and the keyboard can still be used to get rid ( close out) the screen.

Cleaning the browser history removes the pop-up. ( tips below ).

Tech support scammers use fake warnings and lie about the state of your computer to frighten you into calling them & then flim-flam you into a so called cleanup or perhaps, some maintenance scam.

Getting rid of bogus screen (s)
Look at the very topmost right corner of the browser itself.
I mean the one for Chrome or Firefox or Edge browser itself ( or matter of fact any browser).
Move the mouse pointer over the X at the very far right-top corner and click that.
That will close the browser and its display and the audio too ( if any).

You could also use Alt-key + F then click on Exit.
.
Other ways available, if the one above is not a success.
You can easily use keyboard key-press shortcuts to get rid of the false pages displayed. ( see below). And if there is any video with this, it will stop when the page is closed.

When this fake is in the foreground and in a web browser, there are many ways to get it off the screen.
I would suggest to do a few keyboard presses to get rid of the windows on-screen.

press and hold CTRL key on keyboard and then tap W key. CTRL + W

That should close the Tab page of the web browser in the foreground.
You can repeat as needed.

Every web browser will recognize the CTRL+W key-presses as a "close this window" command.
.
.
Other ways to get rid of screen:
Press and hold ALT-key on keyboard and then tap the F4 function key a to get the foreground windows closed and done away with. ( repeat use of ALT + F4 sequence).

ALT + F4 is especially helpful against the smaller window ( if any) that is up in front.
If your machine is a notebook or laptop, you should depress and hold the ALT + FN (function key) + F4 keys.

ALT + HOME key on the keyboard will put your browser page back onto your prior choice for Home page. That easily deals with the bigger full page displayed.
Then while still in the web browser, press and hold SHIFT + CTRL + DELete keys to start the process to delete all browser cache & history.

Other ways to get rid of the bogus display are listed below:

There is always the ability to end the web-browser program thru using Windows' Task Manager applet.
Click the Start button and type:
taskmgr.exe
and then press Enter.
( or you can press and hold CTRL-key on keyboard + ALT-key +DELETE key to get Task Manager option).

In the processes tab, find the process for whichever browser you are running:
_iexplore.exe, firefox.exe, chrome.exe, MicrosoftEdge.exe, MicrosoftEdgeCP.exe_ and then click _End Process_ or _Terminate_.

Ztruker · 06 Jul 2019

Excellent, thanks for the clear, easy to understand explanation. Saved this for my and my friends and family's edification.

Dude · 06 Jul 2019

Yep, browser spam. I use the task manager to kill it

jimbo45 · 08 Jul 2019

Hi there
I'd avoid any of the games from the Ms store -- if you want to play things like Solitaire etc I suggest you install the classic games from W7 or if you install a Linux Virtual machine there's a whole slew of FREE card games - install package KPAT or KPATIENCE depending on the distro -- 100% safe and not ridden with advertisements, malware or anything else. The old W7 games also good - no ads / spyware etc etc.

Here's the kpat games on a Linux VM running on a W10 Host.

3rd ransom? attempt in a week-snapshot7.png

BTW things like Malwarebytes / other 3rd party AV software - especially the free versions are IMO increasingly redundant on newer versions of Windows for HOME type users -- WD improves with every release and is updated almost daily -- no 3rd party supplier can possibly keep up with that speed of development. WD on W10 is a totally different animal to previous editions of Windows where security was really just an afterthought.

These days in any case Identity theft, Scamming and downright fraud are much more likely to be a problem then any amount of nasty virus problems -- Infrastructure attacks etc aren't aimed at Home computers -- I don't think N.Korea for example is bothered about typical home computers but interrupting say the European Air traffic control system is a much more tasty target for example for that type of regime so that's where really serious high grade proffessional AV protection becomes critical -- not on typical Home computers.

As a test I downloaded a couple of TV series from TPB - not a single bit of malware -- even those torrent sites attempt to keep malware of their sites -- as for the use of TPB - well I'd gladly pay for content but if its not available in your area then what's the alternative other than going without. It's time Geo blocking was stopped and people making tv / other series should be able to market these world wide -- it's rediculous say for Netflix to have different availabilities in different countries --anyway that's another issue.

Cheers
jimbo