Something nasty in my tech preview

tinmar49 said:

I have had a copy of the technical preview since the beginning, using WD and the free Malwarebytes with no problems up till last night. My home page on Edge is Sky.com which has my email and news, and I was looking through the many news items when a "warning " popped up. "PLEASE CONTACT MICROSOFT LIVE TECHNICIANS", and a UK phone number, (020)3805 0592 (toll free). The website was tekharmor.com. The browser was locked, no way to shut it down except shutting down or restarting the pc. After restarting the pc the malware was still there. Another restart later, I ran Malwarebytes and Windows Defender without anything being detected. The tech preview is about to be scrapped and a fresh load put on the pc, I will not be held to ransom by these b*****ds.

Yeah, unfortunately Edge does not support extensions yet, and it sounds like you may have been served an infected ad (very common these days). Malwarebytes Antimalware Free is not an "active" protection. The paid version probably would have prevented this from happening. Their Anti-Exploit helps in these situations a bit. Also CryptoPrevent.

Solved Scammers Exploit Windows 10 Upgrade Rollout-What You Need to Know - Windows 10 Forums

Hate to see you quit the Insiders program over this! :)

Matth79 said:

Just got caught by these scum, though I've got used to dealing with these.

I'd say it's a browser locker, comes from a malicious ad.

Browser can be closed by using task manager (CTRL-ALT-DEL etc.).

But when you re-open, it opens the same tab again!

DO NOT re-open the browser directly, do something that will open a new tab (easy if you use Cortana) - the offending tab will now be inactive, and then you can close the browser (close all tabs) - now you're clear!

You can change that behavior in settings. Smart money is to always closing all tabs on shut down while opening to a secure home page

Suggest you run this program to try to terminate the malware process that may be blocking your attempts at removal. Do NOT reboot after running this program. Once this program is run, scan with your malware scanners to see if they show up & can be removed.

RKill Download

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools. When finished it will display a log file that shows the processes that were terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again. Instead, after running RKill you should immediately scan your computer using some sort of anti-malware or anti-virus program so that the infections can be properly removed.

Below are a list of RKill download links using different filenames. We offer RKill under different filenames because some malware will not allow processes to run unless they have a certain filename. Therefore when attempting to run RKill, if a malware terminates it please try a different filename offered below.

Other programs you could run would be AdwCleaner & JRT, which are good at dealing with adware.

AdwCleaner Download

Junkware Removal Tool Download