What is this virus / scam?

[Dr Mike Oxgreen]

... and what do I do about it?

My neighbour asked for help today, saying his computer is locked and it's asking for a registration key. I've taken a look, and it's instantly obvious to me that it isn't what it purports to be.

The English spelling of "dialog(ue)". No English techy that I know would spell it like that.

The grammar is terrible.

The language is designed to frighten you. Any truly official thing would use neutral language.

But I've not actually seen this beast before, nor do I know what to do about it. For now I've told him not to call anything and not to enter any information until I've got help from knowledgeable people, which is where PistonHeads comes in!

So what is it?



An overview:




Close ups:










Bugger! Sorry about the alignment!

Edited by Dr Mike Oxgreen on Thursday 25th April 16:38

[illmonkey]

It's obviously bullst, but the OS is wrecked, either which way. Try to gain access to files from an other PC, save data, rebuild OS. Potential is they've encrypted the data/HDD so you won't get anything, inwhich case, recover from their backups.

[Harpoon]

Looks like a full screen browser page or similar.

If you hit CTRL-ALT-DEL, can you get into Task Manager and kill the web browser(s) ed Edge / Chrome / Firefox / etc?

https://www.microsoft.com/security/blog/2017/04/03...

{Edit}

It could be a crypto-type virus/malware as suggested by the poster above but they just normally demand bitcoins rather than list a phone number (even that it probably connects to the scammers in India or similar)...

[Dr Mike Oxgreen]

Harpoon said:

Looks like a full screen browser page or similar.

If you hit CTRL-ALT-DEL, can you get into Task Manager and kill the web browser(s) ed Edge / Chrome / Firefox / etc?

That's a good point. Interestingly there's no mouse pointer, but I guess a web page could be designed to hide it.

I guess there's no harm in trying Ctrl-Alt-Del. Unless there is...

[illmonkey]

Dr Mike Oxgreen said:

Harpoon said:

Looks like a full screen browser page or similar.

If you hit CTRL-ALT-DEL, can you get into Task Manager and kill the web browser(s) ed Edge / Chrome / Firefox / etc?

That's a good point. Interestingly there's no mouse pointer, but I guess a web page could be designed to hide it.

I guess there's no harm in trying Ctrl-Alt-Del. Unless there is...

No harm. Go for it, I maybe jumped the gun, it could just be a dodgy page, where they make you call, pretend to be MS and take control, then they encrypt the data. Same result though.

Take it off the net straight away and work offline.

[Dr Mike Oxgreen]

illmonkey said:

Take it off the net straight away and work offline.

I'm embarrassed that I didn't think of doing that!!!

Will pull the ethernet cable out of the computer and/or router forthwith.

Then try Ctrl-Alt-Del.

So do we think this is an infection, or is it just a web page? If I close it, will it come back?

The dire warning not to restart your PC is probably just saying "This scam is so badly designed that you can easily circumvent it by just restarting your PC, so please don't do that!"

[danpalmer1993]

Family member had a the same style virus so I used the below link to sort it out.

https://malwaretips.com/blogs/remove-windows-suppo...

[zedx19]

I'd have just turned it off and booted it into safe mode, ran some virus and anti-malware checks and see if found anything. Then rebooted as normal and see if all is well.

[Funk]

zedx19 said:

I'd have just turned it off and booted it into safe mode, ran some virus and anti-malware checks and see if found anything. Then rebooted as normal and see if all is well.

This.

The scam isn't malware, it's getting you to call the scammers in India where they'll then attempt to convince you to spend £399 having one of their 'Microsoft technicians' repair your machine.

[Dr Mike Oxgreen]

zedx19 said:

I'd have just turned it off and booted it into safe mode, ran some virus and anti-malware checks and see if found anything. Then rebooted as normal and see if all is well.

I think doing anything is a bad idea until you know exactly what you're dealing with. My first reaction was to tell my neighbour to do nothing and remain calm, and wait for me to find out a bit more about it.

Having also Googled it, I agree that it is probably just a scam web page. Ctrl-Alt-Del and killing the browser with task manager should sort it, so that's what I'm going to do.

[Dr Mike Oxgreen]

Well, that was easy!

As I suspected, the warning not to restart your computer was just a desperate attempt to prevent you from killing the page.

Killed Chrome, problem appears to have gone. If it comes back I'll do a bit more digging.

Thanks everyone! :-)

[okenemem]

good old ransomware

[Harpoon]

Good time to ask the neighbour if they have anything important on the PC like photo's, documents etc and if they back them up?

If it had been a proper crypto-virus, they might be facing a rebuild and restoring from a backup... what do you mean "what backup?"

[Funk]

Harpoon said:

Good time to ask the neighbour if they have anything important on the PC like photo's, documents etc and if they back them up?

If it had been a proper crypto-virus, they might be facing a rebuild and restoring from a backup... what do you mean "what backup?"

A good point and well-made. The neighbour should consider this a stroke of luck and ensure he or she is adequately backed up. With so many cheap cloud services there's no excuse not to make sure you have safe backups.

[Dr Mike Oxgreen]

Good point.

Anyway, Mrs Oxgreen and I are now enjoying the little bottle of champers that my neighbour gave me. Cheers!

[Mr Pointy]

I hope you added a few vital addons/extensions to his browser. NoScript/Unblock Origin/Privacy Badger/Facebook Container for a start. And signed him up to a decent AV package.

[S6PNJ]

Also a good site to bookmark and possibly refer to in the future: https://www.nomoreransom.org/en/index.html
I've not had reason to use it, and I can't remember where I had it recommended from, but I recollect it was from a reputable source, hence me bookmarking it.

[TonyRPH]

OP I suggest you run Hitman Pro to clean the PC.

It has a free trial that will permit cleanups for 30 days.

[3.1416]

Check for Windows updates and install if necessary - should be automatic but not always carried out if PC switched off when installation is scheduled.