U.S. CitiesCity-Data Forum Index
Celebrating Veterans Day!
Go Back   City-Data Forum > General Forums > Science and Technology > Computers
 [Register]
Please register to participate in our discussions with 2 million other members - it's free and quick! Some forums can only be seen by registered members. After you create your account, you'll be able to customize options and access all our 15,000 new posts/day with fewer ads.
View detailed profile (Advanced) or search
site with Google Custom Search

Search Forums  (Advanced)
Reply Start New Thread
 
Old 07-17-2016, 12:13 PM
 
95 posts, read 78,378 times
Reputation: 253

Advertisements

Hello the only thing I know how to do on my computer is turn it on and to delete mail. What I am trying to say is I don't know bukus about computers.

ok I don't visit a lot of sites facebook and utube and a few other favorites. I don't stray or open anything attachments etc. I was just minding my own business and clicked on a story that was on the side of the news page I was on. All of a sudden a banner covered my page and said that my computer was invested and I was to call this number.

I shut down the computer and rebooted it and low and behold that banner filled the page saying I have to call Microsoft. I went and got my husband and he tried to get the banner off the page. He ended up calling and Microsoft had him do a few things then gave permission for them to fix the problem on there end.

They said last week on 3 certain days someone went to these sites and that is where the virus came from so he looks at me and I said know I only go to the same sites I have been going to for the last year or so. Then we thought of our adult daughter come to visit last week and was on the computer.

the bottom lline is they said we will fix it for 1 time fee o f300.00. my husband said we don't have that kind of money we are both retired and have a fixed income. oh they said in that case we can do it for 140.00 amazing how they dropped the price. I kept saying to my husband via paper and a pen how do we know we are really talking to Microsoft and you just gave them 149 to fix the problem.

I am wondering if we got scammed. they did fix the problem and showed what caused the virus and the dates and time but still it was from a week ago it takes that long for a virus to shut down my computer a week after daughter went to those site.?

confused in jersey thank you
Reply With Quote Quick reply to this message

 
Old 07-17-2016, 02:22 PM
 
Location: (six-cent-dix-sept)
4,875 posts, read 2,494,990 times
Reputation: 3132
its a scam. probably someone from lagos, bangalore, moscow...
you gave permission for the criminals to read files on your computer. they probably made copies of your emails (tax returns, credit card info, ...). or probably installed a keylogger.
Reply With Quote Quick reply to this message
 
Old 07-17-2016, 04:22 PM
 
Location: Log "cabin" west of Bangor
5,721 posts, read 6,912,654 times
Reputation: 10448
You got screwed. You now have malware installed. If you don't know how to do it yourself, take it to someone who knows what he/she is doing (even if you have to pay a local pro) to have the system restored to a point just prior to the date of this event, or to run a *real* virus/malware scan on it. (Do NOT take it to staples, and do NOT let the 'Geek Squad' touch it.)
Reply With Quote Quick reply to this message
 
Old 07-17-2016, 04:29 PM
 
1,648 posts, read 1,537,313 times
Reputation: 12396
If you called the "Microsoft" number that was on the banner, you were connected to the scammers who put the banner on your computer in the fist place. The purpose was to get you to call the number displayed on the banner and give the scammer access to your computer so they could install the malware and then offer to "fix" it if you pay them.


Follow the advice of the poster who recommended taking the computer to an independent professional computer repair service.


If you don't have good virus protection on your computer, you should consider installing it, which might help to prevent similar problems in the future.
Reply With Quote Quick reply to this message
 
Old 07-17-2016, 05:09 PM
 
Location: Log "cabin" west of Bangor
5,721 posts, read 6,912,654 times
Reputation: 10448
Quote:
Originally Posted by Chaofan View Post
If you don't have good virus protection on your computer, you should consider installing it, which might help to prevent similar problems in the future.
No, that won't help with this particular problem.

I have run into this myself recently, as a result of an event on a website that I help to manage. External Google and Bing searches, and internal searches (which use Google functions) return links that appear to be valid, but if clicked directly the user is taken to an unexpected site. While many of the sites appear to be adult-oriented, one is a scammer site with a "Your computer is infected blah blah blah. Call Microsoft Support at (Tel. No.) to fix."

There is nothing 'wrong' with the machine at this point. There is no virus or other malware installed.

All the user needs to do is close the browser tab/window and everything is fine.


It is only if the user actually calls the number and allows the 'tech' (scammer) access to the machine that anything bad happens.

A virus scanner will not prevent this from occurring, as the scam dupes the unwitting/ignorant user into giving the scammer direct access to the machine.

This is an education problem, not a virus problem.

This issue is currently known to affect Google and Bing search engines and functions and can occur whether you use the search function in your browser or if you go to the Google or Bing website directly and search from there.

This issue DOES NOT affect users using the DuckDuckGo search engine, either through the site directly or through the browser. (I am not sure how or why this is, but it is.)

-----------------------------------------------------------

Note:

The user(s) of the machine do not have to have actually tried or intended to visit any 'unusual' or 'bad' websites. The browser is hijacked and redirected independently of where the user wanted to go and thought he/she was going. Do not accuse other users of the machine of visiting [what you consider to be] illicit web sites, other users may be completely innocent of such activities.
Reply With Quote Quick reply to this message
 
Old 07-17-2016, 05:35 PM
 
Location: Southern New Hampshire
7,443 posts, read 13,073,040 times
Reputation: 23084
Quote:
Originally Posted by Zymer View Post
... While many of the sites appear to be adult-oriented, one is a scammer site with a "Your computer is infected blah blah blah. Call Microsoft Support at (Tel. No.) to fix."

There is nothing 'wrong' with the machine at this point. There is no virus or other malware installed.

All the user needs to do is close the browser tab/window and everything is fine.


It is only if the user actually calls the number and allows the 'tech' (scammer) access to the machine that anything bad happens.
But Zymer, the OP wrote this:

Quote:
Originally Posted by sutton08865 View Post
... I was just minding my own business and clicked on a story that was on the side of the news page I was on. All of a sudden a banner covered my page and said that my computer was invested and I was to call this number.

I shut down the computer and rebooted it and low and behold that banner filled the page saying I have to call Microsoft. I went and got my husband and he tried to get the banner off the page. He ended up calling and Microsoft had him do a few things then gave permission for them to fix the problem on there end.
Doesn't the fact that the "bad" banner is still showing AFTER a re-boot indicate that something bad HAD already happened? Otherwise her computer should have just started normally, I would think.
Reply With Quote Quick reply to this message
 
Old 07-17-2016, 06:17 PM
 
Location: Log "cabin" west of Bangor
5,721 posts, read 6,912,654 times
Reputation: 10448
Quote:
Originally Posted by karen_in_nh_2012 View Post
But Zymer, the OP wrote this:



Doesn't the fact that the "bad" banner is still showing AFTER a re-boot indicate that something bad HAD already happened? Otherwise her computer should have just started normally, I would think.
I might agree with you, if I believed the OP's story to be correct as written. But, for various reasons, I do not. Perhaps I have grown too cynical.

At any rate, the search hijacking behavior is real and and occurring as I described it. I and several others are trying to figure out how it is being done but we have no joy yet (Go Daddy, who hosts the site on which we have documented the behavior, is not being cooperative). I don't know how many other sites are affected.
Reply With Quote Quick reply to this message
 
Old 07-17-2016, 08:22 PM
 
95 posts, read 78,378 times
Reputation: 253
thank you all the replied In my gut it was telling me something isn't right. But hubby gave his credit card number and said if it isn't real then I will work with the credit company. he said that is why he used his credit card. if it is a scam atleat they cant get to our checking and savings info since we don't do anything online.

I will break the bad news to hubby and he will call his credit card company to let them know he was scammed and cancel the credit card.

what do we do the next time this happens again? nothing we did from reboot to unplugging computer and waited 20 minutes and turned it back on. still was not able to do anything. I do have a printed copy of the tech support memo that they worked on the computer :
WEMO Tech support they gave us our customer id # and contact #s to call if we have any more problems.

I broke the bad news to hubby he said he will take care of it in the morning calling his credit card company.

but once again what do we do if the banner fills the page again. what or how do I get around it. We do have Norton virus protection. we have been on the computer since 1999 and never incounted a problem not the same computers but atleast ten over the years
before this . n
thank you again

Last edited by sutton08865; 07-17-2016 at 08:25 PM.. Reason: forgot something
Reply With Quote Quick reply to this message
 
Old 07-18-2016, 01:27 AM
 
40,161 posts, read 41,766,549 times
Reputation: 16735
Quote:
Originally Posted by sutton08865 View Post

what do we do the next time this happens again?
When this happens hold down the left ctrl , alt and then delete button, release all three. This will open a window that gives you a few options, select Task Manager. Alternatively in the Windows search box search you can search for task manager. When you have task manager open on the processes tab find the browser, if you are using windows 10 this is most likely going to be Microsoft Edge. Right click it and select end task, this will close the browser. At this point typically you can open the browser and it will be gone.

I'm assuming in your case after rebooting, everything is fine. It's when you are opening the browser it immediately appears? In that case what has happened is they have changed the browsers homepage. I've seen this on my parents computer with Microsoft Edge and you are locked out of the options menu to change it back.

Make sure the browser is closed, send yourself an email with a link to any page. http://www.google.com for example. When you click the link in the email it will open the page in the browser bypassing loading the hijacked homepage. Go into your browser settings and change the homepage to whatever you want.

Last but not least download and run Malwarebytes. This will most likely find all kinds of crap, let it clean it all.

Last edited by thecoalman; 07-18-2016 at 01:42 AM..
Reply With Quote Quick reply to this message
 
Old 07-18-2016, 01:46 AM
 
40,161 posts, read 41,766,549 times
Reputation: 16735
Quote:
Originally Posted by Zymer View Post


All the user needs to do is close the browser tab/window and everything is fine.

As I said I saw this on my parents machine using MS Edge, they managed to change the homepage. I would assume someone probably clicked something to change it. Opening the browser of course immediately opens the warning putting you into that loop of dialog boxes. You cannot access the options menu to change the homepage back because of the dialog box. Sending a link in an email is the work around.

Also note Malwarebytes found nothing.
Reply With Quote Quick reply to this message
Please register to post and access all features of our very popular forum. It is free and quick. Over $68,000 in prizes has already been given out to active posters on our forum. Additional giveaways are planned.

Detailed information about all U.S. cities, counties, and zip codes on our site: City-data.com.


Reply
Please update this thread with any new information or opinions. This open thread is still read by thousands of people, so we encourage all additional points of view.

Quick Reply
Message:

Over $104,000 in prizes was already given out to active posters on our forum and additional giveaways are planned!

Go Back   City-Data Forum > General Forums > Science and Technology > Computers
Similar Threads
Follow City-Data.com founder on our Forum or

All times are GMT -6. The time now is 08:12 PM.

© 2005-2019, Advameg, Inc. · Please obey Forum Rules · Terms of Use and Privacy Policy · Bug Bounty

City-Data.com - Archive 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35 - Top