Tech Support Scam Popup

wagnsew · Jun 2, 2018

My mother-in-law got a tech support popup on her computer and called. They uninstalled MalwareBytes and loaded and a number of freeware programs then declared it fixed. And charged a lot of money.

It is a Windows 7 Home laptop. I've run the scans for malware and have attached the logs. The computer seems to be running OK. It looks like they did a backup of the registry. Not sure what they may have done to the registry. There are some *.bat files on the desktop. One is FirewallSecurity.bat, AdvanceSecurity.bat and VPNSecurity.bat. She tells me these are from the "tech support" people. Just not sure what could be hidden and working in the background.

There are some weird things happening and I am not sure if it because of the "fixes" the "tech support" did on her computer or not. Right mouse click does not always work. Also, files in the Library are locked and a message comes up that they are not accessible. Plus there are duplications of folders, some locked some not.

Thanks,
Chris

TimW · Jun 2, 2018

Well, I kind of doubt they have done anything malicious, since they already have their money. But...I would advise you do a system restore to before this happened, rerun the scans and attach those logs.

wagnsew · Jun 3, 2018

Fortunately, husband works for bank and was able to stop the payment. The earliest restore point was the day that she called "tech support". It was when they installed AdBlock Plus on her computer. Did the restore and reran the scans and attached files. Is there anything available to prevent the popups in the future?

Chris

TimW · Jun 3, 2018

Please remove everything in ADWCleaner - except:
PUP.Optional.DriverAgent HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\DriverSupport.exe
PUP.Optional.DriverAgent HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\DriverSupport.exe
PUP.Optional.DriverAgent HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\driversupport.com
PUP.Optional.DriverAgent HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\download.driversupport.com
PUP.Optional.DriverAgent HKCU\Software\Microsoft\Internet Explorer\DOMStorage\driversupport.com
PUP.Optional.DriverSupport HKU\S-1-5-18\Software\ActiveOptimization
PUP.Optional.DriverSupport HKCU\Software\ActiveOptimization
PUP.Optional.DriverSupport HKU\S-1-5-20\Software\ActiveOptimization
PUP.Optional.DriverSupport HKU\S-1-5-19\Software\ActiveOptimization
PUP.Optional.DriverSupport HKU\.DEFAULT\Software\ActiveOptimization
PUP.Optional.DriverSupport HKLM\Software\Wow6432Node\ActiveOptimization

Rerun Hitman and remove everything it finds.

Reboot and rescan with both ADW and Hitman and attach the new logs.

I suggest you install WOT on their system. These tech scam pop ups come from infected web sites or links.

Good to know you were able to cancel the payment!!

wagnsew · Jun 3, 2018

Here are the new logs.

First thing I thought when I saw WOT was World of Tanks...it takes me a minute sometimes.

TimW · Jun 3, 2018

wagnsew said: ↑

First thing I thought when I saw WOT was World of Tanks
Click to expand...

LOL....You/they should be good. I have occasionaly been hit with the tech scam and all I could do was to close my browser ( often with Task Manager ) and then I could reopen and delete the tab.

But you do need to tell you folks to not fall for the scam in the future.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Re-enable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 or 10 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

wagnsew · Jun 10, 2018

Sorry to be so long in replying. I was out of town for business.

The computer seems to be running well. I've removed all of the tools and done the general clean up. The computer now has a big sticky note reminding her not to call any 800 numbers that pop up!

Thanks for your help.
Chris

TimW · Jun 11, 2018

No problem. Good luck.

Log in or Sign up

Tech Support Scam Popup

wagnsew Private E-2

Attached Files:

Malwarebytes log file.txt

RogueKillerLog.txt

HitmanPro_20180601_2359.log

MGlogs.zip

AdwCleaner[S00].txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

wagnsew Private E-2

Attached Files:

AdwCleaner[S01].txt

MB log.txt

RogueKillerLog.txt

HitmanPro_20180602_2335.log

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

wagnsew Private E-2

Attached Files:

AdwCleaner[S03].txt

HitmanPro_20180603_1108.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

wagnsew Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Tech Support Scam Popup

wagnsew Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

wagnsew Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

wagnsew Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

wagnsew Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches