Malware on my neighbour's laptop

[think2]

I help my elderly neighbour out with her laptop sometimes and the laptop appears to have been attacked by malware. It is Windows 10 and has auto update enabled so is probably up to date with patches. A few days ago she was on facebook and she clicked on a notification or something and her laptop went berserk. The screen showed "warning warning" or something, an alert sound played and a voice repeatedly said "there's a problem" or some such thing. On the screen there was a phone number with a message saying "call Microsoft" toll free. She rang the number and spoke to a guy for 40 minutes before she realised it was a scam. She tells me that he asked her to type in a few things including I strongly suspect Win+R - for run (she says it was escape R but the escape key is nowhere the bottom left of the keyboard which she says is where one of the keys was). From what she tells me he appeared to have control of the laptop and from his end he initiated a printout on her printer of two pages of text that included a price of several hundred dollars for "fixing" the security protection on her PC.

I had previously made a recovery USB drive for her. I tried to use it to boot into safe mode but was unsuccessful. I somehow managed to initiate a "reset" of the OS - a partial reinstall but after the installation completed I couldn't log in sensibly. If I log in as non admin I get logged straight off. If I log in as admin, the screen goes blank but the mouse cursor is responsive and when I press Ctrl+Alt+Del I get the screen that asks "switch user", sign out, task manager etc. If I click on task manager the screen goes back to all black. A couple of times a BSOD has come up saying "problem, we need to restart" and something about "kernel auto boost". If I initiate a restart from the afore-mentioned "switch user" screen, I can get into safe mode and browse the file system. After logging in to safe mode, a dialog comes up saying "you'll need a new app to open this ms-get-started" with an OK button. I can get into the registry ok.

I'm probably going to do a full re-install but I would very much like to know what has happened and if anyone has heard of this scenario before. Is there anything I can look for in the file system or registry to see what malware might be present?

 

[VirtualLarry]

Don't bother. Just wipe it. Boot with a Linux LiveUSB, and save her photos and documents to an external HDD.

 

[think2]

ok, I've formatted the drive and reinstalled. Do you have any idea how a clicking a link on facebook could cause this?

On my advice she uses only Windows Defender and has no extra security software. Would bit defender or something be any help to avoid this? Is Microsoft Edge browser safer than google chrome?

 

[Unico]

Perhaps install the addon UBlock Origin to block advertising or run the Brave browser which has it intergrated into its code.

 

[RLGL]

Drive by malware. I have had the same thing happen by typing the wrong web page address and landing on an infected site. Does not matter whose security software is used. Once the message is on the screen the only way out of the situation is a hard reboot.

 

[Ketchup]

From what I have seen, this "scam" is little more than I pop-up. When I first heard of it, it was on a lady's Facebook page. There is a site that I go to every once in a while that started reverting to this page as well. it won't allow the back button, it just refreshed. But it you close the browser, you are fine. What's more, the computer really isn't "infected" with much of anything if you don't make the call. I have scanned a few computers after people saw this, but didn't grant permission to access, or didn't even make the call, and there really wasn't any major malware to speak of. So anything that was put on that computer was from the person that she allowed access to. I have seen this show up on Windows 7, Windows 10, and Android. Browsers were IE and Chrome, so I don't really think it has anything to do with programs or OS, just the content of the page clicked. I know my FB customer clicked on something that looked "interesting", not a piece of her personal content.

So to your neighbor, or anyone that runs into this, close your browser, wipe your history (if it helps you feel better) and move on.

 

[think2]

Are browsers smart enough to not store credit card numbers on the hard drive somewhere. Should my neighbour get a new credit card?

She uses Thunderbird for email and has a gmail address. Is it possible the guy has her email password? Should we cancel the email address and start a new one. Could she be at risk of identity theft?

 

[Ketchup]

If the top of the page shows that it is secure with https, then yes. The data is not "stored" on her computer (assuming there isn't a keylogger or other malicious software already present on the machine). If she is sending people credit card numbers via email, then yeah, she needs to cancel that email account and credit card account pronto.

 

[cbm80]

It's just advertising, no harm done if you ignore it.

 

[Unico]

Are browsers smart enough to not store credit card numbers on the hard drive somewhere. Should my neighbour get a new credit card?

She uses Thunderbird for email and has a gmail address. Is it possible the guy has her email password? Should we cancel the email address and start a new one. Could she be at risk of identity theft?

I’d suggest that she just change her email passwords for now.

As for the credit cards, I would go ahead and replace them. Don’t know which browser she is using but while the hacker had control of her computer it would be a simple matter to navigate to a prepared web page to collect any auto-fill details the browser would cough up. So you might want to turn off any feature for form auto-fill in her browser.

I noticed that Firefox has experimental parameter for “forms.autocomplete” in about:config but it defaults to False in my copy. Presumably a future version will have this turned on.

Take a look a the scale of this problem documented over at ghacks.net.

https://www.ghacks.net/2017/01/05/browser-autofill-data-may-be-phished/

 

[sm625]

Makes you wonder what the purpose of UAC is when any random web link can totally infect your computer without ever even bringing up one single UAC box. (?)

 

[Ketchup]

Makes you wonder what the purpose of UAC is when any random web link can totally infect your computer without ever even bringing up one single UAC box. (?)

The page isn't infecting or controlling your computer, but it does a pretty good job of tricking people into calling a person who will do just that.