New Screaming page popup titled Win Erx03 or Win ERX10

[Donald51]

These windows pages claim that my security and financial information is being captured and sent to thieves unless I contact the number given.  Malwarebytes and McAfee do not stop it.   Windows health system checks do not find it.     

[Maurice Naggar]

@Donald51,

Hi.  My name is Maurice.  The subject line caught my attention.

If there is any audio with this screen pest, it will stop when you close the web browser.  You did not mention which web browser this was on.

What you described is a browser displaying a scam - a tech support scam displayed on screen in a web browser.

It  is a kind of malvertisement and does not come from your PC. It emanates from the Internet and exists as Browser based alert and not something from some thing on your computer. Malwarebytes won't "catch it" for that reason.

Browser lockers reside in the browser cache only, it does not involve actual malware on your computer.

Please keep in mind that the computer mouse and the keyboard can still be used to get rid ( close out) the screen.

Cleaning the browser history removes the pop-up. ( tips below ).

Tech support scammers use fake warnings and lie about the state of your computer to frighten you into calling them & then flim-flam you into a so called cleanup or perhaps, some maintenance scam.

Getting rid of bogus screen (s)

Look at the very topmost right corner of the browser itself.
I mean the one for Chrome or Firefox or Edge browser itself ( or matter of fact any browser).
Move the mouse pointer over the X at the very far right-top corner and click that.
That will close the browser and its display and the audio too ( if any).

 

You could also use Alt-key + F then click on Exit.

.

Other ways available, if the one above is not a success.
You can easily use keyboard key-press shortcuts to get rid of the false pages displayed. ( see below). And if there is any video with this, it will stop when the page is closed.

 

When this fake is in the foreground and in a web browser, there are many ways to get it off the screen.
I would suggest to do a few keyboard presses to get rid of the windows on-screen.

 

press and hold CTRL key on keyboard and then tap W key. CTRL + W 
 
That should close the Tab page of the web browser in the foreground.
You can repeat as needed.

 

Every web browser will recognize the CTRL+W key-presses as a "close this window" command.

.

.

Other ways to get rid of screen:
Press and hold ALT-key on keyboard and then tap the F4 function key a to get the foreground windows closed and done away with. ( repeat use of ALT + F4 sequence). 


ALT + F4 is especially helpful against the smaller window ( if any) that is up in front.
If your machine is a notebook or laptop, you should depress and hold the ALT + FN (function key) + F4 keys.

ALT + HOME key on the keyboard will put your browser page back onto your prior choice for Home page. That easily deals with the bigger full page displayed.
Then while still in the web browser, press and hold SHIFT + CTRL + DELete keys to start the process to delete all browser cache & history.

---

Other ways to get rid of the bogus display are listed below:

There is always the ability to end the web-browser program thru using Windows' Task Manager applet.
Click the Start button and type: 
taskmgr.exe
and then press Enter. 
( or you can press and hold CTRL-key on keyboard + ALT-key +DELETE key to get Task Manager option).

In the processes tab, find the process for whichever browser you are running: 
_iexplore.exe, firefox.exe, chrome.exe, MicrosoftEdge.exe, MicrosoftEdgeCP.exe_ and then click _End Process_ or _Terminate_.

---

Look at the following Malwarebytes Blog article and scroll down to the section marked *Clear your browser's cache* 
and do that for each of your web browser programs.
https://blog.malwarebytes.com/puppum/2017/04/adware-the-series-part-1/

---

I hope this helps.

Sincerely,

Maurice

 

[Donald51]

Maurice, thanks for responding so quickly and completely.   I have a Dell Inspiron M531R with Windows 10 that I purchased off QVC in early 2014.  The deal was to include lifetime McAfee and tech support.  QVC's original tech support helped me get rid of this ransomeware several times before going out of business.   McAfee likes to give me the run around which is why I picked up Malwarebytes.   I have been turning off my PC at the off switch when these ransomeware pages open and start screeching at me, then when I open the browser again I shut it down closing out all the pages that were previously on.   In the last 3 weeks the ransomeware has come on at least twice a week.   I'm busy with some other business today, but will try to get through all your recommendations this week.   Thanks again!  

[Maurice Naggar]

Hi Donald51.

My preceding reply provided the different ways to get a scam screen Closed.  Most often, you can manage by the Keyboard shortcuts, or even using mouse to click the X close button at the very top right of the screen.  If not, then by using the Windows Task Manager to force the browser to "End Task".

 

If as you describe this happens on a frequency that you reported, it means we have to take more actions.

Lets start by having you tell us, which web browser you use most often.   and which web browser (s) these scam displays show on.

Lets also start by adding some ad blocker to Chrome & or Firefox and or Edge browser  ( the latter if your Windows is Windows 10).

Malwarebytes has browser extensions for Chrome & Firefox that can help in preventing these types of scam / malvertising displays.

if you use Chrome or Firefox browser, install the Malwarebytes beta browser extension.  There is one for Chrome & another for Firefox.

To get & install the Malwarebytes beta Chrome extension,

Open this link in your Chrome browser: https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

Then proceed with the setup.

 

To get & install the Malwarebytes beta Firefox extension.

Open this link in your Firefox browser: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

Then proceed with the setup.

.
The Malwarebytes Blog has a few articles about tech support scam browser pests.   Here is one of themhttps://blog.malwarebytes.com/cybercrime/2018/09/partnerstroka-large-tech-support-scam-operation-features-latest-browser-locker/

I mention that so you can take a look, especially down to the section about "mitigations" .....which also shows a sample of the Malwarebytes browser extension.

.

[ 2 ]

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

.

[ 3 ]

I would suggest to download, Save, and then run Malwarebytes ADWCLEANER.

Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner.

 

 

Please download the current release for Malwarebytes AdwCleaner from here:
https://downloads.malwarebytes.com/file/adwcleaner

 

Go to the folder where you saved Adwcleaner. Double click Adwcleaner to start it.

At the prompt for license agreement, review and then click on I agree.

 

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).

Then click on Dashboard button.

Click the blue button "Scan Now".

 

allow it a few minutes to finish the Scan.

 

You should then see a screen showing "Scan results".

Review what is listed. If something is listed that you know for sure is safe, then for that line, click the check-box on the left so that it is un-checked.

(NOTE, clicking the small right pointed little arrow, will cause the screen to refresh & show all line items . )

 

When ready, click on the button "Clean and repair".

If prompted to restart then click on "Clean & Restart Now".

 

[ 4 ]

Please run the Malwarebytes support tool.  Then after it is done, attach the ZIP file into your next reply.

Please use this how-to-guide  https://support.malwarebytes.com/docs/DOC-2396

Sincerely,

Maurice

[Maurice Naggar]

Hi Donald.

How is it going ?  Just want to check up on your situation.

Maurice

[Donald51]

Thanks Maurice, yes, I have Edge with Win 10 and I will try to download Adwcleaner as you recommend. -Doug

[Maurice Naggar]

Hi, Doug,

Just re-checking on you.  The Adwcleaner download & run only takes a few minutes.

[Donald51]

Maurice, you are good on staying on a subject!

Downloaded and ran it.   Found 55 PUPs, deleted all the PUPS.Optional, except the two Amazon.   Deleted 4 drive Agent, 39 Legacy, 2 SlimCleanerPlus, 2 SupportDotCom, and 6 The Bright Tag.    I read the Malwarebytes article before downloading the Adwcleaner, and I looked at the scan log and I did not see any of the cue words mentioned in the article before removing/repairing.

Thanks Maurice!

[Maurice Naggar]

I take it then that all is well ?

You are welcome.  Your case started out as a scam tech support display.

Is there anything else that you need help on?

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks