Windows Defender Security Center - app ads.fiancetrack(2).dll

[h8tshaqz]

 Just recently, I received this Windows Defender Security Center warning popup on my screen after clicking on a DuckDuckGo search link result --the search critera entered was something to the effect of 'social security medicare advantage plans' - I clicked on the top link and encountered this: "Windows Defender - Security Warning...ACCESS TO THIS PC HAS BEEN BLOCKED FOR SECURITY REASONS...your coputer has alerted us that it has been infected with a Trojan Spyware.  The following data has been compromised...App: Ads.fiancetrack(2).dll...Threat Detected: Trojan Spyware...Contact Windows Support 1+877-901-6855 (security Helpline)  click Deny or Allow"  I did neither and did not call that number.  I tried cntr+alt+del to force quit and it put me in a blank screen situation.  I shut down immediately.  After rebooting I moved all my data over to a thump drive, deleted all personal/vital information. Hard drive searches of that file ads.fiancetrack*.dll could not be found. I then Installed Malware Bytes and have been treading with extreme caution on this PC (Windows 11) ever since.  Also, I have been diligently scanning my TCP/UDP ports, using Netstat -a -o , and keep getting similar results with "ESTABLISHED CONNECTIONS" to unknwn IP's. Also my CNTL+ALT+DEL shows many active sessions of SVChost.exe;  I have attached my latest Netstat for review.  I also have attached the screen shot of this pop-up message.  Since installing Malwarebytes, nothing has been picked up.  but i am concerned with these many SVCHOST.exe sessions that keep popping up, as wells as not being able to identify the IP's that are establishing connections on my Netstat results.  Any help or advice is greatly appreciated.  Thank you so very much.   

services_details.doc mynetstat.txt

[Maurice Naggar]

That "screen" is a scam !  If that is on-screen now ...press and hold ALT-key and then tap the F4 function keys.

ALT +F4 is the double-key sequence to force a CLOSE of the window in foreground.

Repeat that action until each of the "scam" windows is gone.

Which web browser were you using?

Edited January 2, 2023 by Maurice Naggar
corrected typo

[h8tshaqz]

HI Maurice, 

This happened last month.  I took a pic of the screen with my phone.  Just uploaded by taking a picture of it (from my phone) with may laptop, then just attached.  

 

ty

[Maurice Naggar]

These here are the next steps ( after doing the ones above) if your PC has the Google CHROME browser.

Using just the Chrome browser, signin to your Google account ( if not signed in already)  https://chrome.google.com/
Then go to https://chrome.google.com/sync?
Scroll down the page, press the "CLEAR DATA" button, to clear the Chrome data from your Google account.

[   2   ]

for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line  "Browsing history"

Check mark the line "Download history"

Check mark the lined "Cached images and files"
and press Clear Data button  ( in blue )

[   3   ]

After that, make real sure that Chrome is "NOT" set to reload the pages from the last session

Go into the settings menu of Chrome by first clicking  the control icon of Chrome on upper right of the adress bar

Then look deeper in SETTINGS

Make real sure it is "NOT" set to "continue where you left off"

.

[   4   ]

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

[   5   ]

I suggest you install the Malwarebytes Browser guard for Chrome.

To get & install the Malwarebytes Browser Guard extension for Chrome,

 

Open this link in your Chrome   browser: 

https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

Then proceed with the setup

We will do more later. Please put away any "netstat" usage. By its very nature, Windows will have traffic 

[Maurice Naggar]

Those "screens" are fake / a scam / a lure to get you to call the phone number of the scammer, so that they can begin to scam you, plus also get your phone number.
Do all that I said above. You need to get to know how to identify scams. One big clue....anything that displays a phone number to call.
These scams typically do not have a "payload". But I do advise that you do what I listed before.

One must point out that the "fake display" did NOT come from "Windows Defender Security". All of that display was made-up by the scammer. It is unfortunate that the web-browser encountered that fake display.

Edited January 2, 2023 by Maurice Naggar
updated

[h8tshaqz]

Thank you Maurice.  Though  I am not using Chrome, I will try to follow similar steps using Firefox. 

[Maurice Naggar]

Y.W. Let me suggest that you get your browsers each, as applicable, to have the Malwarebytes Browser Guard.

See Support article how-to

https://support.malwarebytes.com/hc/en-us/articles/360038520374-Install-Malwarebytes-Browser-Guard

See Support article how-to for Firefox
https://support.malwarebytes.com/hc/en-us/articles/4413298841747--Install-Malwarebytes-Browser-Guard-on-Firefox-browser

For the EDGE browser https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser

Note: If the pc also has Opera or Brave or Vivaldi browser, you can install the Chrome version of the Malwarebytes Browser Guard ( on each as appropriate).

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10, or 11), or on Opera.

Scroll down to the tips section "How do I disable them".

Edited January 2, 2023 by Maurice Naggar

[Maurice Naggar]

Temporarily disable Microsoft SmartScreen to download the next software below 

I would recommend getting a readout report as to update status of some key apps.
Download SecurityCheck by glax24 from here

and save the tool on the desktop.

                   If Windows's  SmartScreen block that with a message-window, then
                         Click on the MORE INFO spot and over-ride that and allow it to proceed.

                             This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

When all done, you may go back to turn ON the EDGE Smartscreen protection.

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you