Bogus McAfee Hack

[jcgc50]

I use MWB premium and Windows Defender on a PC running Win 10. All of these are kept updated. Yesterday using MS Edge my spouse clicked a website link which linked to a site which apparently installed something somewhere which causes a notification to keep popping up claiming to be McAfee that reports either viruses or claims a system error wanting you to click it to fix the problem.

I've run MWB several times with no success and Defender. Performed a system restore which also didn't fix the problem. I'm attaching a photo of one of the popups. Looking for suggestions. Not sure if the website link will help but this is the site it tried to take us to, nothing was clicked on that site. (cactuscatsrescue.net)

[Maurice Naggar]

Hello @jcgc50 Step 1

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10 or 11), or on Opera.

Scroll down to the tips section "How do I disable them".

( 2 )

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

Attach the clean log from Adwcleaner when all completed.

Edited June 2, 2023 by Maurice Naggar

[jcgc50]

Thanks for that suggestion. I just discovered that the problem was a cookie that got picked up from that site pushing that ad. I found the joofte.co.in cookie in Edge and removed it. Appears to have fixed the problem.

Should MWB been able to identify that cookie and quarantined it or is there something that I need to enable for that?

 

Jim

[Maurice Naggar]

Please do a new scan with Malwarebytes like listed below.
Cookies in and of & by themselves can not & do not carry malicious payload. They are just a text-type file. Malwarebytes does not do anything on cookies. There are ways for you to have each web browser not accept third-party cookies.
We will later run a few other tools / scans to check some more for adwares. Upon further study of the image-above, this is in the nature of a SCAM type display. A fake display with obvious false claims.

Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes sca

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

Edited June 2, 2023 by Maurice Naggar

[jcgc50]

Checked for updates and it updated from 4.5.28 to 4.5.29 and did not require a restart. Nothing was found. Attaching the report.

By the way, rootkit isn't turned on by default. Should it be?

MWB Results.txt

[Maurice Naggar]

If you see the same-scam screen in future,  ...press and hold ALT-key and then tap the F4 function keys of the Keyboard.

ALT +F4 is the double-key sequence to force a CLOSE of the window in foreground.

As to Malwarebytes option, no, it is not needed to select the Scan for rootkit option. I seriously doubt there is any sort of "rootkit".

( 1 )

On some periodic basis, suggest to delete all Cache content on Chrome ( and ANY OTHER browser ) for "all time" period. That will help keep Chrome running more snappy.
open Chrome.
At the top right, click More .
Click More tools and then Clear browsing data.
Choose the time range All time.
Select the types of information that you want to remove.
Click Clear data.

By the way, the same principle applies to the Edge browser in Windows 11 / 10. Clearing all cache helps.

The section for EDGE browser how-to https://forums.malwarebytes.com/topic/286888-few-malwares-were-failed-to-removed/?do=findComment&comment=1517006

( 2 )

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply..

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks