View original (French)

Help: fake virus scam

Solved
Noellflantier Posted messages 1 Registration date   Status Member Last intervention   -  
bazfile Posted messages 58498 Registration date   Status Moderator Last intervention   -
Hello,

I fell for a fake virus alert and granted access to a fake Windows support through AnyDesk. I’m worried about the security consequences for my PC and my data.
Moreover I receive Edge notifications every 3 minutes saying there is a virus on my PC, but it seems to be malicious ads.

Following indications found on other forum topics, I obtained the FRST reports below via Cjoint.

https://cjoint.com/c/LCvw3AQvrGr
https://cjoint.com/c/LCvw4DWeyur

Could someone help?

Thanks a lot

2 answers

  1.
    bazfile Posted messages 58498 Registration date   Status Moderator Last intervention   20 273
     
    Hello.
    Nothing new, it’s a very well-known scam, read carefully THIS PAGE everything is explained..

    What you got was simply a web page that gives you a fake support phone number, so it’s more of a scam than a real infection, if you call the number indicated and if you do what the scammer asks you to do on the line, you’ll be scammed out of a few hundred euros, and on top of that they install some fake and useless software that they charge a fortune for, what interests them is your money not what’s on your PC.

    - First, uninstall TotalAV this antivirus is a scam, uninstall it with RevoUninstaller in advanced scan mode (see tutorial at the end of the message).

    - Uninstall also WebAdvisor by McAfee it’s adware.

    - For Edge notifications and other infected or obsolete processes do the following:
    Procedure to follow in the given order:

    1- Open FRST as administrator by right-clicking on FRST and choosing run as administrator
    2 - Copy the entire script that is in the box below: 
    Start::
    CreateRestorePoint:
    CloseProcesses:
    Edge Notifications: Default -> hxxps://bingocaptchapoint.top; hxxps://goprotectpc.com; hxxps://www.facebook.com; hxxps://www.oui.sncf; hxxps://www.restaurantlabri-cotier.com; hxxps://www.science-et-vie.com; hxxps://www.sncf-connect.com
    R1 webshieldfilter; C:\WINDOWS\System32\drivers\webshieldfilter.sys [96264 2021-11-09] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
    Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\WINDOWS\System32\MbaeParserTask.exe (No file)
    S3 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe" [X]
    S2 mfemms; "C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe" [X]
    S3 mfevtp; no ImagePath
    S0 cfwids; system32\drivers\cfwids.sys [X]
    R0 mfeaack; system32\drivers\mfeaack.sys [X]
    R0 mfeavfk; system32\drivers\mfeavfk.sys [X]
    S0 mfeelamk; system32\drivers\mfeelamk.sys [X]
    S0 mfefirek; system32\drivers\mfefirek.sys [X]
    R0 mfehidk; system32\drivers\mfehidk.sys [X]
    R0 mfeplk; system32\drivers\mfeplk.sys [X]
    R0 mfewfpk; system32\drivers\mfewfpk.sys [X]
    S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
    FirewallRules: [TCP Query User{5E5FDBA1-D5C5-44C3-AC3B-807311DD5C7E}C:\users\melin\downloads\anydesk.exe] => (Allow) C:\users\melin\downloads\anydesk.exe => No file
    FirewallRules: [UDP Query User{982A8E4F-4A05-4793-B345-0769B664D195}C:\users\melin\downloads\anydesk.exe] => (Allow) C:\users\melin\downloads\anydesk.exe => No file
    FirewallRules: [{23C7CAA7-6CC5-43C2-87D8-3B381893C49E}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No file
    FirewallRules: [{44B77296-21C2-407D-A5B4-584CF44A3E53}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No file
    FirewallRules: [{F99A1ACD-C74A-486D-A0BA-AAA8A10B9339}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No file
    FirewallRules: [{B37191F1-18A4-44D9-AF98-6B27143C0922}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No file
    FirewallRules: [{B74F19F2-72A6-43EA-986B-E5CB19C8D52B}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No file
    FirewallRules: [{D693DE31-C701-4823-B07E-D12431B5FA84}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe => No file
    FirewallRules: [TCP Query User{332FB1D8-40DC-4EA2-9EE6-4256D8E22507}C:\users\melin\onedrive\bureau\anydesk.exe] => (Allow) C:\users\melin\onedrive\bureau\anydesk.exe => No file
    FirewallRules: [UDP Query User{1AE87CCC-A789-4E40-B760-C026A25ABCFB}C:\users\melin\onedrive\bureau\anydesk.exe] => (Allow) C:\users\melin\onedrive\bureau\anydesk.exe => No file
    EmptyTemp:
    End::

    3- Once the script is copied click on Fix, FRST automatically takes the script from the clipboard.



    Let the fix complete; when it’s finished you will be asked to restart your PC, do it as soon as you're asked, see below.
    Then once your computer restarts:
    4- You will have a Fixlog file on your desktop then send these reports to https://www.cjoint.com/ see this tutorial and then give the link generated by Cjoint in your next message.

    5- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT

    Uninstall the software with Revo Uninstaller in advanced scan mode.

    Revo Uninstaller tutorial to read carefully.






    Accept the uninstall of the program you want to uninstall and if there is an error message saying the uninstall is impossible, close the error message and continue the procedure.


    Check "Advanced scan" then click "Scan".


    Click "Select All" then "Delete"; if a second list appears do the same; once everything is deleted click "Finish" – a restart may be required.

    .

    .
    bazfile
    Moderator/Security Contributor.
    a hello, a reply, a thank you are always nice.
    1