Discussion Can you spot it?

[SyCoREAPER]

Not sure who's the bigger idiot, the malware creator or my dad.

Do you see it?

https://ibb.co/M52sjMMZ

 

[Cilantro7536]

Some sort of persistent web browser notification? Although it doesn't look very convincing, don't be too hard on your dad. We all need to learn.

BitDefender has a scam chatbot that can help figure out (or slow down) scams. Uploading the above image does get a warning.

https://scamio.bitdefender.com/chat

 

[USAFRet]

Not sure who's the bigger idiot, the malware creator or my dad.

Do you see it?

https://ibb.co/M52sjMMZ

Plenty of people have fallen for that type of scareware.

They even show up around here sometimes.

 

[SyCoREAPER]

Some sort of persistent web browser notification? Although it doesn't look very convincing, don't be too hard on your dad. We all need to learn.

BitDefender has a scam chatbot that can help figure out (or slow down) scams. Uploading the above image does get a warning.

https://scamio.bitdefender.com/chat

I wasn't, just told him not to touch it until I can come over. And I'm not talking behind his back, I have no problem saying it to his face. 👹

You're on the right track or at least at a high level.

Look at the taskbar.

 

[Cilantro7536]

Look at the taskbar.

You mean the "anti-edge" icon? So, it's an executable?

 

[SyCoREAPER]

You mean the "anti-edge" icon? So, it's an executable?

Indeed. That's where the bad actor's bad job gave away immediately what I need to look for. At this point it has to be, hopefully not baked any deeper than that like a spreadsheet in which case I'll never find it.

Makes you wonder why someone running a scam would make such a mistake unless it's intentional to easily weed out if it's theirs.

 

[rgd1101]

tell your dad, when in doubt do alt-f4 to close it out.

 

[SyCoREAPER]

I'm seeing him today. Yesterday told him to just shut it down until I can work on it.

Until I look at what it is, hopefully just ma/spyware and not some counting down ransomware.

Better safe than sorry because he notoriously doesn't back up, keeps stuff from years back, and can't remember where he put files. So extracting the files is near impossible if I like the drive. Not to mention its a work issued laptop which has licenses.

 

[COLGeek]

Make sure you have Hirens in your toolkit. Can come in handy depending on what you find.

 

[SyCoREAPER]

Make sure you have Hirens in your toolkit. Can come in handy depending on what you find.

Thanks, I'll have to check that out.
I haven't encountered this kind of stuff in a while and always used Spybot, Malwarebytes and HijackThis

Edit; Ahh it's a bootable/live disc.

Edit 2; This is why I should have 'Search on Page. Spent 5 minutes scrolling looking for Hirens in the list. Here I've been looking at all the tools included. Pretty impressive.
https://www.hiren.info/pages/bootcd

 

[COLGeek]

Thanks, I'll have to check that out.
I haven't encountered this kind of stuff in a while and always used Spybot, Malwarebytes and HijackThis

Edit; Ahh it's a bootable/live disc.

Yep. That can be very useful.

I used most recently with an elderly neighbor who allowed some joker (he actually called the number...) to lock him out of his PC.

 

[SyCoREAPER]

Yep. That can be very useful.

I used most recently with an elderly neighbor who allowed some joker (he actually called the number...) to lock him out of his PC.

I can at least give props and say my dad was smart or savvy enough to be suspect and not click it