Question Possible hacker download attempt ?

[Cpt Snake]

OS: Windows 10

About every seven to ten days, I get a message that states:

"Sorry need to update your computer", and starts to download from [to?] my computer. The message is on a light blue background, with a tilted sad face in a block. I immediately shut down my computer and restart.
Is this a hacker attempting to gather information? It does not appear to be a MS update. It's only when I am on the internet. Any advise is appreciated. Thanks

 

[Lutfij]

A screenshot would actually help. I'd advise running Malwarebytes and seeing if you have any stowaways.

 

[COLGeek]

Have you scanned this system for malware?

Can you get an image of the screen and upload to a site like imgur.com and then post a link here?

 

[Cpt Snake]

Thanks for getting back. I had Glary Malware installed, but it did not stop the attempt. I am thinking about Bitdefender anti virus. I attempted to take a screen shot, but it is lost when I shut down the computer

 

[COLGeek]

Another to use is Hitman Pro.

 

[Cpt Snake]

Thanks, I'll try a screen shot again. Maybe, I did it incorrectly. I am not sure if the clip board is emptied when a computer is restarted. I'll find out next time. My understanding is that I just press the "prtsc" button. Take about 7 - 10 days before the next event

 

[USAFRet]

I am not sure if the clip board is emptied when a computer is restarted.

Yes it is.
You need to SAVE that somewhere.

 

[Bob.B]

Thanks for getting back. I had Glary Malware installed, but it did not stop the attempt. I am thinking about Bitdefender anti virus. I attempted to take a screen shot, but it is lost when I shut down the computer

Open file explorer expand pictures open screenshots.

 

[nuttynut]

It is strange, but being in your face like that, it seems like a prank. Also, the shortcut is Win + PrtSc.

 

[kanewolf]

About every seven to ten days, I get a message that states: Sorry need to update your computer, and starts to DOWNLOAD from my computer. The message is on a light blue background, with a tilted sad face in a block. I immediately shut down my computer and restart. Is this a hacker attempting to gather information? It does not appear to be a MS update. It,s only when I am on the internet. Any advise is appreciated. Thanks

One thing that might help is if you used PiHole as your DNS. You could then see what URLs are being accessed. If you have network hardware that is capable of blocking, you could put some IP and/or geographic blocks in place.

 

[Cpt Snake]

As soon as I get the screen shot, I'll post it. Maybe 7-10 days. TY

 

[Cpt Snake]

I was attacked just now. Pressed "prtsc" twice, shut down the computer, yet there was nothing on the clip board after the restart. Why??

 

[COLGeek]

I was attacked just now. Pressed "prtsc" twice, shut down the computer, yet there was nothing on the clip board after the restart. Why??

Because you have to "save" what you capture to a file before you shutdown. Pasting into Paint and then saving as JPG is the typical way to save the captured image.

You can also take a picture with a cell phone and upload that as previously discussed.

Have you looked at your list of installed programs for anything you don't recognize? Same for what is running in Task Manager.

Did you ever perform a full scan with Malwarebytes or Hitman Pro and remove all identified threats?

 

[Cpt Snake]

I see, well if I wait that long the damage will have been done. Hum. I'll try to be faster, next time and pin it in the clip board.

 

[USAFRet]

I see, well if I wait that long the damage will have been done. Hum. I'll try to be faster, next time and pin it in the clip board.

No, not the clipboard.
That does not survive a restart.

You must save it as a file (jpg or similar)

 

[Cpt Snake]

Thanks, Not enough time 20% is already downloaded from [to?] my computer, before I notice it. Humm?

 

[kanewolf]

Thanks, Not enough time 20% is already downloaded from [to?] my computer, before I notice it. Humm?

The simplest thing is to pull the network cable, rather than power off. Then you have time to review.....

 

[COLGeek]

The simplest thing is to pull the network cable, rather than power off. Then you have time to review.....

Good advice.

This would also allow you to thoroughly scan your system with the previously mentioned tools (that you download the installation files onto a USB drive on a different system). Those apps may want to update themselves, but ignore and scan.

 

[Cpt Snake]

OK, great, I'll give it a try. Is there a way to set the firewall to block download attempts. The hack does not allow me to approve the download, it just starts.

 

[USAFRet]

OK, great, I'll give it a try. Is there a way to set the firewall to block download attempts. The hack does not allow me to approve the download, it just starts.

"the firewall"

Which firewall?
If your system initiates something, the generic firewall will let it through.

 

[Cpt Snake]

I was referring to the Network Firewall. So, you think my system is allowing these download attempts?

 

[USAFRet]

I was referring to the Network Firewall. So, you think my system is allowing these download attempts?

Maybe/probably.
But as we out here have NO clue as to what this may be or looks like, we cannot estimate validity.

 

[Cpt Snake]

The strange thing is that windows 7 always allowed me to make a decision on whether not to allow a download. This thing starts without permission.

 

[JayGau]

If it only happens when you are browsing on the internet, it's probably something in your browser cache or cookies, or even an authorized site notification, maybe a plugin too. You could use another browser (like if you use Firefox, switch to Chrome) and see if it still happens. You could also clear cache and cookies, make sure you don't have any authorized notifications in the browser settings and uninstall plugins.

For the screenshot, there are several ways to take one without having to paste the clipboard in Paint. Nvidia app or Geforce Experience can do it, as well as the Xbox App. You can set a keyboard shortcut to take the screenshot and automatically write it to a predefined folder.

And by the way, hackers never notify you when they steal your files. When you see a pop up like that, it's usually to make you click on something that will install the real malware.

 

[Cpt Snake]

OK, Thanks. I had to ordered a internet cable splicer for a quick disconnect. No rush, this will take time. Thanks for all the help. When I get more info, I'll release it. 👍