Windows 10 Fake Microsoft has locked your your computer, malware?

[MikeHawthorne]

Hi

My wife just got one of those Microsoft has locked your computer because you are using a fake version of Windows messages. This one even had an official sounding voice playing a threatening message.

The computer was locked up, so I Control Alt Deleted out and shut the computer down and rebooted.
Then I ran Malwarebytes Pro which she has installed on her laptop.

It came up clean, so with Windows Defender and Malwarebytes Pro installed and running it still popped up on Chrome.

Anybody know any way to block these things, I know what to do but every time it happens she thinks her computer is going to die.

I think that this is something that's all online, I don't think it actually installs anything on the computer, so it there a way to stop the browser allowing them.

I never get these things, probably because I don't do any of the social media things like Facebook and Twitter etc. which she does.

Mike

 

[Neemobeer]

Can you send a screenshot?

Could be a chrome plug-in, or a push notification pop up but without seeing it it would be hard to say how to block it.

 

[MikeHawthorne]

Hi

I can't the computer was frozen while it was on screen, and now it's gone.
I had to control alt delete to get out.

I have looked online for a sample of it, and while I've found many similar I can't find the one that Mary got hit with.
It said that your computer is locked because you are using an illegitimate copy of Windows, call this number, the thing that was different was that there was a voice message along with it threatening to format the hard drive or something like that.

In reality, I'm guessing that the only thing that was really locked was Chrome since the computer responded to control alt delete instantly.

If I can find an image of something that looks like it I'll post it. The surprising thing is that Malwarebytes Pro didn't catch it, that's what makes me think that it didn't actually download anything just hacked the browser somehow.

Anyway it hasn't come back so maybe it was a one-off, I have found some other reports of the same "Your Windows is not an authentic Windows installation.

Mike

 

[Neemobeer]

From a phone perhaps?

 

[MikeHawthorne]

It hasn't come back since I restarted the computer but if it does I'll try and get a picture of it.
I'm still surprised that Malwarebytes didn't stop it, I never have anything get through.

 

[rjlocal22]

Somehow a scammer was able to track her while online. I received a simular message that appeared to come from an authorized Microsoft repair agency. I even spoke over the phone with this man and realized he was a scammer. If it happens again, see about doing a search to see if changing your IP address that may stop this intrusion.

 

[Neemobeer]

These scams are fairly low tech and no they don't have the ability to track you or your IP unless you previously allowed them to connect and they installed something on your system that allowed them to track you. Generally they either cold call numbers and read a script and show you things like errors in the event viewer which most regular users don't know the difference.

 

[nmsuk]

SImple rule, Microsoft never directly phone. So any call saying we're microsoft is a scam. Just hang up on them, never let them connect with logmein and any emails just delete them.

 

[MikeHawthorne]

Hi

Mary has had this again and I've figured out that the computer isn't really locked, it's a full screen page that emulates your browser Window. Nothing works because it's only an image of the screen. The buttons aren't real but you think that your computer is locked up.

What it is doing it trying to get you to do is call the phone number on the screen to get support, I'm sure that if you do, they will offer to fix your computer for a fee.

All you need to do is close the browser.

I ran a scan afterwards and found nothing.

Mike

 

[rjlocal22]

Mike,
If you cannot take a screen shot, then try taking a picture with a camera and send that in.

 

[MikeHawthorne]

If it comes back I'll do that.

After I wrote that I looked online there are so many that it took a while but this seems to be the exact screen that my wife is getting on her computer.

I never get these things and we are both running Malwarebytes Pro.

I'm wondering if I have different security setting in Chrome somewhere.

 

[rjlocal22]

The area code and phone number is not part of the United States or Canada. Here is a website that has all area codes and you can do a search including the phone number: Link Removed
Someone outside both countrys is trying to scam you.
This site just has records of area codes for the U.S. and Canada only.