(In) Famous last words) ….

[dwynnehugh]

Although the TDSSKiller gives the OK on a scan, the original problem is still there.  A malware scan has indicated certain PUPs which have  all been quarantined and removed – w/o any effect on the original problem. Now getting to the stage where I’m beginning to suspect that the problem is more of a ‘bloody nuisance item’ than specific malware.

The more you meet people the more you understand why Noah took animals instead of humans

[Boris]

Dave, can you post a picture of what this original screen looks like ?

Never trust an atom - they make up everything !

[dwynnehugh]

I’ll do that asap.

The more you meet people the more you understand why Noah took animals instead of humans

[Ed P]

PUPs normally hide in the browser profile or run on start-up. The other action is to check what programs are allowed to run on start-up. I recommend using Autoruns (from the SysInternals Suite) to check on the latter.

[Ed P]

Just to add, if you use the ‘Everything’ tab you will probably get a shock on just how much autostarts. My tip would be to use the ‘Options’ tab and eliminate Microsoft etc from your search, After this it is a question of methodically going through the list and look up unknown publisher/programs on the web.

[dwynnehugh]

Hi John,

I attach the images from the screen.

The first one is in the taskbar and the latter the ‘on screen’ message.

 

Dave

The more you meet people the more you understand why Noah took animals instead of humans

[Ed P]

Dave what browser is being used? If Firefox, one very good PUP killer is to refresh Firefox. link

[Wheels-Of-Fire]

If you are going to give Autoruns from Sysinternals a go as Ed sudgests (and I think you will like it) then it is a good idea to go to options, scan options and tick verify signiature before hiding Microsoft entries. While you are there you can also tick check virus totals and every autorun entry will be sent to a bunch of online virus checkers.

Oh and dont worry about entries where a valid path name cant be found they will not cause problems.

[Boris]

Dave,

Do as Edp suggests.

Also read this for further info. about clearing it.

https://answers.microsoft.com/en-us/windows/forum/windows_10-security-winpc/microsoft-your-computer-has-been-blocked-error/06f36c65-3e7e-4238-8a6a-e911ad8ab329

Amended

 

.

Never trust an atom - they make up everything !

[Malcolm]

Hi Dwynne,

If that doesn’t work (it probably will).

Here’s an oldie but a Goldie, download Ultimate Boot CD link is here:

http://www.ultimatebootcd.com/

It contains F-prot Antivirus and as that runs in ‘Parted Magic’ the infected Windows partition will not even be asked to ‘run’ anything by the mini ‘Parted Magic’ Linux based operating system. Hopefully with a fully slave disc you’ll be able to clear it out.

For any guest readers – always virus check downloads.

[JayCeeDee]

Interestingly enough that UK phone number for “Microsoft Support” – 0151 808 0560 – has been reported in the last few days as a spam caller.

The dialogue box contains bad English – Debit and Credit Card Details which is end with(7012) – definitely dodgy.

[Wheels-Of-Fire]

By the way I cheat when it comes to using the Sysinternals utilities because I splashed out on the book “Windows Sysinternals Administrator’s Reference”

This is a really good book and the first chapter gives a brief overview of how Windows works internally too.

[Ed P]

Boris your link gives a ‘thread not available’ response.

[dwynnehugh]

Thanks for all of your inputs – unfortunately the past 3 weeks have been hectic and I will try some of the suggestions in the next week or so.

Thank you one and all.  Dave

The more you meet people the more you understand why Noah took animals instead of humans

[Boris]

Ed P wrote:

Boris your link gives a ‘thread not available’ response.

I’ve amended it

Never trust an atom - they make up everything !

[Author]

Posts