Anyone seen this before? Weird pop-up.

Forums › Spark New Zealand (including Skinny and BigPipe) › Anyone seen this before? Weird pop-up.

quickymart

14940 posts

Uber Geek
+1 received by user: 13953

ID Verified

#179274 2-Sep-2015 21:21

While surfing tonight, the following browser window popped up several times. Restarting my Firefox resulted in it reloading several times, with the timer at the top right continuing to countdown. The page has been designed to look scary (and it mentions the NZ Police towards the end). Has anyone else seen this before, and is it legit? Note that I wasn't looking at any of the type of pages they state I was.

Coil

6614 posts

Uber Geek
+1 received by user: 2153
Inactive user

#1378566 2-Sep-2015 21:24

City: Tauranga, Region, Gisborne hahahahahahhahahahahaha

Finch

2862 posts

Uber Geek
+1 received by user: 195

#1378567 2-Sep-2015 21:24

Well if you haven't been looking that stuff up that it says you have been looking up, Im going to guess its a fake. Just trying to get your $$$

quickymart

14940 posts

Uber Geek
+1 received by user: 13953

ID Verified

#1378568 2-Sep-2015 21:25

I know :) I'm just about to update and run Malwarebytes and scan the machine but wanted to see if anyone had seen this before?

hyperman

418 posts

Ultimate Geek
+1 received by user: 101

#1378570 2-Sep-2015 21:26

looks like "ransomware" to me.....

The views expressed by me are not necessarily those of my employer

quickymart

14940 posts

Uber Geek
+1 received by user: 13953

ID Verified

#1378573 2-Sep-2015 21:35

A little Googling indicates this may be an "FBI Virus". Good thing I'm scanning my machine...like hell I'm paying anything!

raytaylor

4076 posts

Uber Geek
+1 received by user: 1296

Trusted

#1378636 2-Sep-2015 23:27

Its also known as the ukash virus - ransomware.

The ukash variant is known for encrypting your files and charging a fee to unencrypt them.

I would check the task manager and make sure there are no odd looking processes running that have image paths in weird places for exe files to be sitting - you can switch on the image path column to make it easier to see.

If you do see something that looks like it might be actively encrypting files then kill it and back up your document files.

But from your screenshot it appears its probbaly just a web browser window and should be okay. Check those processes anyway.

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

Dell

Shop now for Dell laptops and other devices (affiliate link).

quickymart

14940 posts

Uber Geek
+1 received by user: 13953

ID Verified

#1378666 3-Sep-2015 06:08

I ran Malwarebytes and it found an .exe that was suspicious and removed it - PUP.Optional.Amonetize. I suspect it was related to this pop-up.

Thanks for all the suggestions :)

dimsim

867 posts

Ultimate Geek
+1 received by user: 151

Trusted

Lifetime subscriber

#1378761 3-Sep-2015 09:20

I've been told by a client of a similar scam where it purported to be from the NZ Police and had used my clients webcam to take a photo of them to insert in the ransomeware page - now thats spooky.