Print this page | Go back to previous topic
Forum nameThe Computer Forum
Topic subjectRED Ransomware popup
Topic URLhttp://www.pcqanda.com/dc/dcboard.php?az=show_topic&forum=2&topic_id=565035
565035, RED Ransomware popup
Posted by wings515, Wed Mar-07-18 03:18 PM
Lately on two different PC's I've been getting the Ransomeware infection. I have run CCleaner, Malwarebytes, Privazer and Wize cleaner.
This occurs when I open Edge, Yahoo mail and no specific mail message.

Doing the Control Alt Delete and Ending the Edge process stops the ransom ware.

What else should I be scanning with to remove this annoying app?

Regards,
565037, RE: RED Ransomware popup
Posted by therube, Wed Mar-07-18 06:11 PM
Screenshot?

If may just be a phishing malware (malware ad), in which case there might not be anything to be found on your computer (particularly).

That it happens on 2 different computers is odd, making me think the above is less likely.


If you create a new, clean (Edge) Profile (can you do such a thing?) & visit Yahoo mail (I guess that is mail.yahoo.com?) do you still get the ransomeware popup?

Likewise if you start Edge in "safe mode" (again, does it have such a feature, like to disable all Plugins & extensions), does the issue persist?


If it is a malware ad, an ad blocker might help.
565041, RE: RED Ransomware popup
Posted by wings515, Thu Mar-08-18 03:30 PM
Thanks for the reply. I found Ad Guard and installed it on one of the PC's. I'll see if this prevents the pop up again.

Regards,
565067, RE: RED Ransomware popup
Posted by wings515, Wed Mar-14-18 12:41 AM

The virus popped up again so I did some more digging. Recalled Rkill so I did the download from Bleeping Computer. When I clicked on the Malwarebytes icon it would not execute the program. I remember there was a part of the virus that looked at the file name, so I changed it to something else and then ran the program.

Much to my surprise, 4 malware instances were found plus two instances of Trojan virus.

So I think all my problems have been solved.

My concern is how did these get in in the first place. I thought Webroot should have caught them. My bad.

Regards,
wings515