New type of divorce
Few people on Habré use IE as their main browser, which cannot be said about our friends and acquaintances. Some of them use IE because of their habit or inertia, others simply do not know or are afraid of other browsers.
Recently, a new way of divorcing gullible users has appeared on the Internet. An add-in is added to the Internet Explorer browser, redirecting it to a page with Microsoft activation (replacing its source code). The page also says that now the browser is paid and you have to pay for it using SMS. Allegedly, the cost of using the browser is 30 rubles per year (although in fact it is removed about 100).
')
Treatment: SERVICE -> PROPERTY PROPERTIES -> ADDITIONAL -> RESET. After that, you can try to open any page in IE and see which add-in has been added, then delete the file associated with it.
It will be useful to check the hard drive with antivirus with fresh updates, or, for example, with antivirus utilities like CureIt or AVZ .
Recently, a bunch of services monetized, so the average user with a high probability can believe in such a message and send SMS. Warn people who are inexperienced in this matter.
UPD: Trojan.Win32.KillProc.am (Trojan-Ransom.Win32.BHO.a).
It is a Browser Helper Object and is embedded in the Internet Explorer browser. Entering the "legalization code" does not lead to unlocking, but to displaying the message "The code entered is incorrect." This message is hard coded directly in the code of the fake page.
Recently, a new way of divorcing gullible users has appeared on the Internet. An add-in is added to the Internet Explorer browser, redirecting it to a page with Microsoft activation (replacing its source code). The page also says that now the browser is paid and you have to pay for it using SMS. Allegedly, the cost of using the browser is 30 rubles per year (although in fact it is removed about 100).
')
Treatment: SERVICE -> PROPERTY PROPERTIES -> ADDITIONAL -> RESET. After that, you can try to open any page in IE and see which add-in has been added, then delete the file associated with it.
It will be useful to check the hard drive with antivirus with fresh updates, or, for example, with antivirus utilities like CureIt or AVZ .
Recently, a bunch of services monetized, so the average user with a high probability can believe in such a message and send SMS. Warn people who are inexperienced in this matter.
UPD: Trojan.Win32.KillProc.am (Trojan-Ransom.Win32.BHO.a).
It is a Browser Helper Object and is embedded in the Internet Explorer browser. Entering the "legalization code" does not lead to unlocking, but to displaying the message "The code entered is incorrect." This message is hard coded directly in the code of the fake page.
Source: https://habr.com/ru/post/44635/
All Articles