Hello,

Windows10 Chrome -- month ago got a malware popup when on tunein radio. Along with the following popup, a voice came on and said "your pc is infected with Malware, do not ignore this, etc:

** Zeus Virus Detected  - Your Computer Has Been Blocked **

Error: Trojan Backdoor Hijack #365838d7f8a4fa5

---------------------------------------------------------------------

After running adwclnr v7 in safe mode I removed three unwanted objectes (PUP.LEGACY.OPTIONAL).

Few days ago, I got the zeus popup again so ran adwclnr in safe mode, but this time found no unwanted objects. Was really surprised nothing was found. 

Any thoughts as to why no PUPs found after getting zeus hijack? Any other suggestions for removing?

Thank you

 

Re: PUP.Legacy.Optional

Hi,

Don't panic, this is a classic "aggressive (scam) advertising" and a (real) false 'Zeus' alert! None zeus virus is present on your computer!

https://www.bleepingcomputer.com/virus-removal/remove-zeus-virus-detected-popups

https://blog.malwarebytes.com/threat-analysis/2017/06/the-numeric-tech-support-scam-campaign/

I've not seen yet MalwareBytes, ADWCleaner, HitmanPro, uBlock, adblock, antivirus, etc... detect or block these URL because it's change too much often. You can use NoScript plugin in Firefox, it can block few bad effect (tab can't be closed) of this scam advertising...

You can note the URL or IP used and add a rule to your firewall, antivirus, adblock plugin or in the Windows hosts file to block it next time your encounter this scam!

Re: PUP.Legacy.Optional

Thanks Bernard. Good point on adding to firewall if happens again. Was thinking same thing -- that it's not a real hijack or spyware. Glad to hear it from somebody with more IT proficiency. It only happens on one specific station on tunein, and I listen to a bunch so seems site specific. 

Re: PUP.Legacy.Optional

Addition to your protection, you can also add some form of Adblock to your security arsenal. uBlock does wonders blocking malicious pop-ups, and you will not get any scareware that might concern you in any way.