New(?) RDN/Trojan.worm Infection

[Mr.Mike]

Hi Fellow Nibblers,

Anyone seen this latest Badboy: RDN/Trojan.worm 055BCC3053861 infection?

My remote client has an AIO Dell 64bit Windows 10 system that shows what I believe is a new variant of what was the RDN/Trojan.worm 055BCCAC9FEC.

Before I have to pass this along to another tech in the area, is anyone aware of a remote fix? I instructed the client to boot into safe mode and tried a startup repair. No good. Ideas?

I appreciate any info you may have.

Mr.Mike

 

[Porthos]

Is it just a screen to call some phone #?

 

[Mr.Mike]

Thanks Porthos,

Yes, a wierd pink screen, then a female voice warning of the infection and that data his may be lost unless calling the phone number given.

New Info just now. Client says he got a call from "MS" saying there is a problem with his computer. So it's the obvious scam and had him shutdown. I know what to do. Thanks for your post.

Mr.Mike

 

[Porthos]

I figured as much. Good luck with your client. Hope they learn.

 

[callthatgirl]

That's what I was going to say! 2 scams in a row!

That first one might just be a browser hi jack?

 

[Porthos]

That first one might just be a browser hi jack?

And the second one a lucky (timing) scam phone call.

 

[Mr.Mike]

I hear you! Wouldn't be the first time for multiple attacks. Cheers!

 

[ohio_grad_06]

Last couple of cleanups I've done were a simple browser hijack of Microsoft edge.

 

[callthatgirl]

I use logmein and one of their websites has a hijacked lookalike. Many times I'll be telling the client to go to the logmein123..com and they go to the hijack site and I hear "WARNING WARNING...." and I'm yelling "close that window!" it's just a hijack, but never know.